W32.Kelvir.II

[TJ]

W32.Kelvir.II is a worm that spreads through MSN Messenger and downloads a copy of another threat, which is a Backdoor.Sdbot variant.

When W32.Kelvir.II is executed, it performs the following action:

   1. Sends the following message to all the MSN Messenger contacts on the compromised computer:

      loool sure fat ppl is the best target for jokes hehe
      [http://]Personal0457.dynu.net/[REMOVED]/jokes.php?sec=fats&clip=06

      Note: If a recipient clicks on the URL above a copy of a Backdoor.Sdbot variant will be downloaded and executed on their computer. This variant has back door capabilities that can give a remote attacker access to the compromised computer via IRC.

REMOVAL INSTRUCTIONS
See: http://securityresponse.symantec.com/avcenter/venc/data/w32.kelvir.ii.html