Kelvir.B

[rdsu]

Hi,

When the avast team release the definition for Kelvir.B?

Secunia >> Virus Information >> Kelvir.b

Regards

[DavidR]

Kelvir.b - Description:
W32.Kelvir.B is a worm that spreads through Windows Messenger and MSN Messenger and attempts to download and execute a variant of W32.Spybot.Worm.

Exercising common sense and watching what links that you choose to click on (especially those unsolicited messenger pop-ups) should see you are OK in the meantime. Since it would appear that it tries to download a variant of w32.spybot, that may be detected on a generic level by avast, possibly limiting the damage potential.

[lee16]

Yea a mate of mine got infected by this yesterday and it started attempting to infect everyone on his list, luckily i known not to accept .pif files, and certainly not anything which is a Dos file, lol.
It basically shuts down all protection you have as well (his NIS was completely disabled, and he can't enable it again).
Also goes for all your OS accounts, and just keeps downloading more crap.
I've already taken a procation of blocking all URL with .Pif in them, only thing left now is to check it. 

So if you know what your doing, your are 100% fine

--lee

[lee16]

Kelvir.B and other were added today (8/3/05) 

--lee

[rdsu]

More than 1 day of delay...

[lee16]

More than 1 day of delay...

Well it depends on the rate of infection and so on, if you add a virus/worm quickly, exceptionally advanced ones like this, it may not be removed properly because it wasn't fully analyzed.

So i feel this was a good response time, well done alwil.

--lee

[DavidR]

I too think the response is ok, considering the threat level of low and spread of low from many different sources.

Especially when a degree of common sense should have proved an adequate protection in the short term and since this technically only effected those using IM, limiting the potential for infection.