4/29: Kelvir-D an IM Worm
April 29, 2005

W32/Kelvir-D is an instant messenging worm that spreads by sending a message through Windows Messenger to all of an infected user's contacts.

W32/Kelvir-D arrives attached to the message that encourages the recipient to visit a web page to download an update and reads:

lol! see it! u'll like it.

W32/Kelvir-D also attempts to download and execute ME.JPG and FILE.EXE files from the predefined websites.

The ME.JPG file is detected by Sophos as W32/Rbot-XA.

More information can be found at Sophos page.