Worm_Kelvir.EL may be downloaded unknowingly by a user when visiting malicious Web sites.

It may also arrive via the instant messaging application MSN Messenger.

It sends a message, which is in Spanish, that contains a link pointing to a remote copy of itself. It uses the instant messaging application MSN Messenger to send its messages. The message it sends has the following details:


mira esta animacion de bush
http://{BLOCKED}deosgratis.gratishost.com/bush.exe

The message uses a known political figure to entice users into clicking on the link. The said message may also appear to be from a known contact to trick users into clicking on the link.

Once recipients click on the link, a copy of this worm is downloaded on recipients' systems.

Technical details can be found at this Trend Micro page.