Win32/Cervivec.A Worm

 Information about the Win32/Cervivec.A worm:

Win32/Cervivec is an email worm. This worm will infect Windows systems.

The worm arrives as an email message. The body of the mail varies and consists of different languages. This mail contains an infected attachment Ntkrnl.exe. Upon execution of the attachment, it displays a dialog with no title with the following message "Press restart button to close this application". When the user clicks on OK button, the worm executes itself and displays a set of colorful worms filling the desktop area. The worm copies itself to Windows System directory as Ntkrnl.exe.

The worm makes necessary modifications to registry at the following locations to load itself at next system startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

During next startup, in an ICQ installed computer, the worm tries to collect email addresses in ICQ contact list. Later on, it sends infected mails to them using its own SMTP engine.

This worm first appeared on 22nd March 2002.

 Other names of Win32/Cervivec.A worm:

This worm is also known as W32/Cervivec, I-worm, Cervivec.A, Worm_Cervivec.A.