[zovat]

Looks like symantec have already released an update, and defined the virus as below :

http://securityresponse.symantec.com....kelvir.a.html

although the payload (from people who have told me they followed the link) also appears to install some spyware...
__________________

From that link - you have to follow the link in the popup - then it starts to autoinfect - so as long as you don't :

a) follow the link
and b) accept the download

you should be ok

Originally Posted by Symantec

When W32.Kelvir.A is executed, it performs the following actions:

1. Sends the following message to Windows Messenger contacts:

Message:
omg this is funny!
[Link to the jose.rivera4.home.att.net domain]

2. If the link is clicked, W32.Kelvir.A downloads a file and executes it.

3. Upon execution, the worm attempts to download a file from home.comcast.net domain and saves it as c:\patch.exe.

4. Attempts to download an additional file from www.yoursite.com domain. The downloaded file is a W32.Spybot.Worm variant.

Note: At the time of this writing, the file was unavailable.

5. When the downloaded file is executed, it moves itself to the following file:

* %System%\hotkeysvc.exe (with attributes hidden, read only and system)

6. Adds the value:

"CPQHotkeys" = "hotkeysvc.exe"

to the registry keys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run
HKEY_CURRENT_USER\System\CurrentControlSet\Control \Lsa
HKEY_CURRENT_USER\Software\Microsoft\Ole
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Contro l\Lsa
HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
HKEY_USERS\.default\Software\Microsoft\Windows\Cur rentVersion\Run
HKEY_USERS\.default\System\CurrentControlSet\Contr ol\Lsa
HKEY_USERS\.default\Software\Microsoft\Ole

so that a W32.Spybot Worm variant runs every time Windows starts.

7. Sets the following registry key to disable DCOM:

HKEY_LOCAL_MACHINE\Software\Microsoft\Ole\"EnableD COM" = "N"