W32/Anivip is a virus. The virus will infect Windows systems and spreads through drives, infecting various file types.

Upon execution, the virus creates an event named "my computer has a virus" so that only one instance of the virus runs on the infected computer.

It then tries to download a file from http://www.q520.cn/i(Blocked) and save it as ip.txt.

If the file is downloaded successfully, the virus searches through all removable drives and infects all the files having the extension .asp, .php and .htm.

The worm avoids infecting files present in the Temp folder and the files having the following strings in their name:

q520
88kv
ac66
136136

The virus infects the files by adding a hidden IFRAME tag which points to the URL
http://www.q520.cn/qq/inde(Blocked)

Upon execution of an infected file, the malicious IFRAME causes the download of the files, which exploit the Microsoft Windows Cursor And Icon ANI Format Handling Remote Buffer Overflow Vulnerability (BID 23194).

The exploit code then tries to download a malware from the URL http://www.q520.cn/qq/28.exe

This virus first appeared on April 22, 2007.

 Other names of W32/Anivip Virus:

This virus is also known as W32.Anivip.