Active Scan. Scan your PC free
Download Cloud Antivirus Gratis

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.


Threat LevelModerate threatDamageHighDistributionNot widespread
Common name:Elkern.C
Technical name:W32/Elkern.C
Threat level:Low
Alias:W32/Elkern.cav, W32.Elkern.4926

It deletes files and tries to disable the permanent protection of certain antivirus programs.

Affected platforms:

Windows 2003/XP/2000/NT/ME/98/95

First detected on:April 17, 2002
Detection updated on:June 19, 2006
Proactive protection:
Yes, using TruPrevent Technologies
Repair utility:Panda QuickRemover

Brief Description 


Elkern.C is a virus that reaches computers inside a dangerous worm called Klez.I. It spreads via e-mail and only affects Windows 98 and Windows 2000 computers.

It is very easy to become infected by this virus, as it is automatically activated when the e-mail message is viewed through Outlook's Preview Pane. It does this by exploiting a vulnerability in Internet Explorer, which allows e-mail attachments to be automatically run. This vulnerability exploit is known as Exploit/iFrame.

Elkern.C can delete certain files and carries out actions aimed at making certain antivirus programs unusable.

Visible Symptoms 


Elkern.C reaches computers in a message with a variable subject. The most common subjects are:

  • A powful tool
  • Worm Klez.E immunity
  • A funny website.

For more information about the message that carries Klez.I, consult the section Means of transmission.

Another symptom of Elkern.C is the disappearance of the permanent protection icon of certain antivirus programs.