Win32:Cervivec

is a very simple worm written in Delphi, packed with UPX and most probably of Czech origin. It saves itself under the name ntkrnl.exe into the system directory and adds the key into the registry so it is activated on each system start.

It displays special effects on the monitor - color lines which look like worms fill the complete screen.

The worm sends itself in the form of ZIP file, so the program cannot be activated directly. It uses psychological methods for forcing the user to activate itself. It does not have any destructive payload.

It sends itself to all ICQ contacts found on the infected computer. Infected message could be written in different languages:
Czech:     Cervici
           Cau posilam ti cerviky tak se na to podivej (virus to neni)
Slovak:    Cervici
           Cau posielam ti cerviky tak sa na to pozri (virus to neni)
German:    Witz
           Hallo, Ich habe ein guter Witz-Wurm so sieh! (kein virus)
French:    blague
           J'ai une bonne blague ca s'appelle verre de terre alors 
           jette un coup d'oeil (il n'y a pas de virus)
English:   Joke
           Hi, I have some cool joke - worms so have a look at it (no virus)
Polish:    Zart
           I   Czesc, mam swietnz dowcip - robaka. Obejrzyj go sobie (to nie jest wirus)
Spanish:   Chiste
           Hola te mando los gusanilloes. Pues mirarlos (no es un virus)

Any avast! with VPS file dated on or after 23th March 2002 is able to detect this worm.