W32/ElKern-B is capable of
infecting file cavities so as not to change the file size. This virus
is carried and dropped by W32/Klez.
Under Windows 98/ME, this virus copies itself to the Windows system directory
as the hidden file named Wqk.exe and sets the registry key
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\WQK to point to this, so as
to run on every reboot.
Under Windows 2000, this virus copies itself to the Windows system directory
as the hidden file name Wqk.dll and sets the registry key
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs to point
to this, so as to run on every reboot