W32/Virut.gen

This page shows details and results of our analysis on the malware W32/Virut.gen

Overview

W32/Virut.gen is a generic detection for the W32/Virut family of polymorphic, entry point obscuring (EPO) file infectors with IRC bot functionality.


Minimum Engine

5600.1067

File Length

Varies

Description Added

2007-06-29

Description Modified

2008-08-29

Malware Proliferation

Characteristics

-----Update on August 29,2008----

When this new variant of W32/Virut.gen  is executed, it injects its code into running processes.

It opens up backdoor on the compromised machine at port 80 (HTTP) but uses it for IRC communication.

This virus tries to connect to IRC server located at :

  • ircd.zief.pl

And joins the channel named: virtu

It can then receive commands to download and execute other malware on the infected machine.

-----------------------------------------------

 

W32/Virut.gen is a generic detection for the W32/Virut family of polymorphic, entry point obscuring (EPO) file infectors with IRC bot functionality.

It appends to the end of the last section of executable (PE) files an encrypted copy of its code. The decryptor is polymorphic and can be located either:

- Immediately before the encrypted code at the end of the last section

- At the end of the code section of the infected host in 'slack-space' (assuming there is any)

- At the original entry point of the host (overwriting the original host code)

The decryptor will either receive control directly or an API call within the host code body will be overwritten to point to it (EPO technique). In all cases where host code is overwritten by the virus the original bytes are stored within the encrypted virus body, and are restored before transfering control back to the host.

For further characteristics of specific variants, please check the various description for W32/Virut:

 

Symptoms

  • Modified executable files (increase in the size of exe files)
  • Unexpected DNS queries and IRC related network traffic

 

Method of Infection

W32/Virut.gen is a family of file infecting viruses. Infection starts with manual execution of the binary. Executables in network shares may also get infected if accessed by the compromised machine.

The virus has a number of bugs in its code, and as a result it may misinfect a proportion of executable files. In those cases of misinfection in which repair data is present within the virus body, and has not been miscalculated by it, the current DAT set will repair the virus as per the non-corrupted case. However, unfortunately, some W32/Virut.gen infections are corrupted beyond repair.

 

Removal

All Users:

Please use the following instructions for all supported versions of Windows to remove threats and other potential risks:

1.Disable System Restore .

2.Update to current engine and DAT files for detection and removal.

3.Run a complete system scan.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

1. Please go to the Microsoft Recovery Console and restore a clean MBR.

On windows XP:

Insert the Windows XP CD into the CD-ROM drive and restart the computer.
When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
Select the Windows installation that is compromised and provide the administrator password
Issue 'fixmbr' command to restore the Master Boot Record
Follow onscreen instructions
Reset and remove the CD from CD-ROM drive.


On Windows Vista and 7:

Insert the Windows CD into the CD-ROM drive and restart the computer.
Click on "Repair Your Computer"
When the System Recovery Options dialog comes up, choose the Command Prompt.
Issue 'bootrec /fixmbr' command to restore the Master Boot Record
Follow onscreen instructions
Reset and remove the CD from CD-ROM drive.

Variants