Guest ~BD~ Posted February 12, 2009 Posted February 12, 2009 Researchers have identified a new strain of malware that can spread rapidly from machine to machine using a variety of infection techniques, including the poisoning of webservers, which then go on to contaminate visitors. The malware is a variation of a rapidly mutating virus alternately known as Virut and Virux. It has long proved adept at injecting itself into executable files, which are then able to attack uninfected machines through network drives and USB sticks. The variant, which Microsoft is calling Virus:Win32/Virus.BM, is also able to infect web scripts based on languages such as PHP, ASP, and HTML. Servers that become infected include an iframe in webpages that attempt to spread malware to visitors. "This catapults the possibility of spreading even farther," Trend Micro researchers warn. "If the script files happen to be uploaded to a publicly accessible website, any visitor to the affected sites will be led to the URL embedded in the iframe code." The iframe surreptitiously directs visitors to zief.pl (don't visit it unless you're a security professional), which attempts to exploit a variety of vulnerabilities based on the browser and other applications the user has installed, Microsoft researchers say. Once installed, the virus injects its code into various system processes such as explorer.exe and winlogon.exe and hooks low-level Windows APIs to ensure it stays in memory. The virus has also picked up some new polymorphic tricks designed to make it harder for anti-virus programs to detect. Among other things, it uses more than one layer of encryption, allowing its binary fingerprint to change but to preserve its malicious payload. Infected machines will have an IRC backdoor installed that tries to connect to several servers using port 80. ® http://www.theregister.co.uk/2009/02/12/new_virut_strain/ Quote
Guest John Doe Posted February 12, 2009 Posted February 12, 2009 So, what's the fix for a machine infected with this malware? "~BD~" <~BD~@nomail.afraid.com> wrote in message news:ujKytmOjJHA.1252@TK2MSFTNGP03.phx.gbl...<span style="color:blue"> > Researchers have identified a new strain of malware that can spread > rapidly from machine to machine using a variety of infection techniques, > including the poisoning of webservers, which then go on to contaminate > visitors. > > The malware is a variation of a rapidly mutating virus alternately known > as Virut and Virux. It has long proved adept at injecting itself into > executable files, which are then able to attack uninfected machines > through network drives and USB sticks. > > The variant, which Microsoft is calling Virus:Win32/Virus.BM, is also able > to infect web scripts based on languages such as PHP, ASP, and HTML. > Servers that become infected include an iframe in webpages that attempt to > spread malware to visitors. > > "This catapults the possibility of spreading even farther," Trend Micro > researchers warn. "If the script files happen to be uploaded to a publicly > accessible website, any visitor to the affected sites will be led to the > URL embedded in the iframe code." > > The iframe surreptitiously directs visitors to zief.pl (don't visit it > unless you're a security professional), which attempts to exploit a > variety of vulnerabilities based on the browser and other applications the > user has installed, Microsoft researchers say. Once installed, the virus > injects its code into various system processes such as explorer.exe and > winlogon.exe and hooks low-level Windows APIs to ensure it stays in > memory. > > The virus has also picked up some new polymorphic tricks designed to make > it harder for anti-virus programs to detect. Among other things, it uses > more than one layer of encryption, allowing its binary fingerprint to > change but to preserve its malicious payload. > > Infected machines will have an IRC backdoor installed that tries to > connect to several servers using port 80. ® > > http://www.theregister.co.uk/2009/02/12/new_virut_strain/ > > </span> Quote
Guest David H. Lipman Posted February 12, 2009 Posted February 12, 2009 From: "John Doe" <johndoe@microsoft.com> | So, what's the fix for a machine infected with this malware? It, virut, is a true file infecting virus. In this case running an anti virus application that cleans the files of the added code, out side the OS, will clean the computer. McAfee is such an anti virus application which recognizes this as Virut.n -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp Quote
Guest FromTheRafters Posted February 13, 2009 Posted February 13, 2009 How much confidence do you expect in the results? Flatten and rebuild if you demand high confidence. After all, that is why you backed up the system prior to infection in the first place. The malware itself can probably be removed by any detector that recognizes it (most do provide removal). To me, a backdoor will introduce the 'unknown' into the mix - as will a trojan downloader. That is why you might have to consider a clean slate. "John Doe" <johndoe@microsoft.com> wrote in message news:%23wz5tgVjJHA.956@TK2MSFTNGP05.phx.gbl...<span style="color:blue"> > So, what's the fix for a machine infected with this malware? > > "~BD~" <~BD~@nomail.afraid.com> wrote in message > news:ujKytmOjJHA.1252@TK2MSFTNGP03.phx.gbl...<span style="color:green"> >> Researchers have identified a new strain of malware that can spread >> rapidly from machine to machine using a variety of infection techniques, >> including the poisoning of webservers, which then go on to contaminate >> visitors. >> >> The malware is a variation of a rapidly mutating virus alternately known >> as Virut and Virux. It has long proved adept at injecting itself into >> executable files, which are then able to attack uninfected machines >> through network drives and USB sticks. >> >> The variant, which Microsoft is calling Virus:Win32/Virus.BM, is also >> able to infect web scripts based on languages such as PHP, ASP, and HTML. >> Servers that become infected include an iframe in webpages that attempt >> to spread malware to visitors. >> >> "This catapults the possibility of spreading even farther," Trend Micro >> researchers warn. "If the script files happen to be uploaded to a >> publicly accessible website, any visitor to the affected sites will be >> led to the URL embedded in the iframe code." >> >> The iframe surreptitiously directs visitors to zief.pl (don't visit it >> unless you're a security professional), which attempts to exploit a >> variety of vulnerabilities based on the browser and other applications >> the user has installed, Microsoft researchers say. Once installed, the >> virus injects its code into various system processes such as explorer.exe >> and winlogon.exe and hooks low-level Windows APIs to ensure it stays in >> memory. >> >> The virus has also picked up some new polymorphic tricks designed to make >> it harder for anti-virus programs to detect. Among other things, it uses >> more than one layer of encryption, allowing its binary fingerprint to >> change but to preserve its malicious payload. >> >> Infected machines will have an IRC backdoor installed that tries to >> connect to several servers using port 80. ® >> >> http://www.theregister.co.uk/2009/02/12/new_virut_strain/ >> >></span> > > </span> Quote
Guest elyax7 Posted February 13, 2009 Posted February 13, 2009 "~BD~" wrote: <span style="color:blue"> > Researchers have identified a new strain of malware that can spread rapidly > from machine to machine using a variety of infection techniques, including > the poisoning of webservers, which then go on to contaminate visitors. > > The malware is a variation of a rapidly mutating virus alternately known as > Virut and Virux. It has long proved adept at injecting itself into > executable files, which are then able to attack uninfected machines through > network drives and USB sticks. > > The variant, which Microsoft is calling Virus:Win32/Virus.BM, is also able > to infect web scripts based on languages such as PHP, ASP, and HTML. Servers > that become infected include an iframe in webpages that attempt to spread > malware to visitors. > > "This catapults the possibility of spreading even farther," Trend Micro > researchers warn. "If the script files happen to be uploaded to a publicly > accessible website, any visitor to the affected sites will be led to the URL > embedded in the iframe code." > > The iframe surreptitiously directs visitors to zief.pl (don't visit it > unless you're a security professional), which attempts to exploit a variety > of vulnerabilities based on the browser and other applications the user has > installed, Microsoft researchers say. Once installed, the virus injects its > code into various system processes such as explorer.exe and winlogon.exe and > hooks low-level Windows APIs to ensure it stays in memory. > > The virus has also picked up some new polymorphic tricks designed to make it > harder for anti-virus programs to detect. Among other things, it uses more > than one layer of encryption, allowing its binary fingerprint to change but > to preserve its malicious payload. > > Infected machines will have an IRC backdoor installed that tries to connect > to several servers using port 80. ® > > http://www.theregister.co.uk/2009/02/12/new_virut_strain/ > > > </span> Quote
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.