Systems Affected:


Win32.Virut virus is also known as:

• Win32/Virut (CA)
• Virus.Win32.Virut (Kaspersky)
• W32/Virut (Norman)
• W32/Virut (Sophos)
• W32/Virut (McAfee)
• W32.Virut (Symantec)
• W32.Virut.A
• W32.Virut.h (McAfee)
• W32.Virut.R (Symantec)
  

Characteristics:

When W32/Virut.h is executed it injects its code into running processes.
This virus tries to connect to IRC server located at:

• eirod.zief.pl

And joins the channel named: virtu

• http://85.114.[REMOVED]/ ~grander/[MALWARE].exe

Symptoms:

The following symptoms may be indicative of a Virus:Win32/Virut infection:

• Network traffic on TCP port 65520 with connection to IRC server proxima.ircgalaxy.pl, on channel &virtu
• Increase in file size of infected files
  
• Infected files fail during execution and have a recent modified date property
• Modified executable files (increase in the size of exe files)
• DNS queries to eirod.zief.pl and IRC related network traffic
  

Method of Infection:


When W32.Virut.A is executed, it performs the following actions:

1. Creates the event named "VT_3", so that only one instance of the threat runs on the compromised computer.
2. Attempts to infect any accessed .exe or .scr files by appending itself to the executable.
3. It avoids infecting files with the following strings in the file name:
   
   • WC32
   • WCUN
   • WINC
     
4. Opens a back door on TCP port 65520 by connecting to the Proxima.ircgalaxy.pl IRC server on channel &virtu.
   
5. The back door allows an attacker to download files onto the compromised computer.

Prevention

Steps

Take the following steps to help prevent infection on your systems:

• Enable a firewall on your computer.
• Get the latest computer updates.
• Use up-to-date antivirus software.
• Use caution with attachments and file transfers.

Enable a firewall on your computer
Use a third-party firewall product or turn on the Microsoft Windows XP Internet Connection Firewall.
To turn on the Internet Connection Firewall in Windows XP

1. Click Start, and click Control Panel.
2. Click Network and Internet Connections. If you do not see Network and Internet Connections, click Switch to Category View.
3. Click Change Windows Firewall Settings.
4. Select On.
5. Click OK.
   

Get the latest computer updates:


To turn on Automatic Updates in Windows XP

1. Click Start, and click Control Panel.
2. Click System.
3. Click Automatic Updates.
4. Select a setting. Microsoft recommends selecting Automatic. If you do not choose Automatic, but you choose to be notified when updates are ready a notification ballon appears when new downloads are available to install. Click the notification balloon to review and install the updates.

Use up-to-date antivirus software:
Most antivirus software can detect and prevent infection by known malicious software. To help protect you from infection, you should always run antivirus software that is updated with the latest signature files. Antivirus software is available from several sources.
Use caution with attachments and file transfers
Exercise caution with e-mail and attachments received from unknown sources, or received unexpectedly from known sources. Use extreme caution when accepting file transfers from known or unknown sources.


Removing W32.Virut:

To detect and remove Win32/Virut, run a full-system scan with up-to-date antivirus software such as the Microsoft online scanner (available at http://safety.live.com). For other security software options, visit http://www.microsoft.com/athome/security/downloads/default.mspx

Before running full-system scan, make sure you disable your system restore (Windows Me/XP).

To disable system restore:

Windows ME and XP utilize a restore utility that backs up selected files automatically to the C:\_Restore folder. This means that an infected file could be stored there as a backup file, and VirusScan will be unable to delete these files. You must disable the System Restore Utility to remove the infected files from the C:\_Restore folder.

WindowsME

1. Right click the My Computer icon on the Desktop and click on Properties.
2. Click on the Performance tab.
3. Click on the File System button.
4. Click on the Troubleshooting tab.Put a
5. Check mark next to 'Disable System Restore'.
6. Click the 'OK' button.
7. You will be prompted to restart the computer. Click Yes.

Note: To re-enable the Restore Utility, follow steps one to seven and on step five remove the check mark next to 'Disable System Restore'.

WindowsXP

Disabling the System Restore Utility (Windows XP Users)

1. Right click the My Computer icon on the Desktop and click on Properties.
2. Click on the System Restore tab.
3. Put a check mark next to 'Turn off System Restore on All Drives'.
4. Click the 'OK' button.
5. You will be prompted to restart the computer. Click Yes.

Note: To re-enable the Restore Utility, follow steps one to five and on step three remove the check mark next to 'Turn off System Restore on All Drives'.