Home > Insights > Blogs 

CA Community

This Blog

Infectious Virut on the Loose

Published: February 09 2009, 05:29 PM
by Methusela Cebrian Ferrer

CA ISBU asks that users stay alert to the latest Win32/Virut variant in-the-wild, which we detect as Win32/Virut.17408.

Win32/Virut.17408 is a polymorphic cavity “space filler” virus. Its entry point obscuring technique ensures that each file is infected in a unique way, which often complicates creation of detection and cure.

Aside from infecting executable files, Virut also targets HTML files, as highlighted in this image:

Example of Win32/Virut.17408 infecting HTML files 

The HTML file is modified to include this small piece of code:

Example of HTML file modified to include a small bit of code 

Examining the URL, we discovered yet another level to Virut’s attack and distribution vector. The image below represents the attack sequence that leads to installation and execution of a Win32/Virut variant once a user executes a Virut-infected HTML file or visits a compromised website:

Example of sequence that leads to installation and execution of Win32/Virut variant 

The malicious script invokes a different attack routine that exploits known vulnerabilities such as:

Win32/Virut then links to the malicious URL and downloads its executable by using the legitimate objects XMLHttpRequest, MSXML2.ServerXMLHTTP, and MSXML2.XMLHTTP. These objects are uniquely identified in the system registry with the following CLSIDs:

  • 0006F033-0000-0000-C000-000000000046
  • 0006F03A-0000-0000-C000-000000000046 
  • 06723E09-F4C2-43C8-8358-09FCD1DB0766
  • 639F725F-1B2D-4831-A9FD-874847682010
  • 6414512B-B978-451D-A0D8-FCFDF33E833C
  • 6E32070A-766D-4EE6-879C-DC1FA91D2FC3
  • 7F5B7F63-F06F-4331-8A26-339E03C0AE3D
  • AB9BCEDD-EC7E-47E1-9322-D4A210617116
  • BA018599-1DB3-44F9-83B4-461454C84BF8
  • BD96C556-65A3-11D0-983A-00C04FC29E30
  • BD96C556-65A3-11D0-983A-00C04FC29E36
  • D0C07D56-7C69-43F1-B4A0-25F5A11FAB19
  • E8CCCDDF-CA28-496B-B050-6C07C962476B

Once successful, Virut downloads an executable with a random filename and saves it in the %Temp% folder, as indicated in this URL string:

hxxp://www.zief.pl/rc/load.php?id<string>=&spl=<string>

Note: %Temp% is a variable location and refers to the directory designated for temporary files. The malware determines the location of the current Temp folder by querying the operating system. A typical path is "C:\Documents and Settings\<username>\Local Settings\Temp", or "C:\WINDOWS\TEMP".

It also uses “ADODB.Stream” and “Shell.Application” objects to transfer the malicious file via the user’s browser. If none of these attacks are successful, the virus invokes its PDF function as indicated in this URL string:

hxxp://www.zief.pl/rc/pdf.php?id=<generated ID>

This generates an exploited PDF file which contains malicious JavaScript that also leads to installation and execution of the Virut variant.

Wondering how it’s luring victims on the Internet? We searched through Google and found a couple of MySpace user pages carrying the malicious Virut URL.

Example of URL to Win32/Virut variant appearing on MySpace web page 

Example of URL to Win32/Virut variant appearing on MySpace web page 

Example of URL to Win32/Virut variant appearing on MySpace web page 

Unfortunately, this URL points to the file “Iraq.jpg”, which directs users to malicious JavaScript. The JavaScript leads to a series of browser attacks, and thereafter to successful execution of the malware.

To keep your computer/network safe from this threat, it is very important to regularly check and apply security updates; make sure your security scanner’s real-time option is turned “ON”; and ensure your security software is up-to-date with the latest signature release.

Stay safe, stay informed!

Share this post:  EmailEmail

By: Methusela Cebrian Ferrer
Methusela “Meths” Cebrian Ferrer joined CA ISBU in mid 2008 as Senior Researcher leading Internet Security Intelligence initiative. Her focus is proactive research, identifying emerging and prevalent threats to provide strategic security response through product solutions, internal & external awareness...
Read More..

10 people have left comments:

This virus attacked my web-server and resulted in my having to completely reinstall.

I wrote a script to get rid of the code injection into HTML pages (it also affects php and some others) - it is available at www.cedit.biz/.../25-repair-ziefpl-iframe-injection.html to anyone that needs to clear their system of this nasty attack.

Posted by: David Barrett | February 11, 2009 3:22 PM

I have two clients who have been attacked by this virus. CA still seems unable to completely clear it, and it also seems to install ndisio.sys as the "Pasthru" service. It will then attempt to attach another network service to all of your adapters.

This one is SERIOUS and I haven't quite enough info yet on how to stop/fully remove it.

Posted by: Ken | February 11, 2009 8:01 PM

Microsoft has also posted about the new Virut going around, they don't call it 17408 but Virut.BM

I still have one system I left infected to try and figure out the best way to remove it, short of a complete wipe.

Posted by: Michael Williams | February 12, 2009 12:08 AM

Just a quick follow-up, I did a scan using the MS online scan with the infected drive in another PC and it did clean the infections on all but one file, which I deleted manually.  I've run CA, AVG & Norton on the drive and they are all coming up clean.

Posted by: Michael Williams | February 12, 2009 3:22 AM

I've had a couple of these - CA gets rid of the virus, but seems to ignore pretty much all of the other crap it puts on the machine. From what I've seen, it will also add a few drivers, stick temp files that reload it, and download other things like "XP 360 antivirus". only way to remove completely that I've found is clean the virus with CA, use ERD to disable suspicious drivers and then move the files, run combofix and then scan with malwarebytes to clean up the last few bits.

Posted by: ladadeda | February 16, 2009 9:17 PM

Hello to all.  Just to warn everyone about this thread. This virus will be recognized by other anitivrus produts as a "new win32" or "new poly win32" but not remove it. In my case to one of our customers, they had another commercial antivirus, wich places ALL the infected executables, including the SYSTEM EXE's into quarantine, causing the system completely unusable!.  in this case i still had acces though to the infected server.  Best shot would be to map all the drives of the infected computer to another uninfected computer and let the CA eTrust AVscanner do what it does best :-). Until there is a fully tested solution for this threat, make sure you scan your system, but not to place the files in quarantine.  This can otherwise have disastrous consequences for the infected system...

Posted by: Hugo Sepulveda From Lisis | February 19, 2009 6:05 AM

Well Hugo - you just described what happened to me.  I got infected by this trojan - our McAfee Enterprise did not detect it - AVG did detect it, but then quarantined all the Windows system files - I now cannot access anything.. I can see my file through the CMD, but cannot access them.  No services are running, there are no paths to anything..

Posted by: SpencerK | March 4, 2009 6:16 AM

I had 9 computers out of 30 infected at one site.  Haven't figured out the the original source culprit.  AVG8 detected its presence, but referred to it as WIN32/HEUR which wasn't very helpful when looking for solutions.   Forturnately one of the work stations was running MS Windows Malicious Software Removal Tool and scanned Novell networked drives and highlighted the name Win32/Virut.BM for two .exe files on the network that, one of which was the program we use for e-mail Pegasus (WINPM-32.exe).  That identification helped me locate AVG's virut removal tool which has successfully (thus far) removed the infection from all the work stations.  I deleted all the files from the Pegasus Mail directory that had to do with running Pegasus (several other exe files were also found to be infected when using the AVG removal tool against the networked drives).  I am about to re-install the Pegasus files from another server and am hoping to get everyone back to business.  Prior to properly identifying the infection as a virut we were using Glary and MalwareBytes tools, but AVG kept telling us that the infection still exist.  Since we used AVGs removal tool we haven't had any alerts on those systems.

Posted by: R Frey | March 23, 2009 1:38 PM

We've had 4 systems in our shop with this W32/Vitru Virus.  3 came in the door this way, 1 we infected with a utility thumb drive (good for us).  Our only proven solution was to copy all data off the drives (data itself does not seem to get infected - though I have heard  that MP3 files can be - anyone know for sure please post info here).  Formating HDD does not fully remove virus - virus must get into MBR.  Full Security Wipe was necessary, then reload OS (XP) w/drivers - fun time as always, then load applications and copy data back.  After doing 4 systems they have stayed clean over 2 weeks now (KnockOnWood).  Two systems we didn't do the secure wipe on at first, came back "the next day" fully infected again.

Notes:

Massive infection of EXE & SCR Files

May start as an iFrameVirus that morph's into Virut

Jumps onto Thumb drives like no one business

None of the "Removers" remove 100%

Good luck - this is one of the worst viruses yet - the only saving grace is data seems to survive.

Posted by: Tom W | April 2, 2009 6:26 PM

 
 
Page Tools