Win32/Virut [Threat Name] go to Threat

Win32/Virut.NBK [Threat Variant Name]

Win32/Virut.NBK is a polymorphic file infector. The virus connects to the IRC network. It can be controlled remotely.

The virus creates and runs a new thread with its own program code within the following processes:

The following Registry entries are created:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
- "\??\%system%\winlogon.exe" = "\??\%system%\winlogon.exe:*:enabled:@shell32.dll,-1"

The performed data entry creates an exception in the Windows Firewall program.

The virus searches for executables with one of the following extensions:

Executables are infected by appending the code of the virus to the last section.

The host file is modified in a way that causes the virus to be executed prior to running the original code.

It avoids those with any of the following strings in their names:

It infects the following files:

The virus inserts a/an IFrame element with an URL link into the file.

The virus acquires data and commands from a remote computer or the Internet.

It communicates with the following servers using IRC protocol:

It can execute the following operations:

The virus modifies the following file:

The virus writes the following entries to the file: