About Win32/Virut (Win32:Vitro).

Win32/Virut.BM disables Windows System File Protection (SFP) by injecting code into WINLOGON.EXE. The injected code patches sfc_os.dll in memory which in turn allows the virus to infect files protected by SFP.
The virus infects .EXE and .SCR files on access, hence actions such as copying or viewing files with Explorer, including on shares (with write access) will result in files being infected, and the virus spreading from machine to machine.

This file infector connects to a remote IRC server. It then joins a channel to receive and execute commands on the affected system. This routine effectively compromises system security.
I can hear what you are thinking about these capabilities. Nothing too unusual. Companies should be able to handle this sufficiently. It appears that the Anti-Virus vendors are on top of the situation so prevention and clean-up should be a breeze. Well, that is where the complications begin. Remember that little bit about disabling Windows File Protection? This means that Virut can and will infect critical system files. One detail that some AV vendors leave out or bury is the fact that cleaning up after Virut is not that easy. Microsoft helps us with a little note in their write-up.

Note: The method of infection used by Win32/Virut can damage some infected files beyond repair. In these cases, in order to return a machine to its pre-infected state, it may be necessary to install a clean backup of the operating system and associated applications.

The Virut family of viruses uses polymorphism to hide from all anti-virus protection, it infects executable files. File infection makes it very hard to repair a system that has been infected. W32/Vitro injects code in running processes and hooks the following functions in ntdll.dll which transfers control to the virus every time any of these function calls are made.

* NtCreateFile
* NtCreateProcess
* NtCreateProcessEx
* NtOpenFile
* NtQueryInformationProcess

We would strongly recommend rebuilding the system from backups. Windows can be rebuilt as described in the following link or failing this a format of the system will be required.

April 9, 2009 About Conficker / W32.Downadup / Kido.

When it comes to naming a threat, the Conficker worm might be more aptly named the Conflicting worm. Barely a week after the 60 Minutes April Fools' Conficker doomsday update failed to materialize, the closely watched Conflicker.C did finally manage an update. And in an ironic twist, the new worm debunks much of the hype circulating about Conficker.

The following is intended to help clear up a couple of the continuing conflicting reports about Conficker and is best read in conjunction with the original report titled "60 Minutes, Conficker, and April's Fool.
Myth: The new version of Conficker downloads keyloggers and other data theft trojans.
Reality: Conficker didn't download keyloggers; instead the worm download a scareware program and a new variant of the spam-related Waledec trojan. Waledec is believed to be written by the same group behind the Storm trojan, and both are malware connected with sending spam.

Myth: The Conficker Eye Chart can tell whether there is a Conficker infection.
Reality: While some have made much of Conficker's ability to block access to antivirus vendor sites, disabling antivirus and preventing access to updates and information is a common characteristic of nearly all malware in circulation today. The "Conficker Eye Chart" will show at a glance if access to F-Secure, Trend Micro, or a handful of other security sites is blocked. Basically, if you view the page and can't see the images, this is supposed to be indicative of a Conficker infection. But while it may be a catchy PR title, in reality a failure of the images to display could indicate infection by the majority of malware circulating today and may have nothing to do with Conficker whatsoever.

Myth: Millions are infected with the Conficker worm.
Reality: In another ironic twist, it appears the authors of Conficker have provided a means to measure potential victims without relying on complex measurements and educated guess. Immediately after updating to Conficker.E, the new updated worm tried to connect to a domain for which traffic can be directly counted. Suffice to say that Quantcast and other traffic monitoring systems report this domain as having too little traffic to be measurable. This lack of traffic during the update cycle - when the worm was alleged to be actively hitting the site - calls into question the high number of victims that have been reported. And it raises the question of whether what's really been reported in the past is really just the result of traffic activity emanating from other antivirus vendors' honeypots.

About Sality Family Virus

Sality is a family of file infecting viruses that spread by infecting exe and scr files. The virus also includes an autorun worm component that allows it to spread to any removable or discoverable drive. In addition, Sality includes a downloader trojan component that installs additional malware via the Web.

Sality.AO is a virus that combines the features of traditional viruses (infecting files and damaging as many computers as possible to achieve notoriety for creators) with the objectives of new malware, i.e. generating financial returns for cyber-criminals. Over recent days, Panda Security’s malware detection and analysis laboratory, PandaLabs, has noted an increase in the number of infections caused by this malware, as well as new variants using the same techniques. It is therefore advising users to be on their guard against a possible massive attack.

Sality.AO uses some techniques which haven’t been seen for years, such as EPO or Cavity. Making it more difficult to detect these changes and to disinfect it, these techniques relate to the way in which the original file is modified in order to infect it. Making it difficult to detect the malware, EPO allows part of a legitimate file to be run before infection starts. Cavity involves inserting the virus code in blank spaces within the legitimate file’s code, making it both more difficult to locate and to disinfect infected files.

These techniques are far more complex than those that can be achieved with automatic malware creation tools, which have been responsible for much of the increase in the number of threats in circulation recently. They require much greater skill and knowledge of malicious code programming.

Sality.AO includes, in addition to these techniques related with early malware, a series of features associated with new malware trends, such as the possibility to connect to IRC channels to receive remote commands, potentially turning the infected computer into a zombie. Such zombie computers can be used for sending spam, denial of service attacks, distributing malware, etc. Similarly, infections are not just restricted to files, as was the case with old viruses, but also look to propagate across the Internet, in line with new trends. To this end, it uses an iFrame to infect PHP, ASP and .HTML files on the computer. The result is that when any of these files are run the browser is redirected, without the user’s knowledge, to a malicious page that launches an exploit against a computer in order to download more malware and that is not all. Any users downloading the files or visiting the Web pages will become infected, if any of the infected files are posted on a Web page –and bear in mind these file types are typically uploaded to the Web.