New Windows virus attacks PHP, HTML, and ASP scripts

> Researchers have identified a new strain of malware that can spread
> rapidly from machine to machine using a variety of infection techniques,
> including the poisoning of webservers, which then go on to contaminate
> visitors.
> The malware is a variation of a rapidly mutating virus alternately known
> as Virut and Virux. It has long proved adept at injecting itself into
> executable files, which are then able to attack uninfected machines
> through network drives and USB sticks.
> The variant, which Microsoft is calling Virus:Win32/Virus.BM, is also able
> to infect web scripts based on languages such as PHP, ASP, and HTML.
> Servers that become infected include an iframe in webpages that attempt to
> spread malware to visitors.
> "This catapults the possibility of spreading even farther," Trend Micro
> researchers warn. "If the script files happen to be uploaded to a publicly
> accessible website, any visitor to the affected sites will be led to the
> URL embedded in the iframe code."
> The iframe surreptitiously directs visitors to zief.pl (don't visit it
> unless you're a security professional), which attempts to exploit a
> variety of vulnerabilities based on the browser and other applications the
> user has installed, Microsoft researchers say. Once installed, the virus
> injects its code into various system processes such as explorer.exe and
> winlogon.exe and hooks low-level Windows APIs to ensure it stays in
> memory.
> The virus has also picked up some new polymorphic tricks designed to make
> it harder for anti-virus programs to detect. Among other things, it uses
> more than one layer of encryption, allowing its binary fingerprint to
> change but to preserve its malicious payload.
> Infected machines will have an IRC backdoor installed that tries to
> connect to several servers using port 80. ®
> http://www.theregister.co.uk/2009/02/12/new_virut_strain/
>

> So, what's the fix for a machine infected with this malware?
>> Researchers have identified a new strain of malware that can spread
>> rapidly from machine to machine using a variety of infection techniques,
>> including the poisoning of webservers, which then go on to contaminate
>> visitors.
>> The malware is a variation of a rapidly mutating virus alternately known
>> as Virut and Virux. It has long proved adept at injecting itself into
>> executable files, which are then able to attack uninfected machines
>> through network drives and USB sticks.
>> The variant, which Microsoft is calling Virus:Win32/Virus.BM, is also
>> able to infect web scripts based on languages such as PHP, ASP, and HTML.
>> Servers that become infected include an iframe in webpages that attempt
>> to spread malware to visitors.
>> "This catapults the possibility of spreading even farther," Trend Micro
>> researchers warn. "If the script files happen to be uploaded to a
>> publicly accessible website, any visitor to the affected sites will be
>> led to the URL embedded in the iframe code."
>> The iframe surreptitiously directs visitors to zief.pl (don't visit it
>> unless you're a security professional), which attempts to exploit a
>> variety of vulnerabilities based on the browser and other applications
>> the user has installed, Microsoft researchers say. Once installed, the
>> virus injects its code into various system processes such as explorer.exe
>> and winlogon.exe and hooks low-level Windows APIs to ensure it stays in
>> memory.
>> The virus has also picked up some new polymorphic tricks designed to make
>> it harder for anti-virus programs to detect. Among other things, it uses
>> more than one layer of encryption, allowing its binary fingerprint to
>> change but to preserve its malicious payload.
>> Infected machines will have an IRC backdoor installed that tries to
>> connect to several servers using port 80. ®
>> http://www.theregister.co.uk/2009/02/12/new_virut_strain/
>

> Researchers have identified a new strain of malware that can spread rapidly
> from machine to machine using a variety of infection techniques, including
> the poisoning of webservers, which then go on to contaminate visitors.
>
> The malware is a variation of a rapidly mutating virus alternately known as
> Virut and Virux. It has long proved adept at injecting itself into
> executable files, which are then able to attack uninfected machines through
> network drives and USB sticks.
>
> The variant, which Microsoft is calling Virus:Win32/Virus.BM, is also able
> to infect web scripts based on languages such as PHP, ASP, and HTML. Servers
> that become infected include an iframe in webpages that attempt to spread
> malware to visitors.
>
> "This catapults the possibility of spreading even farther," Trend Micro
> researchers warn. "If the script files happen to be uploaded to a publicly
> accessible website, any visitor to the affected sites will be led to the URL
> embedded in the iframe code."
>
> The iframe surreptitiously directs visitors to zief.pl (don't visit it
> unless you're a security professional), which attempts to exploit a variety
> of vulnerabilities based on the browser and other applications the user has
> installed, Microsoft researchers say. Once installed, the virus injects its
> code into various system processes such as explorer.exe and winlogon.exe and
> hooks low-level Windows APIs to ensure it stays in memory.
>
> The virus has also picked up some new polymorphic tricks designed to make it
> harder for anti-virus programs to detect. Among other things, it uses more
> than one layer of encryption, allowing its binary fingerprint to change but
> to preserve its malicious payload.
>
> Infected machines will have an IRC backdoor installed that tries to connect
> to several servers using port 80. ®
>
> http://www.theregister.co.uk/2009/02/12/new_virut_strain/
>
>
>