Virus.Virut.a Description

Virus.Virut.A is a nasty virus that spreads through browser security exploits, IRC, and over network shares. Once it is executed, Virus.Virut.A will hide deeply in memory and will try to infect any .exe or .scr files that are executed on your machine. Virus.Virut.A will also attempt to open up a TCP backdoor on port 65520 so that the remote attacker can gain access to any information on your computer. This places any financial or banking information stored on your computer in severe jeopardy and represents a serious security risk.

Type: Viruses

How Can You Detect Virus.Virut.a?

Virus.Virut.a Technical Report

As new Virus.Virut.a details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following Virus.Virut.a files with its MD5s were created in the system:

Virus.Virut.a Removal Details

Virus.Virut.a has typically the following processes in memory:

• xlxhgsb.exe
• f03WtR1066.exe
• pivgrj.exe
• r1w2821.exe
• clean_c1c9.dll
• MailSpectre.exe
• j8j88j.exe

Virus.Virut.a creates the following files in the system:

• Windows Logon Application
• nslookup32.exe~
• spoolsvc.exe~
• Spooler SubSystem App
• NS Lookup App
• MsUpdaters.exe~
• QP[Pu]HISMMMMVLUXNQT
• Windows Update
• Isass.exe~
• winIogon.exe~

Virus.Virut.a creates the following registry entries:

• Software\Microsoft\Windows\CurrentVersion\RunServices\NS Lookup App
• SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\Windows Update
• Software\Microsoft\OLE\Windows Update
• SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\QP[Pu]HISMMMMVLUXNQT
• Software\Microsoft\OLE\NS Lookup App
• SYSTEM\CurrentControlSet\Control\Lsa\NS Lookup App
• Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Xtqbdip

Important Article Disclaimer