W32.Virut.G

W32.Virut.G is a family of viruses associated with various botnets. According to ESG security researchers, the W32.Virut.G family of viruses are designed to connect to IRC (Internet Relay Chat) through a backdoor that they establish on the infected computer system. Through this backdoor, W32.Virut.G can then download additional malware and install it onto the victim's computer. This malware will typically allow a criminal to control the infected computer by relaying automated commands through IRC. Like most viruses, W32.Virut.G is designed to corrupt files and spread on its own within an infected computer system. Like some worms, W32.Virut.G can jump from one computer to another by infecting files on a shared folder (giving W32.Virut.G the capacity to spread in a network) or by infecting files in an external memory device. Using this memory device on another computer would then cause it to become infected with the W32.Virut.G virus as well. The W32.Virut.G family of viruses has been mostly contained to infections in southeast Asia and Japan, with sporadic cases appearing in South Africa and Central Europe.

An Overview of How W32.Virut.G Viruses Infect Your Computer System

W32.Virut.G is characterized by injecting itself into active file processes. It can infect executable files and open a backdoor into the infected computer system through port 80. This port is normally used for HTTP traffic. However, W32.Virut.G viruses use this port in order to establish an IRC connection with a remote server. The server with which the W32.Virut.G virus attempts to connect is located at the address proxim.ntkrnlpa.info. On this server, the W32.Virut.G virus will join the channel #virtu3 in order to receive commands from the criminals that control it. Through IRC, criminals can command the W32.Virut.G virus to download and execute malware located on other locations.

Symptoms of W32.Virut.G

According to ESG security researchers, a common way of detecting whether an executable file has been infected is by detecting any modifications in its size. Typically, a modified executable file will be bigger than usual, because it will contain the W32.Virut.G virus' harmful additions. Analyzing the infected computer's network traffic can also allow detection of W32.Virut.G. An infected computer will present DNS traffic to the proxim.ntkrnlpa.info server as well as IRC activity. Most of the time, W32.Virut.G infections are detected because of the symptoms presented by the malware that W32.Virut.G downloads and installs.

SpyHunter Detects & Remove W32.Virut.G