Comments on: Virut infecting worms, hitching a ride

By: October 2009 Threatscape: An epidemic of Scareware, Bredolab and ZBot | Fortinet FortiGuard Blog

Wed, 28 Oct 2009 17:26:47 +0000

[...] nowhere near as high as rogue security software this month. Look out for this though, as Virut has hybrid capabilities (can spread through other infections) and may indeed piggyback on high-profile scareware campaigns [...]

By: Thund3rbolt

Thund3rbolt — Fri, 11 Sep 2009 04:04:38 +0000

I have never in my 26 years of working as a tech run into a virus as difficult as this one is to clean. Yes, it can be cleaned but with GREAT difficulty! You MUST remove the drive from the infected pc and use an alternate non-infected pc to scan with several scanners and cleaners. I recommend first using AVG’s virut/32 removal tool followed by Avira Antivirus and lastly malwarebytes Antimalware. After cleaning reinstall the hard drive, do NOT connect to the internet and run a windows repair. Then re-run all the scanners one last time and you should be free and clean.

The long and the short is though this is by far the worse virus threat I have seen to date and the most time consuming to clean. More suprising was most antiviral packages were not only unable to clean/remove the infection but in most cases didn’t even detect the infection or when it did detect wanted to delete all the exe files. In a word – ugly!! Someone needs to write a working/less time consuming fix as this thing is spreading across the net at warp speed.

By: May 2009 Threatscape Report: Virut upgrades, Gaming trojans expand, Threats swell | Fortinet FortiGuard Blog

Thu, 28 May 2009 17:20:14 +0000

[...] variant, but is refactored to be more efficient and robust. Watch out for this as Virut, with its hybrid capabilities, can come in many shapes, through many vectors. Meanwhile, Waledac continued to build their [...]

By: corms

corms — Thu, 16 Apr 2009 14:48:39 +0000

This little virus is a thing of destructive beauty akin to a volcano. Its destructive power is awesome to watch as long as you’re not standing in front of it. Congratulations must go to the author, as it is a truly magnificent virus. As an IT consultant whose work partially consists of removing said infection I must say that after 12 years in the industry this baby ranks in my top 3. If you’re looking for a removal method I’d recommend a reformat. Pull the drive, copy your data and move on please, there is nothing to see here! There may well be a removal tool for this baby, but NATM.

By: Kope

Kope — Thu, 16 Apr 2009 02:52:18 +0000

Well, I hope with all the analysis from the great analysts around the world could create a great VACCINE for this virus. This one is totally difficult to eradicate if you don’t want to format all your partition.

So, we hope there’s a better vaccine than any antivirus/antimalware/antispyware who had claimed can resolve this virus but totally bullshit.

Good luck to all who participate making the analysis and vaccine !!!

By: March Threatscape Report: Virut, Conficker and new critical vulnerabilities | Fortinet FortiGuard Blog

Fri, 27 Mar 2009 21:19:35 +0000

[...] After a year long battle, W32/Virut.A finally lands in top spot – surpassing Netsky. This parasitic file infector proves to be quite virulent, and has generated enough activity to land in our malware top 10 for twelve solid months. On top of infecting multiple local files on a PC, the virus can spread through file shares and/or removable media such as USB thumb drives. Additionally, it has a rather unique capability to propagate through other worms in a hybrid form – read here for more info. [...]

By: tacktick

tacktick — Tue, 17 Mar 2009 20:51:56 +0000

That is fascinating!
Unintended consequences..
Thank you for the article and the analysis.