提醒用户及早升级防范virut病毒，如果不幸中招，可根据受损程度处理。如果系统EXE破坏严重，可以采用备份进行还原，没有备份的情况下，覆盖安装可以最大程度减少损失。
说明一下，发现BLOG的回复中有不少人认为应该把病毒扔别处，有本事别在国内放。这个不能苟同，造病毒放哪儿都有害。己所不欲，勿施于人。另外，这个病毒使用的加密引擎来自波兰，那个IRC服务器域名为 proxim.ircgalaxy.pl，貌似也是波兰的域名。
该病毒的其它行为
感染后缀为：EXE和SCR的可执行文件；如果文件名以下面的开始，则不感染。
WINC
WCUN
WC32
PSTO
连接IRC服务器：
proxim.ircgalaxy.pl
加入频道：
#virtu
接收远程指令。
尝试上传一些样本到Virustotal，结果如下：
Antivirus Version Update Result AhnLab-V3 2007.4.17.1 04.17.2007 Win32/Virut.D AntiVir 7.3.1.52 04.16.2007 W32/Virut.B Authentium 4.93.8 04.16.2007 no virus found Avast 4.7.981.0 04.16.2007 Win32:VB-DET AVG 7.5.0.447 04.17.2007 Win32/Virut BitDefender 7.2 04.17.2007 Win32.Virtob.2.Gen CAT-QuickHeal 9.00 04.16.2007 no virus found ClamAV devel-20070312 04.17.2007 W32.Virut.ci DrWeb 4.33 04.17.2007 Win32.HLLW.Unjap eSafe 7.0.15.0 04.16.2007 no virus found eTrust-Vet 30.7.3572 04.16.2007 no virus found Ewido 4.0 04.16.2007 Worm.VB.fi FileAdvisor 1 04.17.2007 no virus found Fortinet 2.85.0.0 04.17.2007 suspicious F-Prot 4.3.2.48 04.16.2007 no virus found F-Secure 6.70.13030.0 04.17.2007 Virus.Win32.Virut.d Ikarus T3.1.1.5 04.17.2007 Virus.Win32.Virut.d Kaspersky 4.0.2.24 04.17.2007 Virus.Win32.Virut.d McAfee 5010 04.16.2007 W32/Virut.e Microsoft 1.2405 04.17.2007 Virus:Win32/Virut.D NOD32v2 2196 04.17.2007 a variant of Win32/Virut Norman 5.80.02 04.14.2007 no virus found Panda 9.0.0.4 04.17.2007 W32/Virutas.G Prevx1 V2 04.17.2007 no virus found Sophos 4.16.0 04.16.2007 W32/Vetor-A Sunbelt 2.2.907.0 04.14.2007 VIPRE.Suspicious Symantec 10 04.17.2007 W32.Virut.H TheHacker 6.1.6.095 04.15.2007 no virus found VBA32 3.11.3 04.17.2007 Virus.Win32.Virut.B VirusBuster 4.3.7:9 04.16.2007 Worm.VB.ZUO Webwasher-Gateway 6.0.1 04.17.2007 Win32.Virut.B
|
Antivirus |
Version |
Update |
Result |
|
AhnLab-V3 |
2007.4.17.1 |
04.17.2007 |
Win32/Virut.D |
|
AntiVir |
7.3.1.52 |
04.16.2007 |
W32/Virut.B |
|
Authentium |
4.93.8 |
04.16.2007 |
no virus found |
|
Avast |
4.7.981.0 |
04.16.2007 |
Win32:VB-DET |
|
AVG |
7.5.0.447 |
04.17.2007 |
Win32/Virut |
|
BitDefender |
7.2 |
04.17.2007 |
Win32.Virtob.2.Gen |
|
CAT-QuickHeal |
9.00 |
04.16.2007 |
no virus found |
|
ClamAV |
devel-20070312 |
04.17.2007 |
W32.Virut.ci |
|
DrWeb |
4.33 |
04.17.2007 |
Win32.HLLW.Unjap |
|
eSafe |
7.0.15.0 |
04.16.2007 |
no virus found |
|
eTrust-Vet |
30.7.3572 |
04.16.2007 |
no virus found |
|
Ewido |
4.0 |
04.16.2007 |
Worm.VB.fi |
|
FileAdvisor |
1 |
04.17.2007 |
no virus found |
|
Fortinet |
2.85.0.0 |
04.17.2007 |
suspicious |
|
F-Prot |
4.3.2.48 |
04.16.2007 |
no virus found |
|
F-Secure |
6.70.13030.0 |
04.17.2007 |
Virus.Win32.Virut.d |
|
Ikarus |
T3.1.1.5 |
04.17.2007 |
Virus.Win32.Virut.d |
|
Kaspersky |
4.0.2.24 |
04.17.2007 |
Virus.Win32.Virut.d |
|
McAfee |
5010 |
04.16.2007 |
W32/Virut.e |
|
Microsoft |
1.2405 |
04.17.2007 |
Virus:Win32/Virut.D |
|
NOD32v2 |
2196 |
04.17.2007 |
a variant of Win32/Virut |
|
Norman |
5.80.02 |
04.14.2007 |
no virus found |
|
Panda |
9.0.0.4 |
04.17.2007 |
W32/Virutas.G |
|
Prevx1 |
V2 |
04.17.2007 |
no virus found |
|
Sophos |
4.16.0 |
04.16.2007 |
W32/Vetor-A |
|
Sunbelt |
2.2.907.0 |
04.14.2007 |
VIPRE.Suspicious |
|
Symantec |
10 |
04.17.2007 |
W32.Virut.H |
|
TheHacker |
6.1.6.095 |
04.15.2007 |
no virus found |
|
VBA32 |
3.11.3 |
04.17.2007 |
Virus.Win32.Virut.B |
|
VirusBuster |
4.3.7:9 |
04.16.2007 |
Worm.VB.ZUO |
|
Webwasher-Gateway |
6.0.1 |
04.17.2007 |
Win32.Virut.B |
