WIN32/VIRUT

Discussion in 'ESET NOD32 Antivirus' started by Budnick, Apr 6, 2009.

Thread Status:
Not open for further replies.
  1. Budnick

    Budnick Registered Member

    Joined:
    Apr 6, 2009
    Posts:
    3
    Hello All.

    I have contracted the above virus.

    I have ESET NOD32 Antivirus (4.0) and it will not get rid of it. It cannot clean it and from what I have read I will have to do a clean install, is this correct?

    Can I save my emails and pictures safely and reinstall them?

    Any assistance is greatly appreciated.

    Budnick
     
  2. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,456
    Is it detected as a variant of Virut or as a concrete variant? Do you have advanced heuristics enabled when cleaning the files with the on-demand scanner?
     
  3. Budnick

    Budnick Registered Member

    Joined:
    Apr 6, 2009
    Posts:
    3
    Hi Marcos

    I may be a little thick here but I do not understand the question correctly?

    It says I have Virut.NBM, not sure if that is the variant?

    Budnick
     
  4. morph000

    morph000 Registered Member

    Joined:
    Apr 13, 2003
    Posts:
    21
    Join the club ! I seem to have contracted this deleted expletive too !

    See here for other experiences with this one : http://www.precisesecurity.com/blogs/2009/02/11/viruswin32virutce/

    I'm running Vista Home,SP1 with latest updates, Zonealarm Internet Security Suite (latest), Malwarebytes (latest), Spybot S&D (latest), with programme setting for all set to deep scan, on-access scanning etc, and yet somehow I contracted Virut !!

    It infected Winlogon in \System32 and other a couple of other files, seemingly at random. eg eMule on a different partition which wasn't even linked to from C: or running, so presumably Virut is scanning for "likely" programmes to hijack.

    Zonealarm detected 3 instances of Virut by itself, and has apparently cleaned them out, although with Virut's reputation, that remains to be seen !
    Malwarebytes found nothing, nor did Spybot, probably not surprising as they're spyware/malware proggies...

    After that, I also ran the stand-alone Kaspersky Virus scan and that also said "clean".

    I'll scan again tonight in safe mode and also try the AVG removal tool to see what the results are...

    Fortunately, I do full hot backups every fortnight so if I have to reformat, no great hardship at all..it helps to plan ahead eh ! (saves reinstalling 150 software packages, and around 1 solid weeks work)

    As for REALLY getting rid of Virut, I'm thinking a BartPE/KAV boot cd/dvd to take the OS right out of the loop when you do a scan, although Virut seems to be polymorphic so even this may not detect or fix it.

    Anyway, any input from people with experience with this is welcome too ! :)

    Especially info as to HOW one gets infected in the first place would be useful.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.