Netskope Threat Labs

Virut

ATP Sandbox Adv. HeuristicsAV

Virut is a file infecting worm and botnet that infects executables on Windows systems and spreads the infected files onward. It turned infected machines into platforms for spam and other criminal services and served as a delivery channel for additional malware families. A coordinated takedown that included Polish authorities shut down much of its infrastructure in January 2013, and researchers took control of its command and control domains for years afterward.

First seen
March 2022
Last seen
October 2026
Alert Name
ByteCode-MSIL.Virus.Virut
Document-HTML.Virus.Virut
Email.Virus.Virut
Win32.Trojan.Virut
Win32.Virus.Virut
Win32.Virut.U
Win32.Virut.V
Win64.Virus.Virut