Cooperative Efforts To Shut Down Virut Botnet

Spamhaus describes the takedown efforts against the Virut botnet, a file‑infector/worm that spread via removable media and network shares and is estimated to have compromised over 300,000 machines. The report explains how operators used dozens of C2 domains primarily in the .pl, .ru and .at ccTLDs, that Virut was dropping ZeuS and Kehlios via a pay‑per‑install model, and documents cooperative sinkholing and domain suspensions in .pl and .ru while .at remained a remaining stronghold.