In common law jurisdictions like the United States, this would probably be controlled under normal tort principles, which would mean that the answer turns on the hacking victim's state of mind.
If the victim is unaware of the virus or unaware of the hacker, she probably has no duty to the hacker, and therefore cannot be held liable for any injury he suffers as a result of her failure to address the virus.
But if this a case of a victim laying a trap for a potential hacker, then you have a variation on the old "spring gun" cases. The classic example is Katko v. Briney, 183 N.W.2d 657 (Iowa 1971).
In that case, a man owned an house -- abandoned for about a decade -- that kept attracting burglars and vandals, even after he boarded it up and posted "no trespassing signs." So Briney rigged up a shotgun to fire at anyone who entered the bedroom. About a month later, two antique collectors went into the house looking for old bottles and jars. One of them, Katko, opened the door to the bedroom, and the gun basically blew off one of his legs.
Although he was convicted of breaking into the house, Katko sued Briney for negligence. The jury awarded Katko $20,000 for medical expenses and the like, as well as $10,000 in punitive damages. Consistent with the approach of most courts, the Iowa Supreme Court affirmed the verdict:
The value of human life and limb, not only to the individual concerned but also to society, so outweighs the interest of a possessor of land in excluding from it those whom he is not willing to admit thereto that a possessor of land has ... no privilege to use force intended or likely to cause death or serious harm against another whom the possessor sees about to enter his premises or meddle with his chattel, unless the intrusion threatens death or serious bodily harm to the occupiers or users of the premises.
So I'd argue that a person who leaves a virus lying around his computer, hoping to infect a hacker, is like Briney, intentionally laying a trap to injure someone who he could probably just defend himself against instead, and therefore liable to the hacker for injuries.
But I could also argue it the other way: Briney's trap was designed to inflict bodily harm or even death against a person who posed no real threat, given that the property was abandoned, while a computer virus merely disables the hacker's weapon, and is used against someone who is attacking property that has greater value than an abandoned house, given the quantity and often extremely sensitive nature of contents on a personal computer.
So the answer, as always, is that it could go either way.