F-Secure
Tools
Viking.H
Summary
Viking.H, a variant of Viking, is a Virus. Viking.H creates files in the Windows directory and downloads and runs a file from website: [http://www.54088.org/backup/[REMOVED]1.exe
Viking.H kills processes belonging to anti-virus and security software.
Viking.H kills processes belonging to anti-virus and security software.
Disinfection
Disinfection of the Viking virus-worm should be performed as follows:
Please note that because of the "Worm." detection prefix F-Secure Anti-Virus will suggest to delete infected files, but DO NOT select the "Delete" option because this worm also has a viral component and you don't want to delete all infected files instead of disinfecting them. At the same time, the worm's dropper and downloader files should be deleted from a computer to prevent re-infection. See the names of the dropper and downloader files in the Details section.
- Disconnect a computer or local network from the Internet.
- Disable network sharing or set strong passwords for all shares.
- Select the "Disinfect Automatically" action for F-Secure Anti-Virus real-time scanners on all computers. With "Disinfect Automatically" selected, F-Secure Anti-Virus will disinfect files that a virus tries to infect over a network (if sharing was not disabled).
- Scan all files on all drives on all computers and MANUALLY select the "Disinfect" action to disinfect all infected files and to rename the virus droppers. DO NOT select automatic disinfection option after the scan!
- Restart all disinfected computers.
- Scan all hard drives on disinfected computers again to make sure that no more infected files are left. If needed, repeat disinfection procedure.
- Disinfect all infected computers connected on the network.
- Enable network sharing, keep strong share passwords.
- Reconnect the disinfected computer or local network to the Internet.
Please note that because of the "Worm." detection prefix F-Secure Anti-Virus will suggest to delete infected files, but DO NOT select the "Delete" option because this worm also has a viral component and you don't want to delete all infected files instead of disinfecting them. At the same time, the worm's dropper and downloader files should be deleted from a computer to prevent re-infection. See the names of the dropper and downloader files in the Details section.
Additional Details
Once an infected file is executed, Viking.H will drop the following files in the Windows directory:
The .DLL component is injected into IEXPLORE.EXE.
Viking.H adds the following registry entry as a part of its installation:
It creates the following text files where it writes some information related to its activities:
Viking.H is a prepending virus that searches for files starting from fixed drives from the Z: to C: drives.
It infects files with the following extension:
It avoids infecting files with the following strings in its path or filename:
In order for the host file to execute, Viking.H creates a backup copy of the itself in the current directory as[filename].exe.exe and then drops and executes the original uninfected host file as [filename].exe. After which, it will now delete the uninfected host file and renames the backup file to the original filename. Viking.H is able to do this with the help of a temporary batch file created in the temporary folder as $$.bat.
Viking.H sends the message "Hello, World" to the following IP address via Internet Control Message Protocol (ICMP) :
It also attempts to propagate via network shares by copying itself to the following shared folders:
- with the following accounts:
It stops the following service:
It terminates the following processes that are often related to Anti-virus products:
Viking.H attempts to download and execute files from the following site:
Note: This site is already down.
- Logo1_.exe - Infector
- vDll.dll - Downloader
The .DLL component is injected into IEXPLORE.EXE.
Viking.H adds the following registry entry as a part of its installation:
- [HKLM\SOFTWARE\Soft\DownloadWWW]
auto = "1"
It creates the following text files where it writes some information related to its activities:
- C:\gamevir.txt
- C:\log.txt
Viking.H is a prepending virus that searches for files starting from fixed drives from the Z: to C: drives.
It infects files with the following extension:
- exe
It avoids infecting files with the following strings in its path or filename:
- \Program Files\
- Common Files
- ComPlus Applications
- Documents and Settings
- InstallShield Installation Information
- Internet Explorer
- Messenger
- Microsoft Frontpage
- Microsoft Office
- Movie Maker
- MSN
- MSN Gaming Zone
- NetMeeting
- Outlook Express
- Recycled
- system
- System Volume Information
- system32
- windows
- Windows Media Player
- Windows NT
- WindowsUpdate
- winnt
In order for the host file to execute, Viking.H creates a backup copy of the itself in the current directory as
Viking.H sends the message "Hello, World" to the following IP address via Internet Control Message Protocol (ICMP) :
-
192.168.0.30 192.168.8.1
It also attempts to propagate via network shares by copying itself to the following shared folders:
-
admin$ ipc$
- with the following accounts:
-
administrator guest
It stops the following service:
-
"Kingsoft AntiVirus Service"
It terminates the following processes that are often related to Anti-virus products:
-
EGHOST.EXE IPARMOR.EXE KAVPFW.EXE MAILMON.EXE RavMon.exe RavMonClass
Viking.H attempts to download and execute files from the following site:
-
http://www.54088.org/backup/[REMOVED]1.exe
Note: This site is already down.
Detection
F-Secure Anti-Virus detects this malware with the following updates:
[FSAV_Database_Version]
Version = 2006-05-28_02.