Viking.H

Disinfection of the Viking virus-worm should be performed as follows:

• Disconnect a computer or local network from the Internet.
• Disable network sharing or set strong passwords for all shares.
• Select the "Disinfect Automatically" action for F-Secure Anti-Virus real-time scanners on all computers. With "Disinfect Automatically" selected, F-Secure Anti-Virus will disinfect files that a virus tries to infect over a network (if sharing was not disabled).
• Scan all files on all drives on all computers and MANUALLY select the "Disinfect" action to disinfect all infected files and to rename the virus droppers. DO NOT select automatic disinfection option after the scan!
• Restart all disinfected computers.
• Scan all hard drives on disinfected computers again to make sure that no more infected files are left. If needed, repeat disinfection procedure.
• Disinfect all infected computers connected on the network.
• Enable network sharing, keep strong share passwords.
• Reconnect the disinfected computer or local network to the Internet.

Please note that because of the "Worm." detection prefix F-Secure Anti-Virus will suggest to delete infected files, but DO NOT select the "Delete" option because this worm also has a viral component and you don't want to delete all infected files instead of disinfecting them. At the same time, the worm's dropper and downloader files should be deleted from a computer to prevent re-infection. See the names of the dropper and downloader files in the Details section.