Viking.H, a variant of Viking, is a Virus. Viking.H creates files in the Windows directory and downloads and runs a file from website: [http://www.54088.org/backup/[REMOVED]1.exe Viking.H kills processes belonging to anti-virus and security software.
Please note that because of the "Worm." detection prefix F-Secure Anti-Virus will suggest to delete infected files, but DO NOT select the "Delete" option because this worm also has a viral component and you don't want to delete all infected files instead of disinfecting them. At the same time, the worm's dropper and downloader files should be deleted from a computer to prevent re-infection. See the names of the dropper and downloader files in the Details section.
Find the latest advice in our Community Knowledge Base.
See the manual for your F-Secure product on the Help Center.
Submit a file or URL for further analysis.
Once an infected file is executed, Viking.H will drop the following files in the Windows directory:
The .DLL component is injected into IEXPLORE.EXE. Viking.H adds the following registry entry as a part of its installation:
It creates the following text files where it writes some information related to its activities:
Viking.H is a prepending virus that searches for files starting from fixed drives from the Z: to C: drives.It infects files with the following extension:
It avoids infecting files with the following strings in its path or filename:
In order for the host file to execute, Viking.H creates a backup copy of the itself in the current directory as [filename].exe.exe and then drops and executes the original uninfected host file as [filename].exe. After which, it will now delete the uninfected host file and renames the backup file to the original filename. Viking.H is able to do this with the help of a temporary batch file created in the temporary folder as $$.bat. Viking.H sends the message "Hello, World" to the following IP address via Internet Control Message Protocol (ICMP) :
It also attempts to propagate via network shares by copying itself to the following shared folders:
- with the following accounts:
It stops the following service:
It terminates the following processes that are often related to Anti-virus products:
Viking.H attempts to download and execute files from the following site:
Note: This site is already down.
Description Created: 2006-10-09 07:27:06.0
Description Last Modified: 2006-12-12 18:10:51.0