Remove Viking.n - Spyware Removal Information

More than 1126248 spyware signatures and growing

Spywarelib Search

Search in:

Spywares

Files

Md5

Registry

Worm.Viking.n Analysis Report

Threat Submitted On: 6/23/2007 5:22:50 AM

Threat Analysed On: 6/23/2007 10:22:50 AM

Threat Updated On: 10/8/2009 8:36:18 AM

Type : Worm

Symptoms of Viking.n

Replicates itself and spreads to the other computers of the network.
Installed by executing the scripts from infected e-mail attachments or messages.

Removal Recommended (Click here to remove automatically)

Removal Recommended

Information

Alias : Worm.Win32.Viking.n

Md5 Hash : [5c4fc2e52f60d8d46362c772b4f85cd8]

File Size : (20531 bytes)

Technical Details

Here are the Technical findings of our analysis team after analyzing this malware in detail :-

Creates the following infected Files on user's System

Note:

Delete the following Files to remove Infection

File: _desktop.ini
Path : %networkpath%

	Md5Hash :


		( bytes)


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)

File: b52e1c88714b33b8ef941b7e71c7a8ba.exe
Path : %networkpath%
Md5Hash :( bytes)

File: f12ae547feeca251d883ea2d1bbacbcd.exe
Path : %networkpath%
Md5Hash :( bytes)

File: logo1_.exe
Path : %networkpath%
Md5Hash :( bytes)

File: _desktop.ini
Path : %programfiles%

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\dir2file

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\inctrl5

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\online services

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\shadowstor
Md5Hash :c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\shadowstor\shadowsurfer
Md5Hash :c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\shadowstor\shadowuser
Md5Hash :c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\systweak
Md5Hash :c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\systweak\rebootservice
Md5Hash :c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\uninstall information

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\xerox

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\xerox\nwwia

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %workingdir%

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: vdll.dll
Path : %workingdir%
Md5Hash :587fdb230f7419b2321b4a306849ce28 ( 23552 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\adminscripts

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\mailroot

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\mailroot\badmail

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\mailroot\drop

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\mailroot\mailbox

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\mailroot\pickup

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\mailroot\queue

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\mailroot\route

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\mailroot\sorttemp

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\wwwroot

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\recycler

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\recycler\s-1-5-21-1614895754-1788223648-839522115-1008

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\temp

	Md5Hash :


		208b8e92d72f60127d57e21c82b41785 ( 9 bytes)


		2b28c73988f7ab540dd9e1759f3024c3 ( 8 bytes)


		a013a253523adb058455a421132dc4fc ( 8 bytes)


		c70841a394ee7f57d1bc03b4ff48a86d ( 9 bytes)


		e64b8eca9da0052e92fa9253d288c535 ( 9 bytes)

File: $$a30.bat
Path : %temp%
Md5Hash :135236b85b8d6808b184f433ca929321 ( bytes)

File: $$a4.bat
Path : %temp%

	Md5Hash :


		6b871d8b8e3bfb16858844e0306bcdb8 ( bytes)


		869acb119a10852a5772cad2a20349cd ( bytes)


		ffc3a488d9394a4c4f21b12a05b3e1b5 ( bytes)

File: $$a45.bat
Path : %temp%
Md5Hash :ea7b0090eb9f216948ec31362bd9cc4a ( bytes)

File: $$a93.bat
Path : %temp%
Md5Hash :b6787e017df68e70cc32096b2862db11 ( 399 bytes)

File: manifest.txt
Path : %temp%\wer1900.dir00
Md5Hash :ecd8f09148b1679fa216e5f361077d23 ( 1872 bytes)

File: manifest.txt
Path : %temp%\wer5cbf.dir00
Md5Hash :9c7799fbf47c4f33549b1f8ed280cdb8 ( 1872 bytes)

File: manifest.txt
Path : %temp%\wera17c.dir00
Md5Hash :43a42f200e34ad63ef4701c4eeaa468e ( 1872 bytes)

File: manifest.txt
Path : %temp%\werba9c.dir00
Md5Hash :1fb01825eb3a8ede43e4d75d619b882c ( 1872 bytes)

File: logo1_.exe
Path : %windir%

	Md5Hash :


		239b6ada28f69630cf3fdfbc864913c7 ( 30105 bytes)


		99baaebbff553c2adbc42417b28aa03a ( 30105 bytes)

File: rundl132.exe
Path : %windir%

	Md5Hash :


		239b6ada28f69630cf3fdfbc864913c7 ( 30105 bytes)


		82c84bea90984838318060736ae957d4 ( 30105 bytes)


		99baaebbff553c2adbc42417b28aa03a ( 30105 bytes)


		b52e1c88714b33b8ef941b7e71c7a8ba ( 30102 bytes)


		f12ae547feeca251d883ea2d1bbacbcd ( 30102 bytes)

File: vdll.dll
Path : %windir%
Md5Hash :98213641aaca1e7fa88a4ea77a2975ef ( 23552 bytes)

File: [randomname].exe
Path : %workingdir%

	Md5Hash :


		4e13374767c94e135757449a29508364 ( 2887065 bytes)


		5c4fc2e52f60d8d46362c772b4f85cd8 ( 20531 bytes)


		82c84bea90984838318060736ae957d4 ( 30105 bytes)


		b52e1c88714b33b8ef941b7e71c7a8ba ( 30102 bytes)


		bca681f1141394e00ba09fce165ec72b ( 20533 bytes)


		f12ae547feeca251d883ea2d1bbacbcd ( 30102 bytes)

File: [randomname].exe.exe
Path : %workingdir%

	Md5Hash :


		4326b093320a0fab52ce0f972327feaf ( 2856960 bytes)


		5c4fc2e52f60d8d46362c772b4f85cd8 ( bytes)


		bca681f1141394e00ba09fce165ec72b ( bytes)

File: 82c84bea90984838318060736ae957d4.exe
Path : \10.10.36.1\admin$
Md5Hash :( bytes)

File: 82c84bea90984838318060736ae957d4.exe
Path : \10.10.36.3\admin$
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\data
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\inetpub
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\inetpub\adminscripts
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\inetpub\mailroot
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\inetpub\mailroot\badmail
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\inetpub\mailroot\drop
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\inetpub\mailroot\mailbox
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\inetpub\mailroot\pickup
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\inetpub\mailroot\queue
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\inetpub\mailroot\route
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\inetpub\mailroot\sorttemp
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\inetpub\wwwroot
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\program files
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\program files\dir2file
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\program files\inctrl5
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\program files\online services
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\program files\shadowstor
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\program files\shadowstor\shadowsurfer
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\program files\shadowstor\shadowuser
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\program files\systweak
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\program files\systweak\rebootservice
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\program files\uninstall information
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\program files\xerox
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\program files\xerox\nwwia
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\recycler
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\recycler\s-1-5-21-1614895754-1788223648-839522115-1008
Md5Hash :( bytes)

File: _desktop.ini
Path : \10.10.36.3\cshare\temp
Md5Hash :( bytes)

File: 82c84bea90984838318060736ae957d4.exe
Path : \10.10.36.4\admin$
Md5Hash :( bytes)

Also creates the following files on user's System which are also created by Genuine Software :-

Note:

These file(s) can be kept as they are also created by genuine Software.

File : appcompat.txt
Path : %temp%\wer1900.dir00
Md5Hash :1192ac16b19e066d86d65adc0780b25d ( 16216 bytes)

File : explorer.exe.hdmp
Path : %temp%\wer1900.dir00
Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)

File : explorer.exe.mdmp
Path : %temp%\wer1900.dir00
Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)

File : appcompat.txt
Path : %temp%\wer5cbf.dir00
Md5Hash :1192ac16b19e066d86d65adc0780b25d ( 16216 bytes)

File : explorer.exe.hdmp
Path : %temp%\wer5cbf.dir00
Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)

File : explorer.exe.mdmp
Path : %temp%\wer5cbf.dir00
Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)

File : appcompat.txt
Path : %temp%\wera17c.dir00
Md5Hash :1192ac16b19e066d86d65adc0780b25d ( 16216 bytes)

File : explorer.exe.hdmp
Path : %temp%\wera17c.dir00
Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)

File : explorer.exe.mdmp
Path : %temp%\wera17c.dir00
Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)

File : appcompat.txt
Path : %temp%\werba9c.dir00
Md5Hash :1192ac16b19e066d86d65adc0780b25d ( 16216 bytes)

File : explorer.exe.hdmp
Path : %temp%\werba9c.dir00
Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)

File : explorer.exe.mdmp
Path : %temp%\werba9c.dir00
Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)

Creates the following child process(s) on execution:

%systemdrive%\docume~1\antisp~1\locals~1\temp\$$a4.bat

%windir%\logo1_.exe

net stop kingsoft antivirus service

%windir%\explorer.exe

net1 stop kingsoft antivirus service

services.exe

%windir%\system32\dumprep.exe 1016 -dm 7 7 %systemdrive%\docume~1\antisp~1\locals~1\temp\wera17c.dir00\explorer.exe.mdmp 16325836412029264

%windir%\system32\dumprep.exe 1016 -dm 7 7 %systemdrive%\docume~1\antisp~1\locals~1\temp\wera17c.dir00\explorer.exe.hdmp 16325836412029276

%windir%\system32\rundll32.exe %windir%\system32\sysdm.cpl,noexecuteprocessexception %windir%\explorer.exe

%workingdir%\[random name].exe

%systemdrive%\docume~1\antisp~1\locals~1\temp\$$a45.bat

Copies the Following Files to Given Location :-

Copies :%windir%\logo1_.exe

To : \10.10.36.1\admin$\logo1_.exe

Copies :%windir%\logo1_.exe

To : \10.10.36.2\admin$\logo1_.exe

Copies :%windir%\logo1_.exe

To : \10.10.36.4\admin$\logo1_.exe

Moves the Following Files to Given Location :-

Moves :%workingdir%\[random name].exe.exe

To : %workingdir%\[random name].exe

NOTE:

1. %networkpath% Refers to the any network location on Local Area Network(LAN).
2. %programfiles% Refers to the program files folder. By default it is 'C:\Program Files'
3. %systemdrive% Refers to the windows System drive folder. By default it is 'C:\'
5. %temp% Refers to the windows temp folder. By default it is 'C:\Documents and Settings\[user]\Local Settings\Temp'
6. %windir% Refers to the windows root folder. By default it is 'C:\Windows'
7. %workingdir% Refers to the current directory in which user is working.

Important: We strongly recommend that you backup the Registry before making any changes to it. Incorrect changes to the Registry can result in permanent data loss or corrupted Files. Modify the malicious\suspicious Subkeys only.

Click Here for more spywarelib.com recommended PC Security and Optimization Tools

To modify registry entries in Windows Operating System:
Follow Steps:
1. Click Start > Run
2. Type “regedit” : to open registry editor
3. Navigate to required registry Key from the Left Tree control and modify accordingly.