Remove Viking.ix - Spyware Removal Information

More than 1126248 spyware signatures and growing

Spywarelib Search

Search in:

Spywares

Files

Md5

Registry

Worm.Viking.ix Analysis Report

Threat Submitted On: 5/21/2007 12:37:34 PM

Threat Analysed On: 5/21/2007 5:37:34 PM

Threat Updated On: 10/7/2009 11:30:29 PM

Type : Worm

Symptoms of Viking.ix

Replicates itself and spreads to the other computers of the network.
Installed by executing the scripts from infected e-mail attachments or messages.

Removal Recommended (Click here to remove automatically)

Removal Recommended

Information

Alias : Worm.Win32.Viking.ix

Md5 Hash : [f40c5e438fa3d0ca133e96e01c6b15aa]

File Size : (28739 bytes)

Technical Details

Here are the Technical findings of our analysis team after analyzing this malware in detail :-

Creates the following infected Files on user's System

Note:

Delete the following Files to remove Infection

File: 11dea76ecb8113770bc0dd2d75190c8a.exe
Path : %networkpath%
Md5Hash :( bytes)

File: 11dea76ecb8113770bc0dd2d75190c8a.exe.exe
Path : %networkpath%
Md5Hash :( bytes)

File: 1c12aaef849304cb16fdce2e7b447885.exe
Path : %networkpath%
Md5Hash :( bytes)

File: 1c12aaef849304cb16fdce2e7b447885.exe.exe
Path : %networkpath%
Md5Hash :( bytes)

File: a79843cccd5573827b2600c1ed4bdbf5.exe
Path : %networkpath%
Md5Hash :( bytes)

File: a79843cccd5573827b2600c1ed4bdbf5.exe.exe
Path : %networkpath%
Md5Hash :( bytes)

File: dir2file.exe
Path : %networkpath%

	Md5Hash :


		( bytes)


		5e77cf55dac10945fea8e63f792b45ce ( 130036 bytes)


		ca186151d3800284fe9e8361a5b9922c ( 133391 bytes)

File: dir2file.exe.exe
Path : %networkpath%
Md5Hash :( bytes)

File: ecd665565592701a249f1d7d9c917f64.exe
Path : %networkpath%
Md5Hash :( bytes)

File: ecd665565592701a249f1d7d9c917f64.exe.exe
Path : %networkpath%
Md5Hash :( bytes)

File: fbcde18bf4d45202c136b6aefa95e076.exe
Path : %networkpath%
Md5Hash :( bytes)

File: fbcde18bf4d45202c136b6aefa95e076.exe.exe
Path : %networkpath%
Md5Hash :( bytes)

File: jgfwu.exe
Path : %networkpath%
Md5Hash :( bytes)

File: jgfwu.exe.exe
Path : %networkpath%
Md5Hash :( bytes)

File: logo1_.exe
Path : %networkpath%
Md5Hash :( bytes)

File: pdjjk.exe
Path : %networkpath%
Md5Hash :( bytes)

File: pdjjk.exe.exe
Path : %networkpath%
Md5Hash :( bytes)

File: shadowuser.exe.exe
Path : %networkpath%
Md5Hash :( bytes)

File: suatshut.exe.exe
Path : %networkpath%
Md5Hash :( bytes)

File: _desktop.ini
Path : %programfiles%
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\dir2file
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: dir2file.exe.exe
Path : %programfiles%\dir2file
Md5Hash :( bytes)

File: _desktop.ini
Path : %programfiles%\inctrl5
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\msn
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\msn\msncorefiles
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\msn\msncorefiles\install
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\msn\msncorefiles\install\msn9components
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\msn\msncorefiles\oobe
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\online services
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\uninstall information
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\xerox
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %programfiles%\xerox\nwwia
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%

	Md5Hash :


		3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)


		c5c248e7bfc232af9733ed70a05bdd56 ( 9 bytes)


		d454c143870a54d1bf76db0ee21eaaf5 ( 9 bytes)


		e36ae5b5da04f8d60b6403375123b464 ( 8 bytes)

File: _desktop.ini
Path : %workingdir%
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\adminscripts
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\mailroot
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\mailroot\badmail
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\mailroot\drop
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\mailroot\mailbox
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\mailroot\pickup
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\mailroot\queue
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\mailroot\route
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\mailroot\sorttemp
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\inetpub\wwwroot
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\recycler
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\recycler\s-1-5-21-1614895754-1788223648-839522115-1008
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: _desktop.ini
Path : %systemdrive%\temp
Md5Hash :3aa98bcde6c9ee8791b673bcb641d460 ( 9 bytes)

File: $$a3.bat
Path : %temp%
Md5Hash :4df6602b9093f6aebe9713e6d9928ffd ( bytes)

File: $$a31.bat
Path : %temp%
Md5Hash :21022003ccb5b3c054aef8e66fadf075 ( bytes)

File: $$a5.bat
Path : %temp%

	Md5Hash :


		0c525006fe6c1801101c19fc5d89047f ( 398 bytes)


		307f2ca54f95d21ba944b0c5c4d7bd10 ( bytes)


		abebb83ba5270411a70998b0fd7a15d4 ( bytes)


		bbdaa17f95cedbfc44beb66b3d83bd13 ( bytes)


		ff537fa2cf978c4071c2383cab65cd06 ( bytes)

File: 77c_appcompat.txt
Path : %temp%
Md5Hash :f040ee73d1b278fb07a7ea657572bce1 ( 29006 bytes)

File: be7c_appcompat.txt
Path : %temp%
Md5Hash :f040ee73d1b278fb07a7ea657572bce1 ( 29006 bytes)

File: d558_appcompat.txt
Path : %temp%
Md5Hash :f040ee73d1b278fb07a7ea657572bce1 ( 29006 bytes)

File: ieb88d.tmp
Path : %temp%
Md5Hash :( bytes)

File: iecaec.tmp
Path : %temp%
Md5Hash :( bytes)

File: iefedd.tmp
Path : %temp%
Md5Hash :( bytes)

File: explorer.exe.hdmp
Path : %temp%\wer7d5e.dir00
Md5Hash :( bytes)

File: explorer.exe.mdmp
Path : %temp%\wer7d5e.dir00
Md5Hash :( bytes)

File: manifest.txt
Path : %temp%\wer7d5e.dir00
Md5Hash :1159cf1b2c92a0087e6d6739bb69f9ca ( bytes)

File: manifest.txt
Path : %temp%\wer87c1.dir00
Md5Hash :a228754f375daa15f6342009db99ae76 ( 1872 bytes)

File: rundl132.exe
Path : %windir%\command
Md5Hash :( bytes)

File: logo1_.exe
Path : %windir%

	Md5Hash :


		2d1fdfc7ae4f80233b4e7c2f3d0e59c8 ( 109622 bytes)


		6151a69c1004a77b7a32c58844685731 ( 63351 bytes)


		8d5e8b2ba870f4d23a460ee5c9a2ca7d ( 64645 bytes)


		97a2816f38045643acb3d5ec245b0440 ( 62985 bytes)


		c4a4e6ff8719977fc2053de6754a4aef ( 69108 bytes)

File: richdll.dll
Path : %windir%

	Md5Hash :


		19c58928b70872b2c5a64c4d454e40cc ( 27976 bytes)


		1d0bf3532d76b6a156b920ed5d021dca ( 27796 bytes)


		55dda6e67b46d0a752587dd771b8fedf ( 27740 bytes)


		a027defd6f8797ea76b54bad74a1e381 ( 29066 bytes)


		c4a60bc243f04aa2a87b8fc5b5870163 ( 27992 bytes)


		d416319182e93c000913f487b145cd37 ( 28784 bytes)

File: rundl132.exe
Path : %windir%\uninstall

	Md5Hash :


		3a54e24444e109a7905a455e64086fc6 ( 61681 bytes)


		6151a69c1004a77b7a32c58844685731 ( 63351 bytes)


		8d5e8b2ba870f4d23a460ee5c9a2ca7d ( 64645 bytes)


		97a2816f38045643acb3d5ec245b0440 ( 62985 bytes)


		c4a4e6ff8719977fc2053de6754a4aef ( 69108 bytes)

File: [randomname].exe
Path : %workingdir%

	Md5Hash :


		078913d2ef6abf1dc19d472b2b588b1e ( 32068 bytes)


		1451da5e94d08ecbe01d4e63bc37f0ae ( 27704 bytes)


		1b20ff194c20bea1a0568952208f9bd3 ( 27932 bytes)


		35545687d06c283bcfaaa17c40d0339e ( 26136 bytes)


		3a54e24444e109a7905a455e64086fc6 ( 61681 bytes)


		3cee71a9c952f1b0b5ac0e6ddce43996 ( 134420 bytes)


		42378cc9ebc9ceaee43d9393aeace24d ( 108041 bytes)


		429a35b53f0b609e3832f91fb9aca22f ( 32580 bytes)


		4bf29f67aa11fc737cefa52d92ae99bb ( 30700 bytes)


		5a758b1556701ef7741e6c4944374716 ( 74166 bytes)


		649248d7bdea9654c7b38ad891af3947 ( 643072 bytes)


		6ad9121948484bce78cae35ff9e43302 ( 49152 bytes)


		6b41bcb1c815cbd74df5389ade8ccbab ( 27468 bytes)


		7657302ed5bb497872ddefa71aa0aa6a ( 25604 bytes)


		82b1537e833a60e72edd3e23584cf8f0 ( 25984 bytes)


		864b74e965fa1aae25306bd947c863db ( 77824 bytes)


		8b3a46079b182a5584660ea6d68f15ce ( 34720 bytes)


		948cc98c758800095a34431ad26a894f ( 109622 bytes)


		c283fd660eb1243e898be5f454e87e7f ( 31576 bytes)


		ca2c65fc90e4a5c0a4a87474b264be88 ( 26924 bytes)


		d955e0ee24f9168350ead7579158cb27 ( 27560 bytes)


		eee775365f3b5d885f158fc015582a86 ( 30352 bytes)


		f2a0e12b34b7c8a7ca1ae56488c8cb80 ( 33796 bytes)


		ff2e4a29095f0c442f4e410cf5f955d3 ( 28020 bytes)

File: [randomname].exe.exe
Path : %workingdir%

	Md5Hash :


		50e41c17bc558e2ce2db4cc526d4faaa ( bytes)


		649248d7bdea9654c7b38ad891af3947 ( bytes)


		6aa800c8c8e08a32a55c675eb912d694 ( bytes)


		864b74e965fa1aae25306bd947c863db ( bytes)


		d81963f7f0e7bec4af287588113ee761 ( bytes)

File: ¡¡¡¡¡¡.exe
Path : \10.10.36.1\cshare
Md5Hash :( bytes)

File: ¡¡¡¡¡¡.exe.exe
Path : \10.10.36.1\cshare
Md5Hash :( bytes)

File: d2eb3a73c05fa15b69bb1c21fdebea44.exe
Path : \10.10.36.1\cshare\data
Md5Hash :( bytes)

File: d2eb3a73c05fa15b69bb1c21fdebea44.exe.exe
Path : \10.10.36.1\cshare\data
Md5Hash :( bytes)

File: dir2file.exe
Path : \10.10.36.1\cshare\program files\dir2file
Md5Hash :565c1cffc944307899d5340c3facae3f ( 67580 bytes)

File: dir2file.exe.exe
Path : \10.10.36.1\cshare\program files\dir2file
Md5Hash :( bytes)

File: 1bfe5b9769958f1ab5cb9129ce9bcc67.exe
Path : \10.10.36.2\cshare\data
Md5Hash :( bytes)

File: 1bfe5b9769958f1ab5cb9129ce9bcc67.exe.exe
Path : \10.10.36.2\cshare\data
Md5Hash :( bytes)

File: dir2file.exe
Path : \10.10.36.2\cshare\program files\dir2file
Md5Hash :( bytes)

File: dir2file.exe.exe
Path : \10.10.36.2\cshare\program files\dir2file
Md5Hash :( bytes)

File: shadowuser.exe
Path : \10.10.36.2\cshare\program files\shadowstor\shadowuser
Md5Hash :( bytes)

File: shadowuser.exe.exe
Path : \10.10.36.2\cshare\program files\shadowstor\shadowuser
Md5Hash :( bytes)

File: suatshut.exe
Path : \10.10.36.2\cshare\program files\shadowstor\shadowuser
Md5Hash :( bytes)

File: suatshut.exe.exe
Path : \10.10.36.2\cshare\program files\shadowstor\shadowuser
Md5Hash :( bytes)

File: dir2file.exe
Path : \10.10.36.3\cshare\program files\dir2file
Md5Hash :50b782a775ae4ffcb17199ec6e9aa2ae ( 137217 bytes)

File: dir2file.exe.exe
Path : \10.10.36.3\cshare\program files\dir2file
Md5Hash :( bytes)

Also creates the following files on user's System which are also created by Genuine Software :-

Note:

These file(s) can be kept as they are also created by genuine Software.

File : dir2file.exe
Path : %networkpath%
Md5Hash :e8bf4f790ab6a3f46dee58747c2507be ( 60928 bytes)

File : shadowuser.exe
Path : %networkpath%
Md5Hash :83d22d623a91d0b18e773a0de544c336 ( 921600 bytes)

File : suatshut.exe
Path : %networkpath%
Md5Hash :5dc088f31cc31c217ef50c7a50680b10 ( 40960 bytes)

File : dir2file.exe
Path : %programfiles%\dir2file

	Md5Hash :


		118c17ed123c01c21c0b74881f6c8946 ( 124279 bytes)


		4f54127ca0dc8f79c5aefba096704591 ( 123913 bytes)


		5e77cf55dac10945fea8e63f792b45ce ( 130036 bytes)


		ca186151d3800284fe9e8361a5b9922c ( 133391 bytes)

File : 1cb0b.dmp
Path : %temp%
Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)

File : 1e2c9.dmp
Path : %temp%
Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)

File : 216ba.dmp
Path : %temp%
Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)

File : 23474.dmp
Path : %temp%
Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)

File : 246f_appcompat.txt
Path : %temp%
Md5Hash :1192ac16b19e066d86d65adc0780b25d ( 16216 bytes)

File : appcompat.txt
Path : %temp%\wer7d5e.dir00
Md5Hash :1192ac16b19e066d86d65adc0780b25d ( bytes)

File : appcompat.txt
Path : %temp%\wer87c1.dir00
Md5Hash :1192ac16b19e066d86d65adc0780b25d ( 16216 bytes)

File : explorer.exe.hdmp
Path : %temp%\wer87c1.dir00
Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)

File : explorer.exe.mdmp
Path : %temp%\wer87c1.dir00
Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)

Creates the following child process(s) on execution:

%programfiles%\internet explorer\iexplore.exe

net stop kingsoft antivirus service

%systemdrive%\docume~1\antisp~1\locals~1\temp\$$a7.bat

services.exe

%windir%\logo1_.exe

net1 stop kingsoft antivirus service

%workingdir%\[random name].exe

%windir%\system32\dwwin.exe -x -s 760

%programfiles%\internet explorer\iedw.exe -h 768

%windir%\system32\dwwin.exe -x -s 2028

%windir%\system32\drwtsn32 -p 1852 -e 768 -g

%programfiles%\internet explorer\iedw.exe -h 2024

Creates the Following MUTEX(s) on user's System:-

iexplore.xpexceptionfilter

raspbfile

Copies the Following Files to Given Location :-

Copies :%windir%\logo1_.exe

To : \10.10.34.1\admin$\logo1_.exe

Copies :%windir%\logo1_.exe

To : \10.10.34.2\admin$\logo1_.exe

Copies :%windir%\logo1_.exe

To : \10.10.34.3\admin$\logo1_.exe

Moves the Following Files to Given Location :-

Moves :%workingdir%\[random name].exe.exe

To : %workingdir%\[random name].exe

Moves :%programfiles%\dir2file\dir2file.exe.exe

To : %programfiles%\dir2file\dir2file.exe

Moves :\10.10.34.1\cshare\program files\dir2file\dir2file.exe.exe

To : \10.10.34.1\cshare\program files\dir2file\dir2file.exe

Moves :\10.10.34.2\cshare\data\5b5f2ffb6c20b341438a5d3233757070.exe.exe

To : \10.10.34.2\cshare\data\5b5f2ffb6c20b341438a5d3233757070.exe

Moves :\10.10.34.2\cshare\program files\dir2file\dir2file.exe.exe

To : \10.10.34.2\cshare\program files\dir2file\dir2file.exe

Moves :\10.10.34.3\cshare\program files\dir2file\dir2file.exe.exe

To : \10.10.34.3\cshare\program files\dir2file\dir2file.exe

Moves :%workingdir%\downtemp

To : %workingdir%\download

NOTE:

1. %networkpath% Refers to the any network location on Local Area Network(LAN).
2. %programfiles% Refers to the program files folder. By default it is 'C:\Program Files'
3. %systemdrive% Refers to the windows System drive folder. By default it is 'C:\'
5. %temp% Refers to the windows temp folder. By default it is 'C:\Documents and Settings\[user]\Local Settings\Temp'
6. %windir% Refers to the windows root folder. By default it is 'C:\Windows'
7. %workingdir% Refers to the current directory in which user is working.

Important: We strongly recommend that you backup the Registry before making any changes to it. Incorrect changes to the Registry can result in permanent data loss or corrupted Files. Modify the malicious\suspicious Subkeys only.

Click Here for more spywarelib.com recommended PC Security and Optimization Tools

To modify registry entries in Windows Operating System:
Follow Steps:
1. Click Start > Run
2. Type “regedit” : to open registry editor
3. Navigate to required registry Key from the Left Tree control and modify accordingly.