Installation to the System

The first time an infected file is run on a clean system, the virus activates and drops the following files into the main Windows directory:

• Logo1_.exe
• RichDll.dll

The .DLL component is then injected into the EXPLORER.EXE process. The virus also creates a subfolder named UNINSTALL in the main Windows folder and then drops a file named RUNDL132.EXE at that location. The virus creates a startup value for that dropped file in Windows Registry:

• [HKLMSoftwareMicrosoftWindowsCurrentVersionRun]
  load=%WinDir%uninstall
  undl132.exe

Where %WinDir% represents the main Windows folder (usualy C:Windows).

Viking.DE also adds the following registry entry as a part of its installation:

• [HKLMSOFTWARESoftDownloadWWW]
  auto = "1"
  

The virus creates the following text files where it writes some information related to its activities:

• C:gamevir.txt
• C:log.txt

Infection of Files

Viking.DE is a prepending virus that searches for .EXE files on all available fixed hard drives and infects them by writing its body before the original file's body. In order for the host file to be run correctly, Viking.DE creates a backup copy of itself in the current directory as [filename].exe.exe and then drops and executes the original file as [filename].exe. After that, it deletes the uninfected original file and renames the backup file with the original filename. Viking.DE is able to do this with the help of a temporary batch file that it creates in the system's designated temporary folder as $$ad.bat.

Viking.DE virus avoids infecting files with the following strings in their paths or filenames:

• Program Files
• Common Files
• ComPlus Applications
• Documents and Settings
• InstallShield Installation Information
• Internet Explorer
• Messenger
• Microsoft Frontpage
• Microsoft Office
• Movie Maker
• MSN
• MSN Gaming Zone
• NetMeeting
• Outlook Express
• Recycled
• system
• System Volume Information
• system32
• windows
• Windows Media Player
• Windows NT
• WindowsUpdate
• winnt

Network Spreading Capabilities

The virus also attempts to propagate via network shares by copying itself to the following shared folders:

• admin$
• ipc$

- with the following accounts:

• administrator
• guest

Payload

As a part of the payload, the virus stops the following service:

• "Kingsoft AntiVirus Service"

- and terminates the following processes related to several anti-virus products:

• EGHOST.EXE
• IPARMOR.EXE
• KAVPFW.EXE
• MAILMON.EXE
• mcshield.exe
• RavMon.exe
• RavMonClass
• Ravmond.EXE
• regsvc.exe

The DLL component of Viking.DE virus attempts to download and execute files from Internet.

Last update 01 March 2007

 

TOP