Hi,
Can somebody please help me. My company has a fairly big size LAN system (about 60 PCs). We run Windows 2003 Server with Windows 2000 clients. The antivirus system used for the network is Symantec Corporate Edition. For the past 2 days the clients have been showing a number of pop ups and have been prone to errors and applications crashing. We scanned the machines on a number of occasions with Symantec, however, it failed to detect anything wrong with the machines.
As I use AVAST home edition on my PC at home, I suggested to the Network Administrator to install AVAST professional edition to try and detect the virus/worm. The Symantec antivirus was uninstalled and AVAST professional edition with the 30 day trial period on the server. Upon installation and first scan the antivirus found that the machine is infected with Win32:Tibs-ADO. Over 70 .exe files have been shown to be infected. However, it seems that the AV has no way to clean these files and therefore we have moved these files to the chest.
The machine also seems to have the following infected files:
logo1_.exe
rundll123.exe
richdll.exe
The above mentioned seem to keep appearing even though they are detected and deleted by the AV.
Of the files that have been move to the chest, all of them are .exe file, however our dilemma is that we don’t know if these are legitmate files that have been infected or files that have been created by the worm. If these files are legitmate then the applications to which they relate will be effected if we delete them. And if they are created by the worm then we are simply cutting the branches of the tree, while the root is still in place.
Will really appreciate if someone can help us out.
The first step is to isolate the PCs so the worm can’t travel through your LAN. This may be the sole source of reinfection, or it may come from the WAN side.
Here’s some information on what logo1_.exe might be
What are the locations of rundll123.exe and richdll.exe?
Of the files that have been move to the chest, all of them are .exe file, however our dilemma is that we don't know if these are legitmate files that have been infected or files that have been created by the worm. If these files are legitmate then the applications to which they relate will be effected if we delete them.
I think the effect will be the same if they are in the chest since they can't run from that location. So if your applications still work these are probably worm related but don't be in a hurry to delete them.
The virus was packed with AsPack so that not so easy to unpack it. It copies itself to the following locations:
\windows\logo1_.exe
\windows\uninstall\rundl132.exe
It drops the Trojan.Viking.EO Trojan file into the \windows\richdll.dll
Removal instructions
1. It is necessary to close of all Windows application
Delete the following files:
\windows\logo1_.exe
\windows\uninstall\rundl132.exe
\windows\richdll.dll
Remove the following Registry value:
HKLM\Microsoft\Windows\CurrentVersion\Run\load.
Detect and disinfect the infected files with the AntiVirus application.
Where %WinDir% represents the main Windows folder (usualy C:\Windows).
Viking.DE also adds the following registry entry as a part of its installation:
[HKLM\SOFTWARE\Soft\DownloadWWW]
auto = “1”
Obviously a back up should be made before making any registry changes. Also, both sites recommend disinfection, not deletion, of the infected application files.
Yes, Viking is very ‘popular’ in china recently, it infects all .exe files in the computer and spread with flashdisk. It add “autorun.inf” and virus program into each disk.
