Virus:Win32/Viking.MS removal guide

The Virus:Win32/Viking.MS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Virus:Win32/Viking.MS virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• Manipulates data from or to the Recycle Bin
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Deletes its original binary from disk
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location
• Likely virus infection of existing system binary
• Anomalous binary characteristics

How to determine Virus:Win32/Viking.MS?

File Info:
name: 2BB70558A039B23347DA.mlw
path: /opt/CAPEv2/storage/binaries/32864a571fcb1bf87ecb48e729497613096faa26b51c7c46eb89bc67c70107d6
crc32: DEA4B657
md5: 2bb70558a039b23347da020a3622accc
sha1: 33a2c1831e1d2e16669911268c421835d7f33619
sha256: 32864a571fcb1bf87ecb48e729497613096faa26b51c7c46eb89bc67c70107d6
sha512: ef56a12515a6bd76450c34cd720177926f98628ae8c09acae772fc9fb978a95a81f24da67758620446eacbaf32cb7b377f54d76c445a2f575806c30da748bf13
ssdeep: 49152:HL5k1YCdptya507NUUWn043oHS3fTZYwVq1/xT3DDbw0TUqyh:fNhS9Yw8y5
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18ED55B13B3F941DCF0AAE2B8D7354632DAB2BC528B34B5DF125016191E76EE05B39722
sha3_384: 251948f91999cf3076baec58a6186d3fed22f58490d8d4e15f1fccdfb9e142e7e0d4e738af1fd49dc305c0b84851c964
ep_bytes: 558bec83c4e8535633c08945e88945ec
timestamp: 1992-06-19 22:22:17

Version Info:
0: [No Data]

Virus:Win32/Viking.MS also known as:

How to remove Virus:Win32/Viking.MS?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.