McAfee > Theat Center > Virus Detail Page

Overview

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then further propagate the virus. Although many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Characteristics

File Property	Property Value
FileName	zz.exe
McAfee Detection	W32/Vaklik
Length	126,464 bytes
CRC	7D67CB7B
MD5	356829E7BFC8A1DDF97390DEA1B43EB7
SHA1	739E6A2C6CCAED95EF35929A395534A9B96A0EE0

Other Common Detection Aliases

Company Name	Detection Name
norman	sandbox: w32/viking.gen5.dropper

Avert® Labs has observed the following system activities:

Activity	Risk Level
Enumerates running processes	Medium
Writes executable in the windows folder	Low

Other detections that have been observed.

FileName	McAfee Supported
%USERPROFILE%\local settings\temp\tru2.tmp	W32/Vaklik

This sample can be identified by the following symptoms.

System Changes

These are general defaults for typical path variables. (Although they may differ, these examples are common.):
%WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

The following files have been added to the system:

%WINDIR%\1.exe

%WINDIR%\system32\drivers\klif.sys

The following registry elements have been created:

hkey_local_machine\system\currentcontrolset\services\kavsys\

• errorcontrol = 1
• imagepath = \??\c:\windows\system32\drivers\klif.sys
• start = 1
• type = 1

Symptoms

This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.

Method of Infection

Viruses are self-replicating. They are often spread by a network or by transmission to a removable medium such as a removable disk, writable CD, or USB drive. Viruses may also spread by infecting files on a network file system or a file system that is shared by another computer.

Removal

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then further propagate the virus. Although many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Characteristics

Characteristics -

File Property	Property Value
FileName	zz.exe
McAfee Detection	W32/Vaklik
Length	126,464 bytes
CRC	7D67CB7B
MD5	356829E7BFC8A1DDF97390DEA1B43EB7
SHA1	739E6A2C6CCAED95EF35929A395534A9B96A0EE0

Other Common Detection Aliases

Company Name	Detection Name
norman	sandbox: w32/viking.gen5.dropper

Avert® Labs has observed the following system activities:

Activity	Risk Level
Enumerates running processes	Medium
Writes executable in the windows folder	Low

Other detections that have been observed.

FileName	McAfee Supported
%USERPROFILE%\local settings\temp\tru2.tmp	W32/Vaklik

This sample can be identified by the following symptoms.

System Changes

These are general defaults for typical path variables. (Although they may differ, these examples are common.):
%WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

The following files have been added to the system:

%WINDIR%\1.exe

%WINDIR%\system32\drivers\klif.sys

The following registry elements have been created:

hkey_local_machine\system\currentcontrolset\services\kavsys\

• errorcontrol = 1
• imagepath = \??\c:\windows\system32\drivers\klif.sys
• start = 1
• type = 1

Symptoms

Symptoms -

This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.

Method of Infection

Method of Infection -

Viruses are self-replicating. They are often spread by a network or by transmission to a removable medium such as a removable disk, writable CD, or USB drive. Viruses may also spread by infecting files on a network file system or a file system that is shared by another computer.

Removal -

Removal -

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A