Threat behavior
Installation
When an infected file is executed, it drops a copy of the virus body to %temp%\tem81.exe. This file is detected as Worm:Win32/Viking.NA. The virus then passes control to the requested host file.
The dropped file, tem81.exe, replaces a system service DLL file (as well as the cached copy in <system folder>\dllcache). It attempts to choose a system service to replace from the following registry entry:
Subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
value: netsvcs
It tries to stop and replace one of the following system services should this attempt fail:
WmdmPmSN
AppMgmt
Ntmssvc
Rasauto
BITS
Browser
ERSvc
A typical example of a replaced system service on a system with default settings is "6to4" -the corresponding system service DLL files are <system folder>\6to4.dll and <system folder>\dllcache\6to4.dll.
It sets the replaced service as an autostart system service to make sure the replaced copy is loaded at each Windows start.
Finally, tem81.exe copies itself to <system folder>\dllcache\systembox.bak.
It also creates a batch file, %temp%\TempDel.bat, that it uses to delete itself.
Additional information
Analysis by Chun Feng
Prevention
