help needed! PC slow & infected

[Guest]

[suhasmk]

I find my computer running very slowly. This is happening from just few days.
I regularly update my anti-virus and other similar programs. Whenever i scan my computer, it takes plenty hours to scan just a few files.
I cannot even open task manager and run regedit.

Please help me in this regard...

[Ragwing]

Greetings,

If you can't open task manager or regedit, it's surely a malware.
Have you installed anything new this week or visited some site you haven't before?
Download HijackThis(http://216.180.233.162/~merijn/programs.php#hijackthis) and run it and save the logfile, then post it here(not the file, copy the text from the logfile instead), to see if there's anything that's suspicious.
Also try Spybot S&D and Lavasoft Ad-aware.


Ragwing

[suhasmk]

I installed certain programs from my pen drive.
I ran spybot and ad-aware. Spybot detected the problem (with task manager) and but didn't get it corrected.

However i have posted the log file. Please see attachment.

Moderator Edit: Please do NOT post HJT logs; they are simply too long.  Instead, upload them as an attachment.

[eXPerience]

C:\WINDOWS\system32\SSVICHOSST.exe

This one is a virus called SSVICHOSST.exe is W32/Sohana-R. a think it's a rootkit.
Try A-squared downloadable here : http://www.emsisoft.com/en/software/download/

Try scanning in safe mode with this

please post your advance

Xan

[zvaragabor]

Uhh, suhasmk, your computer is a malware farm.

Tick, then fix these:
C:\WINDOWS\system32\SSVICHOSST.exe
C:\WINDOWS\system32\SSVICHOSST.exe(yes, there are two of this)
R3 - URLSearchHook: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe SSVICHOSST.exe
F3 - REG:win.ini: load=
F3 - REG:win.ini: run=
O1 - Hosts: 203.27.235.25 www. payseal.icicibank.com
O1 - Hosts: 210.210.19.82 www. sifymall.com
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O4 - HKCU\..\Run: [Yahoo Messengger] C:\WINDOWS\system32\SSVICHOSST.exe
O4 - HKLM\..\Policies\Explorer\Run: [status] present
O4 - HKUS\S-1-5-18\..\RunOnce: [yisouu.dll] Regsvr32.exe /s C:\PROGRA~1\YiSou\yisouu.dll (User 'SYSTEM')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O17 - HKLM\System\CCS\Services\Tcpip\..\{48A41D8E-AED2-41C8-B82F-B28467017BBC}: NameServer = 202.144.95.4,202.144.66.6
O18 - Protocol: ebk - {1E411CE8-FE8B-4973-B8E0-6EA2CC3C6B06} - C:\WINDOWS\system32\ebkp.dll

Also run a full scan in safe mode with disabled system restore.

[eXPerience]

Uhh, suhasmk, your computer is a malware farm. 

LOL

C:\WINDOWS\system32\SSVICHOSST.exe

Yeah, still got one right 

Xan

[suhasmk]

Thank you zvaragabor. I tried your way. I could not find when i ran hijackthis.
C:\WINDOWS\system32\SSVICHOSST.exe
C:\WINDOWS\system32\SSVICHOSST.exe

However, i can run regedit and task manager.

[eXPerience]

Please send another log file so we can see that you're totally secure

[suhasmk]

here is my log file. i couldn't remove C:\WINDOWS\system32\SSVICHOSST.exe & C:\WINDOWS\system32\SSVICHOSST.exe
how can i remove that?

[eXPerience]

I can't see no problem any more but I'm not really an expert, still try a scan in safe mode (I hope you now how to do it? If not just say) and scan with avg, adaware, and spybot to be complete sure.

Also a saw 1 thing, it's no longer BoClean 4.24 it's 4.25 now, you should consider updating him 

Hope I could help ya
Xan

[zvaragabor]

I cannot see the SSVICHOSST.exe in the new report too.
As alaertsxan mentioned, try a scan in safe mode. I would also recommend a-Squared free to run. It's a good antispy too.
Anyway, which antivirus do you use?

[suhasmk]

I use AVG free-edition anti-virus, Spybot, Ad-aware and Comodo BOClean.

[suhasmk]

Greetings,
   Finally Comodo BOClean came to my rescue. It detected and healed that particular virus.

[little mermaid]

I have the same problem

and this is the log file in the next reply


plzzzzzzzzzzz tell me what should I do !!!!!!!!!!!!!?

[Ragwing]

I have the same problem

and this is the log file in the next reply


plzzzzzzzzzzz tell me what should I do !!!!!!!!!!!!!?

If none of the above works, post your own topic in 'Virus/Malware Removal Assistance'.
Include what security products you use, and include a HijackThis log(http://216.180.233.162/~merijn/programs.php#hijackthis).


Ragwing

[Tags:]