File Investigation Report
SSVICHOSST.EXE
Malicious SoftwareYour PC is infected. The file called SSVICHOSST.EXE is considered unsafe and there may be other infections on your PC.
You should urgently check your PC and remove any malicious software including SSVICHOSST.EXE as soon as possible. The free version of Prevx will scan your PC for millions of spyware and malware infections in less than 2 minutes. Don't put your confidential data, or your identity at risk, check your PC now with Prevx.
Associated Malware Groups
The filename is associated with the malware groups:
- Malicious Software
- Cloaked Malware
- Malware Dropper
- Worm
File Behavior
SSVICHOSST.EXE has been seen to perform the following behavior:
- The Process is packed and/or encrypted using a software packing process
- Executes a Process
- Registers a Dynamic Link Library File
- Makes outbound connections to other computers using NETBIOSOUT protocols
- This process creates other processes on disk
- This Process Deletes Other Processes From Disk
- Modifies Windows Security Policies to restrict/expand User Privileges on the machine
- Disables Access to the Task Manager built into Windows
- Adds a Registry Key (RUN) to auto start Programs on system start up
- Disables the built in Windows File Protection System
- Disables Access to the Windows Registry Editior
- Terminates Processes
- Enables the system to use a Communications Proxy Server
- Can communicate with other computer systems using HTTP protocols
- Found on infected systems and resists interrogation by security products
- Uses low level functions to hide itself from the user and from system/security processes
- Injects code into other processes
- This Process looks to see what security products and services are running on the system
- Disables safe mode on your PC
- Creates a new Background Service on the machine
- Enables an In Process Object/Server - Common with DLL Injections
- Looks at the contents of the autoexec.bat file
- Reads email address and phone book details
- Disables or impairs the normal operation of the Windows Security Center
- Uses DNS to retrieve the IP address for web sites
- Visits web sites on your PC without you knowing
- Creates, modifies or schedules batch jobs
- Writes to another Process's Virtual Memory (Process Hijacking)
- Executes Processes stored in Temporary Folders
- Creates system tray popups, messages, errors and security warnings
- Opens browser pop ups
SSVICHOSST.EXE has been the subject of the following behavior:
- Executed as a Process
- Created as a process on disk
- Deleted as a process from disk
- Has code inserted into its Virtual Memory space by other programs
- Terminated as a Process
- Added as a Registry auto start to load Program on Boot up
- Copied to multiple locations on the system
- Created as a new Background Service on the machine
- Executed by Internet Explorer
- Created by processes which appear to be checking for interception by security products
- Executed from Temporary Folders
- Deleted as a Link in the Start Menu
Country Of Origin
The filename SSVICHOSST.EXE was first seen on May 23 2007 in the following geographical regions of the Prevx community:
- EGYPT on May 23 2007
- SPAIN on May 31 2007
- PORTUGAL on Jan 6 2008
- THAILAND on Jul 29 2008
File Name Aliases
SSVICHOSST.EXE can also use the following file names:
- NEW FOLDER.EXE
- MA MUSIQUE.EXE
- MY PLAYLISTS.EXE
- SAMPLE PLAYLISTS.EXE
- SYNC PLAYLISTS.EXE
- ÉCHANTILLONS DE MUSIQUE.EXE
- MES IMAGES.EXE
- ÉCHANTILLONS D'IMAGES.EXE
- MES VIDéOS.EXE
- EXEC.EXE
- ASSETS.EXE
- LOCAL.EXE
- PROMO.EXE
- AUDIO.EXE
- TILESETS.EXE
- CST.EXE
- DE.EXE
- EN.EXE
- ES.EXE
- 34340538.EXE
- KARışıK3.EXE
- PHOTOS.EXE
- VIDEO.EXE
- IMAGES.EXE
- FLASH_DISINFECTOR AMVO0 DLL CLEANER.EXE
- FLASH_DISINFECTOR(n).EXE
- FLASH_DISINFECTOR_.EXE
- FLASH_DISINFECTOR.EXE
- FLASH_DISINFECTOR[n].EXE
- PREVIEW.EXE
- JRPMQOQI.EXE
- WD7HK74C.EXE
- FLASH DISINFECTOR.EXE
- RAPID_SHARE.EXE
- U_FLASH_DISINFECTOR.EXE
- FLASH_DISINFECTOR NEW.EXE
- U_FLASH_DISINFECTOR[n].EXE
- AUTOPLAY/DOCS/FLASH_DISINFECTOR.EXE
- FLASH DESINFECTOR.EXE
- TOOL.EXE
- .DRIVER.EXE
- ملف التدريب.EXE
- EQUI0606.EXE
- VARIABLE DATABASE.EXE
- PICTURE.EXE
- SURVEYS.EXE
- OTHERS.EXE
- MSG_PROCEEDINGS.EXE
- TULIP MESSAGE.EXE
- CALL FOR PAPERS PACKAGE.EXE
- ICYE PAPERS.EXE
- PROPOSAL.EXE
- ICYE 3.EXE
- ICYE LETTERS.EXE
- SARINA.EXE
- PAPER REVIEWS.EXE
- FINAL ICYE SPONSORSHIP PROPOSAL.EXE
- FINAL PAPERS.EXE
- PICTURES.EXE
- SPONSORSHIP PROPOSAL.EXE
- YEF_0806.EXE
- THEVOLUMESETTINGSFOLDER.EXE
- EQULIBRIUM DESIGN.EXE
- NAFIZ & MEZBAH.EXE
- EQUILIBRIUM 3.EXE
- DOCUMENTS.EXE
- ICYE2007.EXE
- PROPOSAL FOR PRINT.EXE
- YEF UNIVERSITIES.EXE
- JOKES & QUOTE.EXE
- RESEARCH.EXE
- CARTOONS.EXE
- SIGNATURES.EXE
- RAW.EXE
- MODIFIED.EXE
- ORIGINAL.EXE
- SELECTED.EXE
- EXTRAS.EXE
- EXP + STUD INTERVIEW.EXE
- CLUB PICS.EXE
- SURVEY PICS.EXE
- ICYE 2.EXE
- RESUME.EXE
- BANNER.EXE
- BROCHURE.EXE
- YEF.EXE
- PRESS.EXE
- EQUI0706.EXE
- MEZBAH.EXE
- IND_AMRITA DASGUPTA.EXE
- IND_ANIRBAN MAZUMDAR.EXE
- CHN_YAN GUO.EXE
- BD_MAHMUDUL.EXE
- IND_PRASHANT TALWAR.EXE
- IND_RISHI CHAKRAVARTI.EXE
- BD_MEZBAH.EXE
- BD_RAIHAN.EXE
- IND_AMIR HAMZA.EXE
- IND_SAPTARSHI PAL.EXE
- IND_SUMAN.EXE
- SRL_THALAGALAGE.EXE
- BD_SALAHUDDIN.EXE
- BD_NAFIZ.EXE
- COPY OF THALAGALAGE.EXE
- COPY OF MEZBAH.EXE
- CORRECTEDVERSIONOFTHECARTOONS.EXE
- ALREADY SHORTENED.EXE
- ZIPPED.EXE
- CROSS TALK 2.EXE
- MESSAGES.EXE
- RESEARCH PAPER.EXE
- JOKES & QUOTES.EXE
- INTERVIEWS.EXE
- KEY INDICATORS.EXE
- EQUILIBRIUM.EXE
- TRASH.EXE
- DESKTOP FOLDER.EXE
- YEF_1006.EXE
- YEF_0906.EXE
- CASE 6 GROUP 3.EXE
- CASE-6, GROUP-8.EXE
- PICS.EXE
- CROSS TALK FOLLOW UP_SPEAKERS.EXE
- CROSSTALK_FOLLOW UP.EXE
- CLUB_NEWS.EXE
- THEFINDBYCONTENTFOLDER.EXE
- DESKTO~1.EXE
- YEF_PICTURES.EXE
- RADOUANE.EXE
- MOF.EXE
- ETC.EXE
- DISDN.EXE
- DRIVERS.EXE
- RAS.EXE
- 3.EXE
- EPSONSTYLUS_C66FAC8.EXE
- CANONMP390_SERIESD1DE.EXE
- CANONLBP3200D78B.EXE
- EPSONSTYLUS_C4259C8.EXE
- EPSONSTYLUS_C6239C9.EXE
- PAS.EXE
- E-MAIL ADDRESS.EXE
- VIRUS REMOVAL TOOL.EXE
- PROGRAM FILES.EXE
- LOGIN.EXE
- PIC.EXE
- PICS LHR.EXE
- ZAMAN.EXE
- DBONLINE.EXE
- PROJECT.EXE
- TODAY.EXE
- DE1.EXE
- PIX.EXE
- SYS.EXE
- STARTUP.EXE
- FS.EXE
- REPOSITORY.EXE
- SYSTEM VOLUME INFORMATION.EXE
- ANTIVIRUS.EXE
- ONLINE COURSES.EXE
- SYSTEM32.EXE
- WINDOWS.EXE
- [n].EXE
- ARDV_SUSPICIOUS_FILE(S).EXE
- .EXE
- [n].EXE
- .EXE
- 1.EXE
- .EXE
- .EXE
- .EXE
- .EXE
- NOD32.EXE
- UPDFILES.EXE
- LEVELS.EXE
- WARSHAK.EXE
- ZUMA DELUXE.EXE
- SOUNDS.EXE
- ANIMAL RETREAT.EXE
- USERDATA.EXE
- PROPERTIES.EXE
- MUSIC.EXE
- RIVERBED.EXE
- INVERSESPIRAL.EXE
- TRIANGLE.EXE
- TUNNELLEVEL.EXE
- MENU.EXE
- ROCKS.EXE
- SPACEINVADERS.EXE
- TURNAROUND.EXE
- FOREST.EXE
- SNAKEPIT.EXE
- TILTSPIRAL.EXE
- TARGETGLYPH.EXE
- CACHED_THUMBNAILS.EXE
- SQUARESVILLE.EXE
- BLACKSWIRLEY.EXE
- GROOVEFEST.EXE
- COASTER.EXE
- UNDEROVER.EXE
- SOUND.EXE
- PERM_THUMBNAILS.EXE
- SERPENTS.EXE
- SPIRAL.EXE
- CLAW.EXE
- LONGRANGE.EXE
- SPACE.EXE
- OVERUNDER.EXE
- GRAPHICS.EXE
- DESERT.EXE
- LOOPY.EXE
- FONTS.EXE
Filesizes
The following file size has been seen:
- 239,905 bytes
- 268,800 bytes
- 313,633 bytes
- 103,641 bytes
- 321,825 bytes
- 240,128 bytes
- 584,993 bytes
Vendor, Product and Version Information
Files with the name SSVICHOSST.EXE have been seen to have the following Vendor, Product and Version Information in the file header:
- ; ; 3, 2, 2, 0
File Type
The filename SSVICHOSST.EXE is used by multiple object types including executable programs,self extracting compressed files.
File Activity
One or more files with the name SSVICHOSST.EXE creates, deletes, copies or moves the following files and folders:
- Creates c:\windows\system32\wmiprvse.exe
- Deletes c:\docume~1\user\locals~1\temp\114906_xeex.exe
- Deletes c:\docume~1\user\locals~1\temp\12days.exe
- Deletes c:\docume~1\user\locals~1\temp\SGInit.exe
- Opens/modifes c:\autoexec.bat
- Creates c:\docume~1\user\locals~1\temp\lmwhw.exe
- Deletes c:\docume~1\user\locals~1\temp\120015_xeex.exe
- Deletes c:\docume~1\user\locals~1\temp\lmwhw.ex
- Creates c:\docume~1\user\locals~1\temp\winhxuea.exe
- Deletes c:\docume~1\user\locals~1\temp\winhxuea.exe
- Creates c:\docume~1\user\locals~1\temp\winmmcmqn.exe
- Creates c:\docume~1\user\locals~1\temp\itcrl.exe
- Deletes c:\docume~1\user\locals~1\temp\itcrl.exe
- Creates c:\docume~1\user\locals~1\temp\winahvm.exe
- Creates c:\docume~1\user\locals~1\temp\winwmin.exe
- Deletes c:\docume~1\user\locals~1\temp\winwmin.exe
- Creates c:\docume~1\user\locals~1\temp\winvgsi.exe
- Creates c:\docume~1\user\locals~1\temp\jtax.exe
- Deletes c:\docume~1\user\locals~1\temp\jtax.exe
- Creates c:\docume~1\user\locals~1\temp\winxvrk.exe
- Deletes c:\windows\system32\drivers\fkklg.sy
- Creates c:\windows\system32\drivers\fkklg.sys
- Creates c:\docume~1\user\locals~1\temp\axeg.exe
- Deletes c:\docume~1\user\locals~1\temp\axeg.exe
- Creates c:\docume~1\user\locals~1\temp\winsdodd.exe
- Creates c:\windows\system32\setting.in
- Deletes c:\docume~1\user\locals~1\temp\145687_xeex.exe
- Deletes c:\docume~1\user\locals~1\temp\winahvm.exe
- Deletes c:\docume~1\user\locals~1\temp\winmmcmqn.exe
- Deletes c:\docume~1\user\locals~1\temp\winsdodd.exe
- Deletes c:\docume~1\user\locals~1\temp\winvgsi.exe
- Deletes c:\docume~1\user\locals~1\temp\winxvrk.exe
- Creates c:\docume~1\user\locals~1\temp\winmioy.exe
- Deletes c:\docume~1\user\locals~1\temp\winmioy.exe
- Creates c:\docume~1\user\locals~1\temp\vtqx.exe
- Creates c:\docume~1\user\locals~1\temp\winnqmw.exe
- Deletes c:\docume~1\user\locals~1\temp\winnqmw.exe
- Creates c:\docume~1\user\locals~1\temp\jiakfq.exe
- Creates c:\docume~1\user\locals~1\temp\winphpn.exe
- Deletes c:\docume~1\user\locals~1\temp\winphpn.exe
- Creates c:\docume~1\user\locals~1\temp\gvrawg.exe
- Creates c:\docume~1\user\locals~1\temp\winpwvgrb.exe
- Deletes c:\windows\system32\drivers\fkklg.sys
- Deletes c:\windows\fonts\pDuuqr4BgFn65AeW.Ttf
- Deletes c:\windows\system32\76B9BA7A.dll
- Deletes c:\docume~1\user\locals~1\temp\120015~1.EXE
- Deletes c:\windows\fonts\xbaDtK8wjtgDDaS7M.Ttf
- Deletes c:\windows\system32\Hzs3R95W.dll
Registry Activity
One or more files with the name SSVICHOSST.EXE creates or modifies the following registry keys and values:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Hidden value:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\system DisableTaskMgr value:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\system DisableRegistryTools value:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings GlobalUserOffline value:
- HKEY_CURRENT_USER\Software\user914\1214104697 1919251317 [REG_DWORD, value: 00000023]
- HKEY_CURRENT_USER\Software\user914\1214104697 -456464662 value:
- HKEY_CURRENT_USER\Software\user914\1214104697 1462786655 value:
- HKEY_CURRENT_USER\Software\user914\1214104697 -912929324 [REG_DWORD, value: 00000023]
- HKEY_CURRENT_USER\Software\user914\1214104697 1006321993 [REG_DWORD, value: 0000006F]
- HKEY_CURRENT_USER\Software\user914\1214104697 -1369393986
- HKEY_CURRENT_USER\Software\user914\1214104697 549857331
- HKEY_CURRENT_USER\Software\user914 u1_0 [REG_DWORD, value: CC96283A]
- HKEY_CURRENT_USER\Software\user914 u2_0 [REG_DWORD, value: 0000158D]
- HKEY_CURRENT_USER\Software\user914 u3_0 [REG_DWORD, value: 01036A29]
- HKEY_CURRENT_USER\Software\user914 u4_0 value:
- HKEY_CURRENT_USER\Software\user914 u1_1 [REG_DWORD, value: 3C434D1C]
- HKEY_CURRENT_USER\Software\user914 u2_1 [REG_DWORD, value: 726566F8]
- HKEY_CURRENT_USER\Software\user914 u3_1 [REG_DWORD, value: 7366195C]
- HKEY_CURRENT_USER\Software\user914 u4_1 [REG_DWORD, value: 72657375]
- HKEY_CURRENT_USER\Software\user914 u1_2 [REG_DWORD, value: A07CA2CF]
- HKEY_CURRENT_USER\Software\user914 u2_2 [REG_DWORD, value: E4CAF367]
- HKEY_CURRENT_USER\Software\user914 u3_2 [REG_DWORD, value: E5C98CC3]
- HKEY_CURRENT_USER\Software\user914 u4_2 [REG_DWORD, value: E4CAE6EA]
- HKEY_CURRENT_USER\Software\user914 u1_3 [REG_DWORD, value: 40795A6F]
- HKEY_CURRENT_USER\Software\user914 u2_3 [REG_DWORD, value: 57304FD2]
- HKEY_CURRENT_USER\Software\user914 u3_3 [REG_DWORD, value: 56333076]
- HKEY_CURRENT_USER\Software\user914 u4_3 [REG_DWORD, value: 57305A5F]
- HKEY_CURRENT_USER\Software\user914 u1_4 [REG_DWORD, value: 2DE49F2D]
- HKEY_CURRENT_USER\Software\user914 u2_4 [REG_DWORD, value: C995D859]
- HKEY_CURRENT_USER\Software\user914 u3_4 [REG_DWORD, value: C896A7FD]
- HKEY_CURRENT_USER\Software\user914 u4_4 [REG_DWORD, value: C995CDD4]
- HKEY_CURRENT_USER\Software\user914 u1_5 [REG_DWORD, value: 05C27D81]
- HKEY_CURRENT_USER\Software\user914 u2_5 [REG_DWORD, value: 3BFB54C4]
- HKEY_CURRENT_USER\Software\user914 u3_5 [REG_DWORD, value: 3AF82B60]
- HKEY_CURRENT_USER\Software\user914 u4_5 [REG_DWORD, value: 3BFB4149]
- HKEY_CURRENT_USER\Software\user914 u1_6 [REG_DWORD, value: FAD02DE8]
- HKEY_CURRENT_USER\Software\user914 u2_6 [REG_DWORD, value: AE60A133]
- HKEY_CURRENT_USER\Software\user914 u3_6 [REG_DWORD, value: AF63DE97]
- HKEY_CURRENT_USER\Software\user914 u4_6 [REG_DWORD, value: AE60B4BE]
- HKEY_CURRENT_USER\Software\user914 u1_7 [REG_DWORD, value: 5CD57A60]
- HKEY_CURRENT_USER\Software\user914 u2_7 [REG_DWORD, value: 20C63DBE]
- HKEY_CURRENT_USER\Software\user914 u3_7 [REG_DWORD, value: 21C5421A]
- HKEY_CURRENT_USER\Software\user914 u4_7 [REG_DWORD, value: 20C62833]
- HKEY_CURRENT_USER\Software\user914 u1_8 [REG_DWORD, value: 6A4E9A0D]
- HKEY_CURRENT_USER\Software\user914 u2_8 [REG_DWORD, value: 932B8E25]
- HKEY_CURRENT_USER\Software\user914 u3_8 [REG_DWORD, value: 9228F181]
- HKEY_CURRENT_USER\Software\user914 u4_8 [REG_DWORD, value: 932B9BA8]
- HKEY_CURRENT_USER\Software\user914 u1_9 [REG_DWORD, value: AE7D9A44]
- HKEY_CURRENT_USER\Software\user914 u2_9 [REG_DWORD, value: 05911A90]
- HKEY_CURRENT_USER\Software\user914 u3_9 [REG_DWORD, value: 04926534]
Network Activity
One or more files with the name SSVICHOSST.EXE performs the following network events:
- DNS Lookup66.196.82.7 d.mx.mail.yahoo.com
Website Activity
One or more files with the name SSVICHOSST.EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.
- mattfoll .eu .interia .
- macedonia .my1 .
- SOSiTE_AVERI_SOSiTEEE .hahah?2113c=108387
- SOSiTE_AVERI_SOSiTEEE .hahah?21b1f=82809
- SOSiTE_AVERI_SOSiTEEE .hahah?22a33=127687
- SOSiTE_AVERI_SOSiTEEE .hahah?234e1=28921
- SOSiTE_AVERI_SOSiTEEE .hahah?2475f=14934
- nhatquanglan3 .t35 .com / setting .nql
- SOSiTE_AVERI_SOSiTEEE .hahah?252c9=45679
- nhatquanglan4 .t35 .com / setting .nql
- SOSiTE_AVERI_SOSiTEEE .hahah?25ea0=46588
- SOSiTE_AVERI_SOSiTEEE .hahah?26901=110567
- Port 80 IP:217.74.65.163
- Port 80 IP:195.216.243.2
- Port 80 IP:66.45.237.219
- SOSiTE_AVERI_SOSiTEEE .hahah?27a27=64937
- hgfdujt .info / ?2187
- hgfdujt .info / i .ph
- hgfdujt .info / myh .ph
- 195 .24 .77 .223 / utest / ?jutr=20573&oo=2&23cff=faaf9&ra=
- 195 .24 .77 .223 / utest / ?jutr=20573&oo=2&263f0=10bb90&ra=
- hgfdujt .info / ?2692
- TCP:66.196.82.7:25 Port:17
- Port 80 IP:195.24.77.223
- TCP:66.196.82.7:25 Port:18