File Investigation Report
SVICHOSSST.EXE
Cloaked MalwareYour PC is infected. The file called SVICHOSSST.EXE is considered unsafe and there may be other infections on your PC.
You should urgently check your PC and remove any malicious software including SVICHOSSST.EXE as soon as possible. The free version of Prevx will scan your PC for millions of spyware and malware infections in less than 2 minutes. Don't put your confidential data, or your identity at risk, check your PC now with Prevx.
Associated Malware Groups
The filename is associated with the malware groups:
- Cloaked Malware
- Malicious Software
File Behavior
SVICHOSSST.EXE has been seen to perform the following behavior:
- The Process is packed and/or encrypted using a software packing process
- Disables the built in Windows File Protection System
- Disables Access to the Task Manager built into Windows
- Modifies Windows Security Policies to restrict/expand User Privileges on the machine
- Disables Access to the Windows Registry Editior
- Adds a Registry Key (RUN) to auto start Programs on system start up
- This process creates other processes on disk
- This Process Deletes Other Processes From Disk
- Executes a Process
- Can communicate with other computer systems using HTTP protocols
- Terminates Processes
- Sets processes to start during user logon
- Creates a new Background Service on the machine
- Looks at the contents of the autoexec.bat file
- Reads email address and phone book details
- Visits web sites on your PC without you knowing
- Creates, modifies or schedules batch jobs
- Makes outbound connections to other computers using NETBIOSOUT protocols
- Registers a Dynamic Link Library File
- Found on infected systems and resists interrogation by security products
- Uses low level functions to hide itself from the user and from system/security processes
SVICHOSSST.EXE has been the subject of the following behavior:
- Added as a Registry auto start to load Program on Boot up
- Created as a process on disk
- Executed as a Process
- Has code inserted into its Virtual Memory space by other programs
- Copied to multiple locations on the system
- Created by processes which appear to be checking for interception by security products
- Deleted as a process from disk
- Terminated as a Process
Country Of Origin
The filename SVICHOSSST.EXE was first seen on May 22 2007 in the following geographical regions of the Prevx community:
- The UNITED ARAB EMIRATES on May 22 2007
- PAKISTAN on May 26 2007
- The UNITED KINGDOM on Mar 22 2008
- SPAIN on Jul 15 2009
File Name Aliases
SVICHOSSST.EXE can also use the following file names:
- NEW FOLDER.EXE
- DATA_FLASH.EXE
- DRIVERS.EXE
- POP DOWNLOADER.EXE
- NEW.EXE
- NAV_DEFS.EXE
- EITMAAD FORMATS.EXE
- SOFTWARE.EXE
- FRESH.EXE
- COPY OF DRIVERS.EXE
- HP2600N.EXE
- ENGLISH.EXE
- MANUALS.EXE
- DRIVER.EXE
- PMS FORMATS.EXE
- ANNEX.EXE
- ETIMAAD FORMS HRM.EXE
- ETIMAAD FORMATS ADMN.EXE
- STORES.EXE
- PROCURMENT.EXE
- ADMIN.EXE
- ADMIN 2.EXE
- APPOINTMENT LETTERS EXCEL.EXE
- CONTRACTEE.EXE
- APPOINTMENT LETTERS 30MAY07.EXE
- ABD FEB 06.EXE
- ABD JAN 06.EXE
- ABD OCT 06.EXE
- ABD PICS.EXE
- EESHA AMIN.EXE
- EESHA BIRTHDAY JAN 06.EXE
- FEB 07.EXE
- HASSAN.EXE
- JAN 07 PICS.EXE
- MUREE VISIT ORG.EXE
- NOV 06 PICS CORRECTED.EXE
- ABDULLAH.EXE
- BABY PICS.EXE
- BABY'S PIC.EXE
- BABY'S PIC 1.EXE
- BABY'S PIC 2.EXE
- OMER HD.EXE
- OMERENG.EXE
- RUHAB.EXE
- SPORTS DAY.EXE
- DIMS.EXE
- PWM.EXE
- AZXCX.EXE
- CONTROL SYSTEM DESIGN - SIMULATIONS_FILES.EXE
- CONTROL SYSTEM.EXE
- INVERTED PENDULUM CONTROL SYSTEM - GOOGLE SEARCH_FILES.EXE
- PWM1.EXE
- CTM EXAMPLE FREQUENCY RESPONSE CONTROL OF THE INVERTED PENDULUM MODEL_FILES.EXE
- CTM EXAMPLE ROOT LOCUS CONTROL OF THE INVERTED PENDULUM MODEL_FILES.EXE
- CTM EXAMPLE INVERTED PENDULUM MODELING_FILES.EXE
- MUFTAI KA MAAL.EXE
- FEEDBACK AND TEMPERATURE CONTROL_FILES.EXE
- VISUAL SOLUTIONS, INC_ - VISSIM, VISSIM-COMM & VISSIM-DSP HOME PAGE_FILES.EXE
- CONTROL SYSTEMS.EXE
- FILES.EXE
- FEEDBACK.EXE
- VOICE.EXE
- RECORD.EXE
- DSP CHAPTER 4.EXE
- AD CONVERTER.EXE
- AD ONLY.EXE
- ADC.EXE
- ADC1.EXE
- LEVEL 2 - SOP.EXE
- OBSOLETE.EXE
- LEVEL 3 - POLICIES.EXE
- LEVEL 4 - FORMATS.EXE
- ORGANOGRAM & JDS.EXE
- PFC.EXE
- QUALITY OBJECTIVES.EXE
- QUALITY RECORDS.EXE
- NOV 06 PICS.EXE
- ORGANOGRAM & JDS.EXE
- PFCS & QUALITY OBJECTIVES.EXE
- DHOTI DAY PICS BY ADEEL.EXE
- PREV ANTIVIRUS.EXE
- DATASHEET.EXE
- CHAPTER5(NEW PROBLEMS).EXE
- CHAP 5.EXE
- CHAPTER 2.EXE
- WORK.EXE
- DSP LATEST.EXE
- LAST LAB.EXE
- DSP LAB.EXE
- VLCSOURCE.EXE
- VLCPORTABLESOURCE.EXE
- OTHER.EXE
- SETTINGS.EXE
- DATA.EXE
- FONTS.EXE
- SKINS.EXE
- PLUGINS.EXE
- VOLUME.EXE
- UNSELECT.EXE
- SELECTION.EXE
- SELECTED.EXE
- DVD.EXE
- DEFAULT.EXE
- ATTOCK CEMENT MAIL.EXE
- ACROBAT.EXE
- NORTON ANTIVIRUS CORPORATE EDITION 9.01.EXE
- PERFORMANCE.EXE
- SYMANTEC ANTIVIRUS CORPORATE CLIENT 10.EXE
- HELP.EXE
- JAVA.EXE
- ODBC.EXE
- SWING.EXE
- REDIST.EXE
- RELNOTES.EXE
- RESPONSE.EXE
- JARRED.EXE
- MSOCACHE.EXE
- MY MUSIC.EXE
- LAB4.EXE
- BATCHREP.EXE
- LAB5.EXE
- LAB51.EXE
- CHAPTER 3.EXE
- ACTIONS.EXE
- FOTO.EXE
- IMAGE PERSONAL.EXE
- KOSM.EXE
- TIARA WORKSHOP.EXE
- SAINS F4 FINAL 2007.EXE
- SAINS PERTANIAN 2006.EXE
- LEE AH LOK FRUIT PLANTATION_FILES.EXE
- BUKU DOA-SRI MALAYSIA.EXE
- UNKNOWN ARTIST.EXE
- UNKNOWN ALBUM (26-01-2006 08-54-04 AM).EXE
- UNKNOWN ALBUM (16-02-2006 07-03-08 PM).EXE
- UNKNOWN ALBUM (24-04-2006 08-58-26 AM).EXE
- UNKNOWN ALBUM (16-02-2006 07-46-34 AM).EXE
- UNKNOWN ALBUM (09-03-2006 06-55-39 AM).EXE
- MY PLAYLISTS.EXE
- UNKNOWN ALBUM (11-02-2006 11-57-32 PM).EXE
- FOTO AKTSPN2009.EXE
- UNKNOWN ALBUM (11-02-2006 07-02-04 PM).EXE
- UNKNOWN ALBUM (01-02-2006 10-12-34 PM).EXE
- VIDEO.EXE
- VIDEO CLIPS.EXE
- PERK.STAFF GC.EXE
- USER-C5AB74758D.EXE
- PERKEMBANGAN STAF JPNS 2008 SEK 6.S.ALAM.EXE
- MSRM.EXE
- PEKELILING.EXE
- MS.CONFIG.EXE
- PATS2.EXE
- STRATEGIC PLANNING.EXE
- PERCUBAAN SPM 2007 & LPM.EXE
- FUNNYCP.EXE
- PERCUBAAN 2007 PERAK K2.EXE
- PBS 2008.EXE
- PANITIA SPN KS.EXE
- JOHOR.EXE
- SELANGOR.EXE
- NT.CONFIG.EXE
- PENANG.EXE
- KELANTAN.EXE
- PATSMGCS7OGOS.EXE
- KDP_SPN2006.EXE
- FIZIK.EXE
- POWERPOINTSPN.EXE
- INO.EXE
- HARDIEPOPE GUIDE.EXE
- SYSTEM.EXE
- KALSIUMKARBIDA.EXE
- SESI UMUM.EXE
- BEDAHSIASAT.EXE
- ALBUM_ALORSETAR.EXE
- PENGAIRAN.EXE
- PENAPAIAN.EXE
- INSTITUT PERTANIAN.EXE
- BAHANBANTUMGAJAR.EXE
- ALBUM_SARAWAK.EXE
- CORAL BAY RESORT PANGKOR.EXE
- LOGO RAKANMMUDA DAN KPM.EXE
- PBS3528 MAC 2009 DYNASTY KL.EXE
- BRG JSU.EXE
- BIOLOGI SM45.EXE
- PENTAKSIRAN JPNS.EXE
- BM BI BC SM.EXE
- ADD MATH SM45.EXE
- JSU BI SPM.EXE
- ARAB SM45.EXE
- BM SM45.EXE
- ROSIZANBIOLOGY CONSTRUCTITEMJSU.EXE
- JSU SPM.EXE
- JSU BHS CINA SPM.EXE
- UFO.EXE
- FONE.EXE
- SHIP1.EXE
- TOY.EXE
- SHIP.EXE
- FRONTEND.EXE
- TOYECA.EXE
- CARS.EXE
- TROLLEY.EXE
- PHAT.EXE
- NORMAL.EXE
- ADEON.EXE
- WINCAR2.EXE
- EDITOR.EXE
- PANGA.EXE
- MUD.EXE
- STUNTS.EXE
- MARKET2.EXE
- EDIT.EXE
- SUGO.EXE
- REVERSEMIRROR.EXE
- WAVS.EXE
- WILD_WEST1.EXE
- NHOOD1.EXE
- VOLKEN.EXE
- NHOOD2.EXE
- GENCAR.EXE
- MISC.EXE
- TOYLITE.EXE
- HOOD.EXE
- DINO.EXE
- REVERSED.EXE
- WILD_WEST2.EXE
- TDF.EXE
- FLAG.EXE
- REVERSE.EXE
- AMW.EXE
- WINCAR4.EXE
- CANDY.EXE
- MARKAR.EXE
- SEJARAH.EXE
- EA SM45.EXE
- MATH SM 45.EXE
- COUGAR.EXE
- MUSE_BAT.EXE
- GARDEN1.EXE
- MIRROR.EXE
- SOUNDS.EXE
- GARDEN.EXE
- GHOST.EXE
- NHOOD1_BATTLE.EXE
- BEATALL.EXE
- MITE.EXE
- BOT_BAT.EXE
- MUSE.EXE
- MARKET1.EXE
- MUSE1.EXE
- WINCAR3.EXE
- GALLERY.EXE
- GFX.EXE
- TIMES.EXE
- MUSE2.EXE
- MOSS.EXE
- SHIP2.EXE
- LEVELS.EXE
- TOY2.EXE
- ROTOR.EXE
- MODELS.EXE
- STRINGS.EXE
- SGT.EXE
- MOUSE.EXE
- MARKET.EXE
- WINCAR.EXE
- Q.EXE
- 1.EXE
- Q1.EXE
- RC.EXE
- R5.EXE
- BM.EXE
- PI.EXE
- S-1-5-21-1482476501-1644491937-682003330-1013.EXE
- TC6.EXE
- TC5.EXE
- TC3.EXE
- TC4.EXE
- TC1.EXE
- TC2.EXE
- 2- DIMS DOCUMENTS.EXE
- '06_11_16_00.EXE
- '06_11_17_00.EXE
- 04 ADMIN.EXE
- 1.0.EXE
- S-5-3-42-2819952290-8240758988-879315005-3665.EXE
- 000A8BC4.EXE
- 000C25AE.EXE
- 1.6.0.2.1.EXE
- 1.6.0.3.1.EXE
- 1.6.0.4.0.EXE
- 5.6 5.7.EXE
- 1.1.0.3.EXE
- CH 5.EXE
- 03 HRD.EXE
- '06_01_16_00.EXE
- '06_01_31_00.EXE
- '06_02_13_00.EXE
- 09JULY.EXE
- 100OLYMP.EXE
- 10JULY.EXE
- '06_11_28_00.EXE
- '07_02_06_00.EXE
Filesizes
The following file size has been seen:
- 222,461 bytes
- 229,113 bytes
- 222,720 bytes
Vendor, Product and Version Information
Files with the name SVICHOSSST.EXE have been seen to have the following Vendor, Product and Version Information in the file header:
- ; ; 3, 2, 0, 1
File Type
The filename SVICHOSSST.EXE refers to many versions of an executable program.
File Activity
One or more files with the name SVICHOSSST.EXE creates, deletes, copies or moves the following files and folders:
- Creates c:\windows\system32\cscript.exe
- Opens/modifes c:\autoexec.bat
- Creates c:\windows\system32\setting.in
Registry Activity
One or more files with the name SVICHOSSST.EXE creates or modifies the following registry keys and values:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Yahoo Messengger C:\WINDOWS\system32\SVICHOSSST.exe
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer NofolderOptions value:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr value:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System DisableRegistryTools value:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCrawler\Shares shared \New Folder.exe
Website Activity
One or more files with the name SVICHOSSST.EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.
- gaig0isaigon .t35 .com / setting .nql
- gaig0isaigon .t35 .com / setting .xls
- Port 80 IP:66.45.237.220