[Resolved] YM virus and SSCVIIHOST.exe

Hello mark_sunday and welcome to the What the Tech Forums

My name is Trevuren and I will be helping you with your problem.


Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard ready for posting back on the forum).
• Finally paste the contents of the Report.txt back on the forum with a new HijackThis log

Your HijackThis log is looking much better. We now need that your system is not hiding any other "baddies" that could come out of the woodwork and stir things up again:

Using Internet Explorer, please do a Kaspersky Online Scan

Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
• Locate the Scan Settings button & configure as follows:
  • Scan using the following Anti-Virus database:
    
    • Extended
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK & have it scan My Computer
• Once the scan is complete, it will provide a report if your system is infected. It does not provide an option to clean/disinfect. We only require a report from it.
  
  [external image: Posted Image]
  
  
• Click the Save as Text button to save the file to your desktop and post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan


With your reply, be tell me how your system is running. Are there any more signs of malware action that you are aware of?

——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Monday, March 10, 2008 9:33:57 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 10/03/2008 Kaspersky Anti-Virus database records: 621929 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ Scan Statistics: Total number of scanned objects: 36782 Number of viruses found: 2 Number of infected objects: 20 Number of suspicious objects: 0 Duration of the scan process: 01:07:43 Infected Object Name / Virus Name / Last Action C:\!KillBox\SSCVIIHOST.exe Infected: Trojan-Downloader.Win32.AutoIt.aa skipped C:\!KillBox\SSCVIIHOST.exe( 1) Infected: Trojan-Downloader.Win32.AutoIt.aa skipped C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\Berx\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Berx\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Berx\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Berx\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Berx\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Berx\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Berx\NTUSER.DAT.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\QooBox\Quarantine\C\WINDOWS\system32\autorun.ini.vir Infected: Trojan.Win32.AutoRun.a skipped C:\SDFix\backups\backups.zip/backups/autorun.ini Infected: Trojan.Win32.AutoRun.a skipped C:\SDFix\backups\backups.zip/backups/blastclnnn.exe Infected: Trojan-Downloader.Win32.AutoIt.aa skipped C:\SDFix\backups\backups.zip/backups/SSCVIIHOST.exe Infected: Trojan-Downloader.Win32.AutoIt.aa skipped C:\SDFix\backups\backups.zip ZIP: infected - 3 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{E2730ACC-B408-4E53-AB5D-EF4E638E80E7}\RP24\A0002801.exe Infected: Trojan-Downloader.Win32.AutoIt.aa skipped C:\System Volume Information\_restore{E2730ACC-B408-4E53-AB5D-EF4E638E80E7}\RP25\A0002843.exe Infected: Trojan-Downloader.Win32.AutoIt.aa skipped C:\System Volume Information\_restore{E2730ACC-B408-4E53-AB5D-EF4E638E80E7}\RP28\A0002904.exe Infected: Trojan-Downloader.Win32.AutoIt.aa skipped C:\System Volume Information\_restore{E2730ACC-B408-4E53-AB5D-EF4E638E80E7}\RP29\A0002962.exe Infected: Trojan-Downloader.Win32.AutoIt.aa skipped C:\System Volume Information\_restore{E2730ACC-B408-4E53-AB5D-EF4E638E80E7}\RP29\A0002969.exe Infected: Trojan-Downloader.Win32.AutoIt.aa skipped C:\System Volume Information\_restore{E2730ACC-B408-4E53-AB5D-EF4E638E80E7}\RP32\A0003979.ini Infected: Trojan.Win32.AutoRun.a skipped C:\System Volume Information\_restore{E2730ACC-B408-4E53-AB5D-EF4E638E80E7}\RP34\A0004624.exe Infected: Trojan-Downloader.Win32.AutoIt.aa skipped C:\System Volume Information\_restore{E2730ACC-B408-4E53-AB5D-EF4E638E80E7}\RP34\A0004626.ini Infected: Trojan.Win32.AutoRun.a skipped C:\System Volume Information\_restore{E2730ACC-B408-4E53-AB5D-EF4E638E80E7}\RP34\A0004627.exe Infected: Trojan-Downloader.Win32.AutoIt.aa skipped C:\System Volume Information\_restore{E2730ACC-B408-4E53-AB5D-EF4E638E80E7}\RP34\A0004629.exe Infected: Trojan-Downloader.Win32.AutoIt.aa skipped C:\System Volume Information\_restore{E2730ACC-B408-4E53-AB5D-EF4E638E80E7}\RP34\A0004682.ini Infected: Trojan.Win32.AutoRun.a skipped C:\System Volume Information\_restore{E2730ACC-B408-4E53-AB5D-EF4E638E80E7}\RP34\A0004683.exe Infected: Trojan-Downloader.Win32.AutoIt.aa skipped C:\System Volume Information\_restore{E2730ACC-B408-4E53-AB5D-EF4E638E80E7}\RP34\A0004685.exe Infected: Trojan-Downloader.Win32.AutoIt.aa skipped C:\System Volume Information\_restore{E2730ACC-B408-4E53-AB5D-EF4E638E80E7}\RP35\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped C:\WINDOWS\system32\config\OSession.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. When you told me to use SDFix in safe mode, it wouldn't let me. The .bat file wouldnt open because the cmd kept closing, just as how it also locked up regedit, taskmgr, and msconfig. So, I used killbox to rid of that sviihost-thingie for that session (that's why you can spot it up there in the report). Sorry if I wasn't meant to do that. I really thought it wouldn't work. Anyways, after the SD Fix did its thing, my ym was fine again and none of my controls (regedit, taskmgr, msconfig, and cmd) were locked anymore. Although I still see RECYCLER folders all over my computer, but they're just there and not doing anything (nothing I can see at least). I believe this all started when I inserted a flash drive of the same kind of virus. I used a disinfector to wipe out the flash drive so its clean now, btw.

1. Please DELETE the following folders and all their content (This should rid your system of the trojans quarantined by our tools):

C:\!Killbox
C:\SDFix

2. If you have no more malware-related problems that you are aware of, just give me the OK and we can start the final but essential cleanup procedures and recommendations.

Trevuren

Done and done. OK, what's next?

Congratulations, your log looksCLEAN

There are a few things you must do once you are completely clean:

1. Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

2. Now Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

• Go to Start > Programs > Accessories > System Tools and click "System Restore".
• Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Then go to Start > Run and type: Cleanmgr
• Click "OK".
• Click the "More Options" Tab.
• Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer More Secure

• From within Internet Explorer click on the Tools menu and then click on Options.
• Click once on the Security tab.
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
  
  
  • Change the Download signed ActiveX controls to Prompt.
  • Change the Download unsigned ActiveX controls to Disable.
  • Change the Initialise and script ActiveX controls not marked as safe to Disable.
  • Change the Installation of desktop items to Prompt.
  • Change the Launching programs and files in an IFRAME to Prompt.
  • Change the Navigate sub-frames across different domains to Prompt.
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Next press the Apply button and then the OK to exit the Internet Properties page.

2. Update your Anti-Virus Software - I can not overemphasize the need for you to update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

3. Make sure you keep your Windows OS current by visiting Windows update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

4. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

5. Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

6. Install Spybot - Search and Destroy - Download and install Spybot - Search and Destroy with its TeaTimer option. This will provide real time spyware and hijacker protection on your computer alongside your virus protection. You should scan your computer with the program on a regular basis just as you would with your anti-virus software. A tutorial on installing and using this product can be found here:
Instructions for - Spybot S & D and Ad-aware

7. Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

Thank you!!!

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.