new virus named SSVICHOSST.EXE

Discussion in 'NOD32 version 2 Forum' started by didine, May 13, 2007.

Thread Status:
Not open for further replies.
  1. didine

    didine Registered Member

    Joined:
    May 13, 2007
    Posts:
    6
    I HAVE DETECTED A NEW VIRUS ON MY COMPUTER, HIS NAME IS "SSVICHOSST.EXE" AND CREATED A NEW FOLDER AND NOD32 DON'T DETECT IT.
    CAN YOU HELP ME PLEASE
    THANKS A LOT
     
  2. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Hi didine, welcome to Wilders.

    Could you please take the following steps:

    1. Upload a sample to www.virustotal.com

    This service will provide an answer as to which antivirus companies are detecting the file, including ours.

    2. Send a zipped sample(s) to samples@eset.com include the following information:

    Any background information as to where the sample was found.

    A. Why you/does the user think it is malware/false positive.

    B. If you know it is a False Positive; that NOD32 is detecting a piece of software incorrectly, then the name/company/website will help.

    C. A Virus Total www.virustotal.com scan log of the sample.

    D. Use of an appropriate subject line in the e-mail is vital. It should be immediately clear if it is: an Infection or a false positive.

    E. Another antivirus company already detect it.

    F. You think you know what it might be. Then please include the name of the infiltration in the subject line so we can easily determine the priorities for which samples we should focus on first.

    G. You may include word URGENT in the subject if you think the matter is really urgent to the greater community. Please keep in mind that excessive usage of this word will render it useless.

    H. Zip the sample and password protect it with the word “infected” and advise of this password in the email.

    Taking the above steps will help the labs speed up the process of identifying and processing samples.

    Cheers :D
     
  3. didine

    didine Registered Member

    Joined:
    May 13, 2007
    Posts:
    6
    first of all
    here the name of this virus
    "IM-Worm.Win32.sohanad.am" when scanned with kaspersky
    kaspersky detect and remove it, but when computer restart, the virus is always in computer.

    I try your method step by step now

    Thanks a lot
     
  4. didine

    didine Registered Member

    Joined:
    May 13, 2007
    Posts:
    6
  5. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Re: Problem with a virus

    Maybe the version of your virus signature database is the problem - the most current version is 2305 and I'm quite positive that some Sohanad variants have been added recently.
     
  6. didine

    didine Registered Member

    Joined:
    May 13, 2007
    Posts:
    6
    Re: Problem with a virus

    Hi Marcos;
    Yes endeed, sohanad.NAK is now detected, but sohanad.t and sohanad.am are not.
    I'm with update 2305 and don't detect it.
     
  7. ASpace

    ASpace Guest

    Re: Problem with a virus

    If you believe any file is real threat but is not detected , send the sample to email samples[at]eset.com
     
  8. didine

    didine Registered Member

    Joined:
    May 13, 2007
    Posts:
    6
    Re: Problem with a virus

    Of course i do it in 3 days ago, but no solution right now
     
  9. ctrlaltdelete

    ctrlaltdelete Registered Member

    Joined:
    Oct 16, 2005
    Posts:
    318
    Location:
    NL
    Re: Problem with a virus

    Didine, you should scan ALL disks. 2 weeks ago you got good advice what to do about the (same?) worm.
     
Thread Status:
Not open for further replies.