Clean your PC from W32/Sohana-R Worm Manually!
The virus under discussion and the other variants of the same are basically different types of the W32/Sohana-R worm. It disables the Task Manager, CMD, Registry Editor and some processes with the similar name to the windows service SVCHOST.exe. It is usually spread by the removable media storage devices like USB Flash drives.
Following are some of the names which are used by this worm to manipulate your PC integrity. SSVICHOSST.EXE, SVICHOSSST.EXE, RVHOST.EXE, SVICHOSST.EXE, etc.
As far as I know, this worm goes undetected and/or uncleaned by most commercial anti virus softwares. I am referring a couple of very good tools using which you can easily remove the virus.
To manually remove the virus from your system use the following directions.
1) There are two main software tools. One is the procexp which is a third party task manager and much more powerful than the default windows task manager. The other is a batch file. EmergencyVirusFix.bat
2) Use this third party task manager to find that process.
3) You will find a couple (maybe more) of tasks currently run with the above mentioned names or similar. Note the spelling of the task and kill all the instances.
4) Now Edit the batch file after uncompressing it from the rar file. Replace the file name with the process name you just killed.
5) Run the batch file. This will enable the Task Manager, CMD (command prompt), Folder Options and Registry Editor.
6) Now Run the registry Editor and find all the keys with the name of the processor.
7) Usually it copies in the RUN and SHELL keys with tricky names. You will have to delete all the keys except the shell which is altered in the following way:
"EXPLORER.EXE SSVICHOSST.EXE". Modify this key to just EXPLORER.EXE and remove all the extra.
8) After removing all the registry keys your system is clean. Note that the file is still there and can not be accessed in normal way. You have to install a good anti-virus to remove the file.
9) Now the most important step of your virus removing mission. Install a good anti virus e.g.
* Kaspersky ( I recommend this)
* BitDefender
* AVG
* McAfee
* PandA AV
* NOD32
* PC Cilin
Check the following sites:
http://anti-virus-software-review.toptenreviews.com/
http://www.consumersearch.com/www/software/antivirus-software/
http://www.pcworld.com/article/id,124475-page,1/article.html
I have made a very simple sequence to clean the system. If you still need any help; just contact me.
Download the archived file from:
http://files.filefront.com//;6793648;;/
http://www.megaupload.com/?d=3GVNDB2D
Ref: http://www.putera.com/tanya/lofiversion/index.php/t32227.html
47 comments:
Nice Tips.
I found them useful.
I have AVG Anti Virus; Should I change my Anti-Virus Software?
Thanks for appreciation.
Good to see someone finding my stuff helpful.
AFAIK the best anti-virus software is Kaspersky Antivirus.
http://www.kaspersky-labs.com
Refer to the following links for more information:
Best Regards,
http://anti-virus-software-review.toptenreviews.com/
http://www.consumersearch.com/www/software/antivirus-software/
http://www.pcworld.com/article/id,124475-page,1/article.html
Quite Useful Tips.
Hi,
My Win 2000 Server has been infected with this worm. Will your write-up on manually removing this virus be helpful for my server as well ? Will the procedures be the same ?
@lasr
I am sorry brother.I should have mention that it works best with WinXP. This doesn't completely work on Windows 2000 machines. The incompatible stuff being the reg command used to enable the registry editor and task manager.
You can still kill the process using the third party task manager procexp.
Then you just have to enable the registry editor. In windows XP it is relatively easy using command line (as in the batch file). If you can alternative way to modify the registry keys as in the batch file using REG command, the same procedure will work.
Try by making a file with .reg extension and using regedit as is done in modifying the registry keys using .reg files.
BHAI BAHUT BAHUT SHUKRIYA.
hi kamran,
i tried, what u have written in your manual removal of the W32/Sohana-R Worm, but the worm is not detected by the antivirus in your step no 9. It will get active every time i start the machine. please help me out of this. i have win xp ad norton antivirus installed on my machine.
Hi!
I thought this virus should be obsolete by now. :)
But anyhow, the thing is Norton Antivirus has a history of not detecting these kind of virii. I will recommend Bit Defender or Kaspersky because they catch nearly every virus.
Now back to your problem, I think if you have cleaned your RUN or RUNONCE blocks of registry by removing all suspicious registry entries (i.e. step 8), then no suspicious process should be able to run at the reboot. Kindly double check again and see if it works. There is another folder at the program menu called Startup. Perhaps there is something is there which starts whenever u restart.
Good Luck.
Best Regards
hi kamran,
thanx a lot for your help.
there was a folder remaining in the shell which was invoking dat virus every time on startup. i was not detected it through regitry editer. then i installed autorun from the thread http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
and delete that one. now it is ok.
thanx once again.
Cheers mate!
I'm glad that I was of any help.
Yeah these autoruns and autorunsc are good tools.
Its always better to have some third party tools like these autoruns and process xp..
Hello,Kamran
thank you very much for such useful advice, it seems to me that everything is ok with my windows xp now. My nod32 detected a kind of autorunini file finally (I don't remember exactly now) and I think that it was the original place from where all the problems started.
best wishes from Odessa, Ukraine, the Black Sea :-)
Yes undoubtedly, in some moments I can phrase that I agree with you, but you may be in the light of other options.
to the article there is even now a definitely as you did in the downgrade publication of this beg www.google.com/ie?as_q=mandala painter 3.0 professional ?
I noticed the phrase you procure not used. Or you profit by the dark methods of helping of the resource. I possess a week and do necheg
crestor vs other statin drugspharmacy tech online buy tramadol now
[url=http://www.bebo.com/buylevitraonline1]buy levitra online with fast delivery[/url]
Glad to greet you, ladies and gentlemen!
Let me introduce myself,
friends call me Peter.
Generally I’m a venturesome analyst. recently I take a great interest in online-casino and poker.
Not long time ago I started my own blog, where I describe my virtual adventures.
Probably, it will be interesting for you to find out how to win not loose.
Please visit my web page . http://allbestcasino.com I’ll be glad would you find time to leave your comments.
Howdy,
I keep coming to this website[url=http://www.weightrapidloss.com/lose-10-pounds-in-2-weeks-quick-weight-loss-tips].[/url]Lots of good information here kaamran1.blogspot.com. Frankly speaking we really do not pay attention towards our health. Here is a fact for you. Research indicates that about 50% of all United States adults are either fat or overweight[url=http://www.weightrapidloss.com/lose-10-pounds-in-2-weeks-quick-weight-loss-tips].[/url] So if you're one of these citizens, you're not alone. In fact, most of us need to lose a few pounds once in a while to get sexy and perfect six pack abs. Now next question is how you can achive quick weight loss? Quick weight loss can be achived with little effort. Some improvement in of daily activity can help us in losing weight quickly.
About me: I am writer of [url=http://www.weightrapidloss.com/lose-10-pounds-in-2-weeks-quick-weight-loss-tips]Quick weight loss tips[/url]. I am also health expert who can help you lose weight quickly. If you do not want to go under difficult training program than you may also try [url=http://www.weightrapidloss.com/acai-berry-for-quick-weight-loss]Acai Berry[/url] or [url=http://www.weightrapidloss.com/colon-cleanse-for-weight-loss]Colon Cleansing[/url] for effortless weight loss.
In it something is. Clearly, thanks for an explanation.
What curious question
I apologise, but, in my opinion, you are not right. Let's discuss. Write to me in PM.
I consider, that you are mistaken. I can defend the position. Write to me in PM, we will talk.
You are absolutely right. In it something is also to me it seems it is good thought. I agree with you.
Rather useful piece
I've as a last resort liked things like sand clocks, lava lamps, and the like to type of just spend space staring at it as a formality of catharsis. In a course, it helps me with meditation, to relieve stress and just think just about nothing. That's why since I was a kid, instead of dolls and cars I've perpetually cool more of such pieces like sand clocks, lava lamps, tuneful boxes etc. So I was most charmed when I establish the[url=http://www.dealtoworld.com/goods-1260-2-Laser++LED+Light+Show+Laser+Top+Gyroscope+with+Music+Effects.html] 2-Laser + LED Spry Show Laser Top Gyroscope with Music Effects[/url] from DealtoWorld.com under the aegis the Toys section. It's like a tuneful box, a spinning head, and a radiance reveal all rolled into one. Which is spectacular amusement! The gyroscope wishes whirl for in the air a minute. The laser enlightenment pretension with accompanying music makes this gyroscope a measure corresponding exactly bauble that my friends have also been most amused with.
My dogs are also fair outr?about the laser gyroscope I got from DealtoWorld.com. They each cleave to the gyroscope as it spins, although at principal they kept barking at the laser insight advertise, and also because it produces music. But after they got tempered to it, they've stopped barking but virtuous watch over following the gyroscope whenever I start spinning it. Kids are also attractive amused alongside it. Occasionally it's meet to maintain diverting toys throughout the lineage so that you can leave the toy on while the kids are being amused or playing with it while you open to provide for foodstuffs or receive changed. The gyroscope is inseparable such play with with this purpose.
The gyroscope I bought from DealtoWorld.com has a dragon as a pattern on it, and produces a dainty indicate with red, dispirited, and unripened colours. Nick a look at the pictures I've uploaded of the gyroscope with laser joyful show. The music produced from the gyroscope is not that expert but decorous adequacy to consider any redone guest to the house. The gyroscope is red and negro, making it look very imperturbable, and somewhat virile with that dragon imprint.
The music flare plain gyroscope runs on 6 LR44 batteries, which are replaceable anyway. I've also utilized this gyroscope to eye-opener my girlfriend during our anniversary celebration. I did the cheesy thing of decorating the hostelry room with roses and when I led her in, I started up the gyroscope as correctly so that the laser brighten show produces a romantic effect. I also had some battery operated candles so all the moonlight effects created a slightly romanticist atmosphere. She loved it, not later than the way, to my relief. I also bought the candles from DealtoWorld.com. These days it seems to be my default shopping site in return all gifts and ideas in compensation romantic occasions.
Since Christmas is coming, this laser lamp playing gyroscope can dialect mayhap be a superb Christmas favour looking for the toddler or methodical the mollycoddle! Alternatively, the gyroscope can absolutely be a gracious addition to the established Christmas decorations. I can imagine placing it within a mile of the Christmas tree and peradventure spinning it when guests reach in the house. Looks like [url=http://www.dealtoworld.com]DealtoWorld.com[/url] is getting my duty yet again!
Hey, I am checking this blog using the phone and this appears to be kind of odd. Thought you'd wish to know. This is a great write-up nevertheless, did not mess that up.
- David
ghd sitting by michael kors handbags side gently touched michael kors cheek with a mind michael kors purses.
is lisseur ghd pas cher right Dad know aunt where ah ghd moins cher.
spyder sound interrupted cheap ugg boots uk propaganda slowed the car speed ugg store.
michael kors purses was found that a small safe michael kors handbags put down the camera went ove.
livres de medecine ebook http://audiobookscollection.co.uk/Biomedical-Application-of-Proteomics/p100031/ robert heinlein free ebook e-book [url=http://audiobookscollection.co.uk/de/Handbook-of-Typography-for-the-Mathematical-Sciences/p104176/]torrent ebook amanda young[/url] terry goodkind soul on fire ebook
vietnamesa ebook http://audiobookscollection.co.uk/Lost-Angels-Psychoanalysis-and-Cinema/p225582/ the world is flat ebook crack [url=http://audiobookscollection.co.uk/es/Emotional-Design-Why-We-Love-Or-Hate-Everyday-Things/p106120/]ebook editor[/url] ebook micro financing peer group lending
ebook analisis kinerja sistem http://audiobookscollection.co.uk/it/Open-Source-Knowledge-Management/p222314/ oil upton sinclair free ebook [url=http://audiobookscollection.co.uk/Practice-and-Theory-of-Automated-Timetabling-4th-International-Conference-PATAT-2002-Gent-Belgium-August-21-23-2002-Selected-Revised-Papers/p195589/]microsoft pws ebook[/url] free ebook torrent between the sheets
julia quinn ebook http://audiobookscollection.co.uk/Made-Ridiculously-Simple-Clinical-Physiology/p117861/ melissa de la cruz ebook [url=http://audiobookscollection.co.uk/Data-Analysis-for-Database-Design-Third-Edition/p218158/]ebook a tree grows in brooklyn[/url] pyrokinesis ebook download
the wife of martin guerre ebook http://audiobookscollection.co.uk/C-Cookbook/p185571/ air brake textbook online ebook download [url=http://audiobookscollection.co.uk/es/Der-f-nfte-Elefant/p227611/]how to walter foster ebook[/url] dating advice ebook online
david drake ebook http://audiobooksplanet.co.uk/Isaac-Rabinovitch/m53072/ ebook library borrowing adobe digital editions [url=http://audiobooksplanet.co.uk/Minding-Animals-Awareness-Emotions-and-Heart/p167357/]forums romance ebook[/url] she comes first ebook
mind control ebook haha lung http://audiobooksworld.co.uk/Cryptonomicon/p206034/ what is a sony ebook [url=http://audiobooksworld.co.uk/authors/?letter=Dl]cartomancy ebook[/url] the little prince ebook
[url=http://audiobooksworld.co.uk/Solving-Latino-Psychosocial-and-Health-Problems-Theory-Practice-and-Populations/p224068/][img]http://audiobooksworld.co.uk/image/2.gif[/img][/url]
medical pc pocket software http://buysoftwareonline.co.uk/es/product-35557/Transmit-4-1-MacOSX gce-8483b drivers and software [url=http://buysoftwareonline.co.uk/product-35076/The-Complete-Genealogy-Builder-2011]mc-1100p install software[/url] computer software learning sing
[url=http://buysoftwareonline.co.uk/product-36504/MONyog-Ultimate-4-5]MONyog Ultimate 4.5 - Download OEM, Software Sale, OEM Software[/url] tax software best
[url=http://buysoftwareonline.co.uk/product-36719/Thomson-Reuters-EndNote-X5-15-0][img]http://buyoem.co.uk/image/3.gif[/img][/url]
12, Lunesta Sale - cheap lunesta http://www.lunestasleepaid.net/, [url=http://www.lunestasleepaid.net/] Generic Lunesta [/url]
Hi there! I'm at work surfing around your blog from my new iphone! Just wanted to say I love reading your blog and look forward to all your posts! Keep up the fantastic work!
Here is my web blog :: coffee flavor
[url=http://certifiedpharmacy.co.uk/products/proscar.htm][img]http://onlinemedistore.com/3.jpg[/img][/url]
ways to change the field of pharmacy http://certifiedpharmacy.co.uk/products/motrin.htm creech and gibbs pharmacy [url=http://certifiedpharmacy.co.uk/products/compazine.htm]vinco pharmacy[/url]
malcolm grow pharmacy refills http://certifiedpharmacy.co.uk/products/flonase.htm wegmans pharmacy [url=http://certifiedpharmacy.co.uk/products/speman.htm]speman[/url]
which pharmacy offers discounts to the un in geneve http://certifiedpharmacy.co.uk/products/oxytrol.htm promanade pharmacy riverdale georgia [url=http://certifiedpharmacy.co.uk/products/accutane.htm]best pharmacy colleges[/url]
safeway pharmacy british columbia phenazo pyridium http://certifiedpharmacy.co.uk/products/vitamin-c.htm sun city pharmacy [url=http://certifiedpharmacy.co.uk/products/acticin.htm]acticin[/url]
Very great post. I just stumbled upon your blog and wanted to say that I have truly enjoyed surfing around your blog
posts. After all I'll be subscribing to your feed and I'm hoping you
write again very soon!
Feel free to visit my blog post - クロエバッグ
Hi there are using Wordpress for your site platform? I'm new to the blog world but I'm trying to get started and set up
my own. Do you require any html coding knowledge to make your own blog?
Any help would be really appreciated!
my web page ... www.chloeoutletshop2013.com
I all the time used to study post in news papers but now as I am a user of net so from now I am using net for content, thanks to web.
Also visit my blog post :: acoustic guitar chords for beginners
Your oωn post οffers verified nеcessary tο me.
Іt’s reаlly educаtional and
you're simply certainly very knowledgeable of this type. You possess popped my eyes for you to various views on this kind of matter using interesting and sound content material.
Look into my web page Buy Ambien
Thank you for sharing your thoughts. I truly
appreciate your efforts and I am waiting for your further write ups thank
you once again.
Also visit my homepage ... ルブタン靴
If you are going for best contents like I do, simply pay a visit this website
everyday as it provides quality contents, thanks
Also visit my homepage ... コーチバッグ
Hello, i read your blog from time to time and i own a similar one and i was just
curious if you get a lot of spam feedback? If so how do you reduce it,
any plugin or anything you can advise? I get so much
lately it's driving me mad so any support is very much appreciated.
my homepage www.mfo-itconsulting.de
I just like the helpful info you supply in your articles.
I will bookmark your blog and check once more right here frequently.
I am reasonably certain I will be told many new stuff proper here!
Good luck for the following!
Take a look at my web site ... ミュウミュウバッグ
Thank you for sharing your info. I really appreciate your efforts and I am waiting
for your further write ups thank you once again.
My weblog :: コーチ 財布
For most recent information you have to visit internet and
on web I found this web site as a most excellent web
site for hottest updates.
Look into my web site: トリーバーチバッグ
physician dating former patient http://loveepicentre.com/testimonials/ greek word for dating
isotopes as tracer in carbon dating [url=http://loveepicentre.com/advice/]isaiah mustafa dating[/url] online dating profile headline
who is nick jonas dating [url=http://loveepicentre.com]millionaire dating site usa[/url] german aryan gay men dating [url=http://loveepicentre.com/user/ebrahooom/]ebrahooom[/url] japanese subsidised dating
Post a Comment