Lately my laptop goes slow.
All resource has been checked and non of significantly & higly in used by a specific service.
Even idle process percentage is more than enough to some more applications.
Using DU Meter, I have been noticing a suspicious & continious Outgoing traffic.
Never aware of this thing out before since I’m working on the High Speed of LAN Connection.
All Internet Connection keeps going on ‘Normaly’.
Till I shocked & found that my Volume Based 3G Service was reached end of blood 
It takes less than two weeks to vanish my Quota.
Suspicious things are :
- Virus that generates attack to Port TCP 445 [MICROSOFT DS]
- Virus that generates attack to Port TCP 25 [SMTP]
Both of them are realy damn tough :).
Microsoft DS Virus is pretty much easier to handle rather than SMTP Virus [google everywhere].
This SMTP Virus is generated by Windows Original Services Ran by : “generic host process for win32 services” under SVCHOST.EXE
I even cannot find and edit such file that SVCHOST.EXE running to stop Generic Host Process For Win32 Services at the start up.
It was realy an integrated things.
What I Have done so far and stops this SMTP Virus :
1. Check Their Activity [NETSTAT -AN]
The attempts is starting by Sending numbers of SYN_SENT to the nearest neighbor till computers at the edge of the world
once upon you ready have your internet connection is up [Clever huh ?].
It’s Establish the SMTP connection to some/many of IPs.
And You realy know you didn’t send anything at all, nor any of Mail Client Opens / Runs.
netstat -an | more
Active Connections
Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1043 127.0.0.1:1044 ESTABLISHED
TCP 127.0.0.1:1044 127.0.0.1:1043 ESTABLISHED
TCP 127.0.0.1:1047 0.0.0.0:0 LISTENING
TCP 202.159.104.3:139 0.0.0.0:0 LISTENING
TCP 202.159.104.3:17068 203.190.241.43:25 SYN_SENT
TCP 202.159.104.3:17070 203.190.241.44:25 SYN_SENT
TCP 202.159.104.3:17072 203.190.241.45:25 SYN_SENT
TCP 202.159.104.3:17073 203.190.241.46:25 SYN_SENT
TCP 202.159.104.3:17074 203.190.241.47:25 SYN_SENT
TCP 202.159.104.3:17075 203.190.241.48:25 SYN_SENT
UDP 0.0.0.0:445 *:*
UDP 0.0.0.0:500 *:*
UDP 0.0.0.0:1025 *:*
UDP 0.0.0.0:1033 *:*
UDP 0.0.0.0:1110 *:*
UDP 0.0.0.0:1132 *:*
UDP 0.0.0.0:2894 *:*
UDP 0.0.0.0:4500 *:*
2. Download & Install Advance Task Manager
This software shows you, all activities in your computer.
Include all hidden process that you have never seen on a Windows Standard Task Manager.
Check at “Internet Connection” Tab and have a good look carefuly at box below “Internet Connections from or to the Programs on Your Computer”.

You should see in the coloumn Address “[IP Adderess Destination]:SMTP”.
That’s It !.
The Process on the left is : “svchost.exe”.
Double click this row, Advance Task Manager brings you to Programs Tab… with Coloumn “Process|PID|…”
And Higlights “Generic host process for win32 services”… Now CHECK & REMEMBER the PID.

3. Open Windows Default Task Manager
Match the PID & the Process “svchost.exe”. [note PID is realy Important]
Once you found the correct process svchost.exe & PID, do End Process 
Now, You are Free !.. but only for a While.

4. Anyway, pls do Re-Patch your “Generic host process for win32 services”.
Ask Google Please
– a. rahman isnaini r.sutan
Anonymous said…