W32/Sohanad.A Worm

 Information about the W32/Sohanad.A Worm:

W32/Sohanad.A is a worm. The worm will infect Windows systems and spreads through Instant Messaging applications.

The worm arrives as a file downloaded from the Internet while visiting malicious websites. It may also arrive via the popular instant messaging application, Yahoo! Messenger.

Upon execution, this worm copies itself as SVCHOST32.EXE or SVHOST.EXE in the Windows folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

It also creates the following registry keys to modify the settings of Yahoo! Messenger:

HKEY_CURRENT_USER\Software\Yahoo\pager\View\YMSGR_buzz
HKEY_CURRENT_USER\Software\Yahoo\pager\View\YMSGR_Launchcast

The worm also modifies the registry to disable Registry Editor and Task Manager. It also changes the Internet Explorer (IE) home page.

This worm propagates via Yahoo! Messenger by sending an instant message to all the contacts of an active user. This message contains a link to a remote copy of itself. When the recipient clicks the link, a copy of this worm is executed on the recipients' system.

The details of the message sent out by this worm are:

plz check this link for me :
http://so{BLOCKED}4us.net/forums/cache/showthread.php?t=myblog .
Why I cannot surf this site ???

can u tell me what he will do next ?
http://so{BLOCKED}4us.net/forums/cache/showthread.php?t=funny

the lastest picture of our upcoming Miss World 2006:
http://so{BLOCKED}4us.net/forums/cache/showthread.php?t=MissWorld !!

hix, may be this's my mistake, but the link you gave me was unavaiable when I visited it:
http://so{BLOCKED}4us.net/forums/cache/showthread.php?t=Storm

It also attempts to connect to the following websites to download and execute few malicious files;

http://(Blocked)idep.com/thoidep/nhac/dl:
http://(blocked).googlepages.com

The worm also terminates some of the security related processes.

This worm first appeared on October 3, 2006.

 Other names of W32/Sohanad.A Worm:

This Worm is also known as WORM_SOHANAD.A .