W32/Sohanad.AS Worm

 Information about the W32/Sohanad.AS Worm:

W32/Sohanad.AS is a worm. The worm will infect Windows systems.

The worm arrives either as a file downloaded from remote sites by other malware or downloaded unknowingly by a user when visiting malicious Web sites.

Upon execution, the worm copies itself as

SCVVHSOT.exe in the Windows and Windows System folder,
BLASTCLNNN.EXE in the Windows System folder.

It also copies autorun.ini in the Windows System folder, which contains the following lines:

Open=SCVVHSOT.exe
Shellexe cute=SCVVHSOT.exe
Shell\Open\command = SCVVHSOT.exe
Shell=Open

It modifies the registry at the following location to ensure its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

The worm also modifies the Windows Registry to disable Registry Editor and Task Manager.

It attempts to connect to certain Web sites to download the possible malicious files.

The worm adds the following registry key, so that the malicious file is accesible to all users within the network:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCrawler\Shares

The worm creates a scheduled task to execute its dropped copies. It then uses Windows Task Scheduler to schedule task that automatically executes at 9 o'clock everyday.

This worm first appeared on August 22, 2007.

 Other names of W32/Sohanad.AS Worm:

This Worm is also known as IM-Worm.Win32.Sohanad.as, W32/YahLover.worm, W32.Imaut.A , DR/Sohanad.AS.1, W32/SillyFDC-AE.