Sophos

W32/Sohana-AU

Aliases
  • Win32/Sohanad.AP worm
  • IM-Worm.Win32.Sohanad.gen
  • W32/YahLover.worm.gen
  • WORM_SOHANAD.EK
  • W32/Worm.DZV
Category
Type
What to do
Prevalence low high

Summary

 
How it spreads
  • Removable storage devices
  • Network shares
  • Chat programs
Affected operating systems Windows
Characteristics
  • Installs itself in the registry
Included in our products from June 2008 (4.30)
Protection available since 24 April 2008 01:55:53 (GMT)
Detected by All Sophos products

Action

More Information

W32/Sohana-AU is a worm for the Windows platform.

W32/Sohana-AU includes functionality to access the internet and communicate with a remote server via HTTP.

When first run W32/Sohana-AU copies itself to:

<Windows>\SSCVIHOST.exe
<System>\SSCVIHOST.exe
<System>\blastclnnn.exe

and creates the following files:

<System>\autorun.ini
<System>\setting.ini

The file autorun.ini is detected as W32/Sohana-W.

The following registry entry is created to run SSCVIHOST.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Yahoo Messengger
<System>\SSCVIHOST.exe

The following registry entry is changed to run SSCVIHOST.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe SSCVIHOST.exe

The following registry entries are set, disabling system software:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

The following registry entry is set:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NofolderOptions
1

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer