W32/Sohana-J

Category	Viruses and Spyware
Type	Worm
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


How it spreads	Chat programs
Affected operating systems	Windows
Characteristics	Installs itself in the registry
Included in our products from	March 2007 (4.15)
Protection available since	28 January 2007 23:59:56 (GMT)
Detected by	All Sophos products

W32/Sohana-J is a worm for the Windows platform.

W32/Sohana-J may attempt to spread via instant messaging clients.

W32/Sohana-J includes functionality to download, install and run new software. W32/Sohana-J is a worm for the Windows platform.

W32/Sohana-J may attempt to spread via instant messaging clients.

W32/Sohana-J includes functionality to download, install and run new software.

When first run W32/Sohana-J copies itself to:

<Windows>\svichosst.exe
<System>\svichosst.exe

The following registry entry is changed to run svichosst.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
explorer.exe svichosst.exe

The following registry entry is set, disabling system software:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

Get reports about the latest virus and spyware threats delivered to your computer