W32/Sohanad.B is a worm. The worm will infect Windows systems and spreads through Instant Messaging applications.

The worm arrives via the popular instant messaging applications.

Upon execution, this worm copies itself as SVHOST32.EXE or SVHOST.EXE in the Windows folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

It also creates the following registry keys to modify the settings of Yahoo! Messenger:

HKEY_CURRENT_USER\Software\Yahoo\pager\View\YMSGR_buzz
HKEY_CURRENT_USER\Software\Yahoo\pager\View\YMSGR_Launchcast

The worm also modifies the registry to disable Registry Editor and Task Manager. It also changes the Internet Explorer (IE) home page.

This worm propagates via Yahoo! Messenger, AIM, Windows Live Messenger or Windows Messenger by sending an instant message to all the contacts of an active user. This message contains a link to a remote copy of itself. When the recipient clicks the link, a copy of this worm is executed on the recipients' system.

The details of the message sent out by this worm are:

Download free MP3s :
http://{BLOCKED}ncerto4.net?id=music

damn, she is so cute :x
http://{BLOCKED}ncerto4.net?id=miss_world :x:x:x:x:x

Just check out my new personal website :
http://{BLOCKED}ncerto4.net c0ol !!!

have you ever seen such a sillyman like this ?
http://{BLOCKED}ncerto4.net?id=stories =))

making money online never be easier :
http://{BLOCKED}ncerto4.net?id=tips >:D<

Let's vote for Vietnam's beauty - Mai Phuong Thuy - for the upcoming Miss World competition : http://{BLOCKED}ncerto4.net?id=vote :x !!

Now you can avoid some critical online viruses by updating Windows . Click here to know how to Update your Windows :
http://{BLOCKED}ncerto4.net?id=update_windows

oh my god , i've won a 20000 usd lottery :O
http://{BLOCKED}ncerto4.net /?id=winning_list . Come to my house tonight for a party !! >:D<

check this link for me :
http://{BLOCKED}ncerto4.net?id=forum . Why I cannot surf this site ???

A new dangerous computer virus that can destroys all your data has just been released . Click here to know how to avoid it :
http://{BLOCKED}ncerto4.net?id=pc_protector

wtf is this ? wanna give me a shit ?
http://{BLOCKED}ncerto4.net /?id=news X-(

you are virus infected . Use this tool to remove viruses from your PC : http://{BLOCKED}ncerto4.net /?id=virus_shield

the only way to clean some online viruses that may lead you into troubles : http://{BLOCKED}ncerto4.net?id=ie_protector <<

It also attempts to connect to the following website to download and execute a malicious file enet.exe, which is a copy of itself;

http://64.141.(Blocked).32

The worm also terminates some of the security related processes.

This worm first appeared on October 4, 2006.

 Other names of W32/Sohanad.B Worm:

This Worm is also known as WORM_SOHANAD.B .