W32/Sohanad.J is a worm. The worm will infect Windows systems and spreads through Yahoo! Messenger, a popular instant messaging application.

The worm arrives as a downloaded file via Yahoo! Messenger.

Upon execution, this worm copies itself as SVHOST.EXE in the Windows System folder.

The worm modifies registry at the following location to load itself during each startup

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

It also creates the following registry keys to modify the settings of Yahoo! Messenger:

HKEY_CURRENT_USER\Software\Yahoo\pager\View\YMSGR_buzz
HKEY_CURRENT_USER\Software\Yahoo\pager\View\YMSGR_Launchcast

The worm also modifies the registry to disable Registry Editor and Task Manager.

It also changes the Internet Explorer (IE) home page to;

http://(BLOCKED)rmex.com.

This worm propagates via Yahoo! Messenger by sending an instant message to all the contacts of an active user. This message contains a link to a remote copy of itself. When the recipient clicks the link, a copy of this worm is downloaded and executed on the recipients' system.

The details of the message sent out by this worm are:

have you ever seen such a silly man like this ? http://nsl-(Blocked)org/?id=stories =))
"oh my god , i've won a 20000 usd lottery http://nsl-(Blocked)org/?id=winning_list. Come to my house tonight for a party !!"
"making money online never be easier : http://(Blocked)rmex.com/?id=tips"
"check out my new personal website : http://(Blocked)rmex.com c0ol !!!"
"look at my new lover : http://(Blocked)rmex.com/darling.jpg"

It also attempts to connect to the following website to download and execute some malicious files.

http://itali{BLOCKED}rmex/host.exe
http://itali{BLOCKED}rmex/host2.exe

This worm first appeared on October 25, 2006.

 Other names of W32/Sohanad.J Worm:

This Worm is also known as WORM_SOHANAD.J.