W32/Sohanad.H Worm

 Information about the W32/Sohanad.H Worm:

W32/Sohanad.H is a worm. The worm will infect Windows systems and spreads through Instant Messaging Applications.

The worm sends the following message to all online contacts of an affected system via Instant messaging application.

;):x Welcome To Website Fan Dan Truong: http://tinhkhucvang.1.to ;):x Tha nguoi dung noi se yeu minh toi mai thoi thi gio day toi se vui hon. Gio nguoi lac loi buoc chan ve noi xa xoi, cay dang chi rieng minh toi... http://www.{BLOCKED}lefarmer.com/2/tinhkhucvang_6x_to/chucbanvuive

Welcome To Website Fan Dan Truong: http://tinhkhucvang.1.to Ngay khong em anh day lam sao cho het ngay? Sang dem duong nhu chi co anh voi anh quay quang... http://www.{BLOCKED}lefarmer.com/2/tinhkhucvang_6x_to/chucbanvuive

;):x Welcome To Website Fan Dan Truong: http://tinhkhucvang.1.to ;):x Khoc cho nho thuong voi trong long, khoc cho noi sau nhe nhu khong. Bao nhieu yeu thuong nhung ngay qua da tan theo khoi may bay that xa... http://www.{BLOCKED}lefarmer.com/2/tinhkhucvang_6x_to/chucbanvuive

A worm copy of nhan_love_tu.exe file is downloaded into the recipient's computer, when the recipient clicks on the link included in the message.

Upon execution, the worm copies itself as TASKMNG.EXE in Windows folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
HKEY_CURRENT_USER\Software\yahoo\pager\View
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer

The worm propogates from any one of Instant messaging applications;

Yahoo! Messenger
Windows Messenger
Windows Live Messenger

This worm first appeared on October 12, 2006.

 Other names of W32/Sohanad.H Worm: