WORM_SOHANAD.DW

This worm may be dropped by other malware. It may also be downloaded unknowingly by a user when visiting malicious Web sites.

Upon execution, this worm drops copies of itself. It also drops several non-malicious files. It then creates a registry entry to enable its automatic execution at every system startup.

It uses the Windows Task Scheduler to create a scheduled task that executes the dropped copy. This worm creates registry entries to disable Task Manager.

This worm drops copies of itself in all physical and removable drives. It also drops an AUTORUN.INF file to automatically execute its dropped copies when the said drives are accessed.

This worm connects to certain URLs to download possibly malicious files. As of this writing, however, the said URLs are inaccessible.

Related Items