WORM_SOHANAD.FM

This worm may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.

Upon execution, this worm drops several copies of itself.

It then uses the Windows Task Scheduler to create a scheduled task that executes the dropped copy. This worm also creates a registry entry to enable its automatic execution at every system startup.

It also drops non-malicious component files with Hidden and System attributes.

It modifies a registry entry to enable its automatic execution at every system startup. This worm also creates registry entries to disable the Task Manager.

This worm drops copies of itself in all physical and removable drives. It also drops an AUTORUN.INF file to automatically execute its dropped copies when the said drives are accessed.

This worm connects to URLs to download possibly malicious files. As of this writing, however, the said URLs are inaccessible.

Related Items