WORM_SOHANAD.AS

This worm arrives either as a file downloaded from remote sites by other malware. It can also be downloaded unknowingly by a user when visiting malicious Web sites.

It drops copies of itself. It also drops a certain file.

It disables Task Manager. It does the said routine to avoid termination from the affected system's memory.

It attempts to connect to certain URLs to download possibly maliciois files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

It creates a scheduled task to execute its dropped copies. It then uses Windows Task Scheduler to create the following scheduled task that automatically executes at 9 o'clock everyday:

• AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su %System%\blastclnnn.exe

Related Items