Remove sohanad.ap - Spyware Removal Information

More than 1309737 spyware signatures and growing

Spywarelib Search

Search in:

Spywares

Files

Md5

Registry

Worm-IM.sohanad.ap Analysis Report

Threat Submitted On: 3/9/2008 7:38:16 PM

Threat Analysed On: 3/10/2008 12:38:16 AM

Threat Updated On: 11/15/2009 11:03:26 AM

Type : Worm-IM

Symptoms of sohanad.ap

Spreads through Instant Messaging.
Sends itself to the Contact lists of the IM.
The users can sometimes be duped to accept the message due to the social engineering techniques adopted by the worm.

Removal Recommended (Click here to remove automatically)

Removal Recommended

Information

Alias : im-worm.win32.sohanad.ap

Md5 Hash : [13531b549b9d70f2457e30c2f027e8f6]

File Size : (244616 bytes)

Technical Details

Here are the Technical findings of our analysis team after analyzing this malware in detail :-

Creates the following infected Files on user's System

Note:

Delete the following Files to remove Infection

File: sscvihost.exe
Path : %windir%

	Md5Hash :


		13531b549b9d70f2457e30c2f027e8f6 ( 244616 bytes)


		2c72bdf0ff52769d5c93847b61efb68f ( 257090 bytes)


		4e12ab75c7f06fe332c4b0ea407770ba ( 308736 bytes)


		69e8a856a2b18eb07f38a19615d767a3 ( 2048512 bytes)


		6a3e2e2a226fa3f3c35bd16104463d45 ( 244736 bytes)


		c455e61fd2556ab8a4640df329933330 ( 244736 bytes)


		e3b2cdd5b360548d1108daa1da14366d ( 265216 bytes)


		e3cda7a2b6251bba1b8b31e278f6ec90 ( 246272 bytes)

File: autorun.ini
Path : %windir%\system32
Md5Hash :f25d2a4eedac8441f694574da0a2bc87 ( 106 bytes)

File: blastclnnn.exe
Path : %windir%\system32

	Md5Hash :


		13531b549b9d70f2457e30c2f027e8f6 ( 244616 bytes)


		2c72bdf0ff52769d5c93847b61efb68f ( 257090 bytes)


		4e12ab75c7f06fe332c4b0ea407770ba ( 308736 bytes)


		69e8a856a2b18eb07f38a19615d767a3 ( 2048512 bytes)


		6a3e2e2a226fa3f3c35bd16104463d45 ( 244736 bytes)


		c455e61fd2556ab8a4640df329933330 ( 244736 bytes)


		e3b2cdd5b360548d1108daa1da14366d ( 265216 bytes)


		e3cda7a2b6251bba1b8b31e278f6ec90 ( 246272 bytes)

File: setting.ini
Path : %windir%\system32

	Md5Hash :


		( bytes)


		c362ce6a19c87780bde4fb222e2d7960 ( 2033 bytes)

File: sscvihost.exe
Path : %windir%\system32

	Md5Hash :


		13531b549b9d70f2457e30c2f027e8f6 ( 244616 bytes)


		2c72bdf0ff52769d5c93847b61efb68f ( 257090 bytes)


		4e12ab75c7f06fe332c4b0ea407770ba ( 308736 bytes)


		69e8a856a2b18eb07f38a19615d767a3 ( 2048512 bytes)


		6a3e2e2a226fa3f3c35bd16104463d45 ( 244736 bytes)


		c455e61fd2556ab8a4640df329933330 ( 244736 bytes)


		e3b2cdd5b360548d1108daa1da14366d ( 265216 bytes)


		e3cda7a2b6251bba1b8b31e278f6ec90 ( 246272 bytes)

File: [randomname].exe
Path : %workingdir%

	Md5Hash :


		13531b549b9d70f2457e30c2f027e8f6 ( 244616 bytes)


		2c72bdf0ff52769d5c93847b61efb68f ( 257090 bytes)


		4e12ab75c7f06fe332c4b0ea407770ba ( 308736 bytes)


		69e8a856a2b18eb07f38a19615d767a3 ( 2048512 bytes)


		6a3e2e2a226fa3f3c35bd16104463d45 ( 244736 bytes)


		70cac1cb214c636e0a1adf4e654e1a16 ( bytes)


		c455e61fd2556ab8a4640df329933330 ( 244736 bytes)


		e3b2cdd5b360548d1108daa1da14366d ( 265216 bytes)


		e3cda7a2b6251bba1b8b31e278f6ec90 ( 246272 bytes)

Creates the following infected Registry Keys on user's System

Note:

Delete these Registries to remove Infection

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCrawler\Shares

The following Registry Values are added to the provided Registry Keys :-

Note:

Delete the added Values from the Key to remove Infection

Key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCrawler\Shares

|__ Value Added :

shared = "\new folder.exe"

Key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

|__ Value Added :

yahoo messengger = "%windir%\system32\sscvihost.exe"

Also creates the following legitmate Registries on user's Systems which are also created by Genuine Software :-

Note:

These Keys can be kept as they are also created by genuine Software

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

The following Registry Values are added to the provided Registry Keys which are also created by Genuine Software :-

Note:

These Values can be left as they are also created by legitimate Software :-

Key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

|__ Value Added :

nofolderoptions

Key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

|__ Value Added :

disableregistrytools

Key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

|__ Value Added :

disabletaskmgr

Key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

|__ Value Added :

shell

Creates the following child process(s) on execution:

%windir%\system32\cmd.exe /c at /delete /yes

%windir%\system32\at.exe at /delete /yes

%windir%\system32\cmd.exe /c at 09:00 /interactive /every:m,t,w,th,f,s,su %windir%\system32\blastclnnn.exe

%windir%\system32\at.exe at 09:00 /interactive /every:m,t,w,th,f,s,su %windir%\system32\blastclnnn.exe

services.exe

Creates the Following MUTEX(s) on user's System:-

raspbfile

Copies the Following Files to Given Location :-

Copies :%workingdir%\[random name].exe

To : %windir%\system32\sscvihost.exe

Copies :%workingdir%\[random name].exe

To : %windir%\sscvihost.exe

Copies :%workingdir%\[random name].exe

To : %windir%\system32\blastclnnn.exe

NOTE:

1. %windir% Refers to the windows root folder. By default it is 'C:\Windows'
2. %workingdir% Refers to the current directory in which user is working.

Important: We strongly recommend that you backup the Registry before making any changes to it. Incorrect changes to the Registry can result in permanent data loss or corrupted Files. Modify the malicious\suspicious Subkeys only.

Click Here for more spywarelib.com recommended PC Security and Optimization Tools

To modify registry entries in Windows Operating System:
Follow Steps:
1. Click Start > Run
2. Type “regedit” : to open registry editor
3. Navigate to required registry Key from the Left Tree control and modify accordingly.