x
48h OFFER
If you're already a customer of
our homeusers protection,
renew now with 50% off
RENEW NOW
x
SPECIAL OFFER
If you're already a customer of
our homeusers protection,
renew now with 50% off
RENEW NOW
x
HALLOWEEN OFFER
take advantage of our
terrific discounts
BUY NOW AND GET A 50% OFF
x
CHRISTMAS OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET A 50% OFF
x
SPECIAL OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET A 50% OFF
x
BLACKFRIDAY OFFER
Buy the best antivirus
at the best price
TODAY ONLY UP TO 70% OFF
x
CYBERMONDAY OFFER
Buy the best antivirus
at the best price
(Only for homeusers)
TODAY ONLY UP TO 70% OFF
Active Scan. Scan your PC free
Panda Protection

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Encyclopedia GetVirusCard True 0

Sohanat.CU

 
Threat LevelHigh threatDamageSevereDistributionNot widespread
Common name:Sohanat.CU
Technical name:W32/Sohanat.CU.worm
Threat level:Medium
Type:Worm
Effects:  

It reduces the security level of the computer, disables the Task Manager and the Windows Registry Editor, and modifies the Internet Explorer Start Page. It spreads via the instant messaging programs AOL Instant Messenger, Windows Live Messenger, Windows Messenger and Yahoo Messenger.

Affected platforms:

Windows 2003/XP/2000/NT/ME/98/95

First detected on:Aug. 25, 2007
Detection updated on:Aug. 31, 2007
StatisticsNo
Proactive protection:
Yes, using TruPrevent Technologies

Brief Description 

    

Sohanat.CU is a worm that reduces the protection level of the computer, as it ends several processes, belonging to security tools.

Additionally, it disables tools, such as the Task Manager, which allows users to view the processes that are being run, and the Windows Registry Editor.

On the other hand, it modifies some items, such as the Internet Explorer Start page and the website that the user views when Yahoo Messenger is accessed.

Sohanat.CU spreads via the instant messaging programs AOL Instant Messenger, Windows Live Messenger, Windows Messenger and Yahoo Messenger in a message that contains a link. If this link is followed, the user accesses the download page of Sohanat.CU.

Visible Symptoms 

    

Sohanat.CU is easy to recognize, as it reaches the computer in one of the following instant messages with a link:

  • ( the page cannot be displayed <link from which the worm is downloaded>error.jpg Something was wrong !!! Check it again and tell me later. THanks
  • :)) I won an iPhone. You will never believe it :O <link from which the worm is downloaded> mylottery.jpg <<
  • :D who is beside you in this pic <link from which the worm is downloaded> "friendpic1.jpg so good-looking
  • ;) 1 of my vacation pictures <link from which the worm is downloaded>vacation1.jpg <:-P
  • ;) 1 of my vacation pictures <link from which the worm is downloaded>vacation2.jpg <:-P
  • Do you realize who is in this image: <link from which the worm is downloaded>who.jpg . Just think for a moment and tell me soon ;))
  • hot pics this week <link from which the worm is downloaded>hot.jpg :x
  • Images shot in Iraq _ The war will never end <link from which the worm is downloaded>Iraqwar.jpg << :(
  • My pics <link from which the worm is downloaded>mypics.jpg b-( <<
  • never click into the links like something in this image <link from which the worm is downloaded>dontclick.jpg #:-S !!!
  • New game ;;) sexy beach 3 (man only) <link from which the worm is downloaded>MissWorld.jpg !!
  • Screenshot of my new Ipod <link from which the worm is downloaded>vista.jpg so cool :D
>