Sohanad and all its variants

Here are SCVVHSOT.exe's alias

• Worm.Sohanad.U [PCTools]
• WORM_SOHANAD.DS [Trend Micro]
• W32.Imaut.A [Symantec]
• W32/YahLover.worm [McAfee]
• IM-Worm.Win32.Sohanad.as [Kaspersky Lab]
• TROJ_AUTORUN.AHP[Sophos]

Sohanad is a virus that spreads from yahoo messenger, it sends a message to all contacts of the victim which invitates their to download a file which is the virus in question. The virus spreads also via USB or external hard drive.

This virus puts three files in your system:

• <System>\SCVVHSOT.exe
• <Windows>\SCVVHSOT.exe
• <System>\autorun.ini

And another two files in all your root directory and removable drive:

• autorun.inf
• SCVVHSOT.exe

Creates registry entry

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  NofolderOptions
  0x00000001

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
  DisableTaskMgr
  0x00000001
  
  DisableRegistryTools
  0x00000001

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  Yahoo Messengger
  %System%\SCVVHSOT.exe

Change the value

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  Shell
  SCVVHSOT.exe
  

This virus launches out automatically to each time you open or explore an USB key, it is thus preferable to download this patch and to decompress it on the desk, to start again your machine in safe mode and of launching the patch, always in safe mode.
Insert all your USB keys when you launch the patch so that they all are disinfected.

Instruction on how to restart your computer in safe mode.