Removing the W32 Sohanad Worm / Virus Instructions
About the Sohanad Worm/ Virus
This is a worm that spreads itself by sending links to your contacts in messengers like Yahoo, AOL and Windows Live messengers. It changes the Internet Explorer (IE) home page and doesn't let you change the homepage address. It also disables Registry Editor, Task Manager and the Run option in Start-menu. Bugs in Internet explorer is the cause of such virus attacks. Firefox users never face attack from viruses, so if you want to stay away from such attacks, you should use Firefox browser.
You can remove this worm by manual method, or using a removal tool.
1. Remove virus/worm using manual method:
Here are simple steps following which you can get the worm removed from your system:
1) Download this file: http://avsharath.googlepages.com/RepairRegistry.reg (Right click and select "Save Target as").
2) Double click on that downloaded registry file, you will be asked weather you're sure to add this to registry, click yes.
3) Restart your system.
4) Search for the file svhost32.exe and delete it if its found.
5) Search for the file svhost.exe and delete it if its found.
6) Install and use Firefox browser instead of the sad IE to keep off from virus attack in future.
If you have Regedit disabled in your system, reboot your system in safe mode and follow the same instructions given above. There is also an alternative method. method that you can try.
The sohanad worm removal tool is available from below link:
Download the tool and run it to get rid of the worm from your system.
Related links:
Removing W32 Sohanad.H worm Instructions
For more details on this worm, read the TrendMicro virus Information on this worm.
If you have any questions, you can mail me to: avsharath(at)yahoo(dot)com