So there you are happily minding your own business IM'ing away while whistling a merry Yahoo! tune when suddenly your friends start asking you why you are swearing at them, showing them some rather "graphic" pictures and hitting you up for a loan cause you just won lottery.. say what?!
At this point you are perhaps a little perplexed by it all and wondering just how you managed to acquire a whole pile of loopy friends who have all simultaneously lost the plot at exactly the same time... but the reality of your situation is not that you have acquired loopy friends (well you might have but that's beside the point) but that you may have acquired a very close releationship with Sohana or a variation of her. Now whether Sohana is a girl or not is actually beside the point as well, as all you need to really know is that Sohana is a Worm currently doing the rounds and causing an awful lot of grief... sounds like a woman to me ;) .. and I can say that because I am one.. a woman not a worm :p
Anyways, back to Sohana...
Sohana has been known to drop into not only Yahoo! Messenger but also AIM and Windows Live Messenger and the typical calling cards that she drops in our Yahoo! Messenger Custom Statuses and sprinkles through our active IM sessions display as (but are not just limited to):
|Symptoms of Sohana
|â€¢ have you ever seen such a silly man like this ?
â€¢ damn, she is so cute :x
â€¢ Just check out my new personal website
â€¢ you are virus infected
â€¢ wtf is this ? wanna give me a shit ?
â€¢ check this link for me Why I cannot surf this site ???
|â€¢ oh my god , i've won a 20000 usd lottery :O
â€¢ Come to my house tonight for a party !! >:D<
â€¢ hot pics this week
â€¢ 1 of my vacation pictures
â€¢ Images shot in Iraq The war will never end
â€¢ look at my new lover
|urls can be anything from nsl-school to lottery-news to thecoolpics to mytermex etc
she's also been known to change your homepage and fiddle with your registry entries for Buzz and LaunchCast (specific to Yahoo! Messenger) so if any of the above look or sound familar then chances are you've either got an ongoing relationship with Sohana yourself or one of your friends has.
can prove quite a mission, simply because one of her (not so nice) characteristics is disabling currently installed AntiVirus scanners so a clean bill of health from your AV might in fact be completely incorrect. If you suspect you may be infected then your best bet is to head directly to an Online Virus Scanner, there are some great "free" scanners around that are very simple and easy to use:
just follow the prompts from the Online Scanner that you decide to use and pay close attention to the worm/trojan and variant details the scanner will provide as if one of the system files (typically svhost.exe or svhost32.exe) is currently in use you may have to download additional programs and / or follow detailed instructions (which they will provide) from safe mode.
(uninstalling Yahoo! Messenger) won't disturb Sohana one bit, she'll happily settle in with her feet up until the next time you re-install Yahoo! Messenger or she'll just swing her attention across to the other IM's (AIM or WLM) so make sure you completely remove her (and her footsteps) from your computer by following the instructions detailed by your chosen Online AV.
Keeping her out...
Once Sohana has been eradicated from your IM, or if you don't wish to make her acquaintance to begin with, then make sure your AntiVirus (we have some freeware AV's listed here if you need one) is right smack up to date and do give serious considering to swinging by Microsoft Windows Update as some of the worms doing the rounds on Yahoo! (and other IM's) at the moment are only made possible because ppl haven't used windows update for critical and security patches so the worms/trojans are using known security issues :)
Need help dealing with Sohana?
Feel free to post to either our WackyB.co.nz forum or over at WackyB.com
Want More Reading:
Worm Sohanad.I and Worm Sohanad.J
Sophos: Sohana.A, Sohana.B, Sohana.C, Sohana.D and Sohana.E