new folder.exe ruine my whole network...

[silencer1987]

please help me about this new folder.exe that it is in every pc here... I read about the thread here about new folder.exe but doesnt work... I also used SDFix no result still there is new folder.exe... I also used registry tools to delete that no result,,, My Avira doesnt detect it... My Malware bytes detect and delete but after reboot still there is new folder.exe... please help here....

[Raymond]

Use this Sohanad Removal Tool.
http://www.sergiwa.com/modules/mydownloads/visit.php?cid=2&lid=9

How to use it?
Start your computer in Safe mode and run this tool. If you have infected floppy/flash disks you can insert them and click start.

[silencer1987]

ok sir raymond, i would to this.... let see what's the result sir... thanks!

sir raymond, it says that whenever there is a detection you must buy first to remove?

[Raymond]

I think you downloaded the wrong one.
Try here.
http://rapidshare.com/files/305775794/SRT.zip.html

Remember to run this tool in Safe Mode.

[Ninja_smile]

Omg.. i have that aswell...

its on my external hard disk, it makes some folders hidden and makes a replacement with .exe extension, i tried using sonahad removal tool. didnt work.

any other solutions ?

[Ceyfer √]

Sohanad issue |my old post


Disable System Restore first. If old Sohanad tools cannot disinfect your pc, then try to run ( other solution ) Microsoft Security Essential / Spyware Doctor Starter Edition ( via Google Pack ). Additional to that, uninstall your Yahoo Messenger client and just reinstall it ( the latest client ) afterwards.

Worm:Autoit/Sohanad.CL is a worm that spreads via mapped network drives. It may also spread via e-mail and Yahoo Messenger after receiving configuration data from a remote attacker. Worm:Autoit/Sohanad.CL also drops additional malware to an affected machine

Microsoft Malware Protection Center
Threat Research and Response

[fletch]

Also try the free version of SAS

Download update then do a full scan in safe mode.

Delete all temp Internet files and cookies first

SAS/ Superantispyware http://www.superantispyware.com/

[ghanoom]

Omg.. i have that aswell...

it makes some folders hidden and makes a replacement with .exe extension,

I see like this virus before
and its name was FlyStudio Worm ( Nod32 name ) ,it was not Sohand
maybe it is a new Autorun worm

[silencer1987]

still no result sir raymond... there is no detection by sohanad removal tool...

[Raymond]

Use Avira AntiVir Rescue System CD.
http://www.raymond.cc/blog/archives/2008/06/28/free-avira-antivir-rescue-system-cd-to-clean-unremovable-virus/

http://www.raymond.cc/blog/archives/2009/09/02/advanced-usage-of-avira-antivir-rescue-system-bootcd/