Nov
27
2006

Removing thecoolpics.net worm

An article by Arun Vishnu

This W32/Sohanad is a worm. The worm will infect Windows systems and spreads through Instant Messaging. This worm propagates via Yahoo! Messenger, AOL Instant Messenger (AIM), Windows Live Messenger or Windows Messenger by sending an instant message to all the contacts of an active user. This message contains a link to a remote copy of itself. When the recipient clicks the link, a copy of this worm is downloaded and executed on the recipients’ system.
Common Instant Message an infected user sends are as follows:

http://thecoolpics.net/hot.jpg
hot pics this week – http://thecoolpics.net/hot.jpg
1 of my vacation pictures – http://thecoolpics.net/vacation2.jpg
Screenshot of new windows version _ Windows Vista – http://thecoolpics.net/vista.jpg so cool
Images shot in Iraq _ The war will never end _ http://thecoolpics.net/Iraqwar.jpg
oh my god , i’ve won a 20000 usd lottery – http://thecoolpics.net/mylottery.jpg
never click into the links like something in this image – http://thecoolpics.net/dontclick.jpg
the page cannot be displayed ” http://thecoolpics.net/error.jpg Something was wrong !!! Check it again and tell me later.
My pics – http://thecoolpics.net/mypics.jpg
Miss World 2006: – http://thecoolpics.net/MissWorld.jpg
Do you realize who is in this image – http://thecoolpics.net/who.jpg . Just think for a moment and tell me soon

How to remove thecoolpics:

Download this file W32Sohanad.vbs
Reboot your computer in “SafeMode” and remain that no other programs are running.
Double click on W32Sohanad.vbs.

This will solve your problem. Please note that this code will set your home page to this blog. If you want you can change it. K.

Keep visiting my blog

Tags: Security, Tips & Tricks, virus, windows, worm

Author: Arun Vishnu

12 Comments + Add Comment

Anonymous December 10, 2006 at 2:54 pm

Dear sir
your suggested anti virus didnt act properly.
In fact it was of no use.
thanx anyway
Arun Vishnu M V (Kannan) December 10, 2006 at 4:23 pm

ohh. ohk ohk.. i will try it 2morw and gve u a solution..k
Anonymous February 16, 2007 at 4:37 am

i have tried it.. but still the worm attacks my PC. is there any other way. one of your suggestion is to run regedit. but RUN command is disabled here. Thanks. pls email me here leo_sweetguy25@yahoo.com
Anonymous May 28, 2007 at 2:26 pm

hey tht link is nt working to dnload file plz fix it or send me at yahoo_ankit@rediffmail.com
andigwandi May 29, 2007 at 11:46 am

my office firewall does’nt allow me to download the file.

can any1 send me the mail @
andigwndi@gmail.com

Thanks

Andigwandi
pp June 8, 2007 at 4:09 am

i wsnt able to download dat file….plss help me..
Anonymous June 8, 2007 at 3:10 pm

pls send me the vbs file because i can,t download it. My mail is seda_6387@yahoo.com. And with this worm i have another problem, it don’t let me to acces the run im the start menu. Could i do anything?
sangram June 8, 2007 at 11:56 pm

please send the file to me at sangramsingh112@yahoo.co.uk
thanx
hare krishna
Anonymous July 24, 2007 at 4:29 pm

thats a 404, can you upload somewhere else ?
gagan July 26, 2007 at 4:17 pm

Hi sir my email is gagandeep1907@yahoo.co.in please tell me how to remove thecoolpics.net worm. Please mail me on this address
Anonymous August 3, 2007 at 3:06 am

hye sir..
i cant remove thecoolpics worm..
please help me…..
email me how to remove it..
jacksparrrow_one@yahoo.com.my

thnks
Deepak August 3, 2007 at 1:33 pm

i got this virus(thecoolpics.net) through ym. can anyone know how to remove it as the link which mentioned above is not working.