W32/Sohana-F is a worm for the Windows platform.

W32/Sohana-F spreads via network shares and may attempt to spread via removable media. W32/Sohana-F may also attempt to spread via instant messaging clients.

W32/Sohana-F includes functionality to download, install and run new software. W32/Sohana-F also includes functionality to:

- harvest information from the clipboard
- log keypresses
- capture screen images
- change the the Microsoft Internet Explorer start page
- set up an FTP server
- set up a proxy server

More information can be found at this Sophos page.