Download Win32 Sality Removal Download

| |

Virus/ Worm Characteristics

After execution, W32/Sality starts a service to listen on a random UDP port and creates a copy of itself in the following path:
  • %Windir%\System32\Drivers\{ RANDOM }.sys
  • W32/Sality infect *.exe and *scr files on the local, network, and removable drives, with the exception of files containing the following string(s) in the filename:
    • WINDOWS
    • SYSTEM
    • SYSTEM32
W32/Sality can download further malware from the following domains (these are example domains only and are not meant to be a comprehensive list):
  • 1. yimg.com
  • Us.i1.yimg.com
  • http:.//ad.yieldmanager.com
  • mattfoll.eu.interia.pl
  • bjerm.mass.hc.ru
Other area to be infected
  • W32/Sality  also drop an Autorun.inf file to auto-execute itself
  • W32/Sality attempts to hook to one of the random processes and connects to certain sites to download malware
  • W32/Sality uses Notepad.exe and Winmine.exe to inject itself into other Windows executables
  • Process Explorer may, for example, show Notepad.exe as a running process when you have not opened it. If you kill this process, W32/Sality will hook on to another process.
Common Registry changes made by W32/Sality
When a W32/Sality infection occurs, it disables Regedit and the Windows Task Manager, and also creates the following registry entries:
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableTaskMgr: 0x00000001
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools
In an attempt to make recovery difficult, registry keys in the following sub-tree are deleted and must be restored to the original configuration:
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\*
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\*
    Other names
Antivirus Company and Equivalent detection
  • Avast : Win32:Kukacka
  • AVG (GriSoft): Win32/Tanatos.J
  • Avira  :  W32/Sality Windows
  • Kaspersky:    Virus.Win32.Sality.GeN
  • BitDefender:    Win32.Sality.2.OE
  • Clamav:    W32.Sality-27
  • F-Prot:    W32/Sality.AJ
  • Microsoft:    virus:win32/sality.am
  • Symantec :   W32.Sality.AE
  • Eset:    Win32/Sality.NAO virus
  • Sophos:    W32/Sality-AM
  • Trend Micro:    PE_SALITY.EK

Related Posts by Categories

0 komentar:

Posting Komentar