How to Remove Sality Virus

 Aliases

• 
  
W32/Sality.B.gen!Eldorado (Command)
• W32/Sality.AT (Avira)
• Win32/Sality.AA (CA)
• Win32.Sector.21 (Dr.Web)
• Win32/Sality.NBA (ESET)
• Trojan.Win32.Vilsel.vyy (Kaspersky)
• W32/Sality.gen.e (McAfee)
• W32/Sality.BD (Norman)
• W32/Spamta.QO.worm (Panda)
• Win32.KUKU.kj (Rising AV)
• Troj/SalLoad-A (Sophos)
• PE_SALITY.BA (Trend Micro)

Alert Level (?)
Severe 

 

Description:

Sality is a family of file infecting viruses that spread by infecting exe and scr files. The virus also includes an autorun worm component that allows it to spread to any removable or discoverable drive. In addition, Sality includes a downloader trojan component that installs additional malware via the Web.

Symptom:

As with many other malware, Sality disables antivirus software and prevents access to certain antivirus and security websites. Sality can also prevent booting into Safe Mode and may delete security-related files found on infected systems. To spread via the autorun component, Sality generally drops a .cmd, .pif, and .exe to the root of discoverable drives, along with an autorun.inf file which contains instructions to load the dropped file(s) when the drive is accessed. The Sality virus joins infected machines to its own P2P network. Updates to the malware are fed via decentralized lists of HTTP URLs.

Remediation:

System changes

The following system changes may indicate the presence of this malware:

• Sudden termination of certain security-related applications, processes or services
• Inability to run Windows Registry Editor
• The presence of the following driver:
  %SystemRoot%\system32\drivers\amsint32.sys
• Failure for certain security-related applications to run due to deletion of installed components such as files with the following extensions:
• .AVC
• .VDB

 

Installation

When run, Virus:Win32/Sality.AT drops a device driver as the following:

 

%SystemRoot%\system32\drivers\amsint32.sys - Trojan:WinNT/Sality

 

The virus creates and starts a system service named "amsint32" to run the dropped driver component. Virus:Win32/Sality.AT communicates with the driver component to restore SSDT.

Spreads via…

File infection

Virus:Win32/Sality.AT injects code into all running processes to load and run the virus and infect Windows executable files with extension ".EXE" or ".SCR". The virus seeks other target files by reading file names found in the following registry subkeys:

 

HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

 

Virus:Win32/Sality.AT will not infect files protected by SFC or if the file name starts with one of the following strings:

_AVPM.
A2GUARD.
AAVSHIELD.
AVAST
ADVCHK.
AHNSD.
AIRDEFENSE
ALERTSVC
ALOGSERV
ALSVC.
AMON.
ANTI-TROJAN.
AVZ.
ANTIVIR
APVXDWIN.
ARMOR2NET.
ASHAVAST.
ASHDISP.
ASHENHCD.
ASHMAISV.
ASHPOPWZ.
ASHSERV.
ASHSIMPL.
ASHSKPCK.
ASHWEBSV.
ASWUPDSV.
ATCON.
ATUPDATER.
ATWATCH.
AVCIMAN.
AVCONSOL.
AVENGINE.
AVESVC.
AVGAMSVR.
AVGCC.
AVGCC32.
AVGCTRL.
AVGEMC.
AVGFWSRV.
AVGNT.
AVGNTDD
AVGNTMGR
AVGSERV.
AVGUARD.
AVGUPSVC.
AVINITNT.
AVKSERV.
AVKSERVICE.
AVKWCTL.
AVP.
AVP32.
AVPCC.
AVPM.
AVAST
AVSERVER.
AVSCHED32.
AVSYNMGR.
AVWUPD32.
AVWUPSRV.
AVXMONITOR9X.
AVXMONITORNT.
AVXQUAR.
BDMCON.
BDNEWS.
BDSUBMIT.
BDSWITCH.
BLACKD.
BLACKICE.
CAFIX.
CCAPP.
CCEVTMGR.
CCPROXY.
CCSETMGR.
CFIAUDIT.
CLAMTRAY.
CLAMWIN.
CLAW95.
CUREIT
DEFWATCH.
DRVIRUS.
DRWADINS.
DRWEB32W.
DRWEBSCD.
DRWEBUPW.
DWEBLLIO
DWEBIO
ESCANH95.
ESCANHNT.
EWIDOCTRL.
EZANTIVIRUSREGISTRATIONCHECK.
F-AGNT95.
FAMEH32.
FILEMON
FIRESVC.
FIRETRAY.
FIREWALL.
FPAVUPDM.
FRESHCLAM.
EKRN.
FSAV32.
FSAVGUI.
FSBWSYS.
F-SCHED.
FSDFWD.
FSGK32.
FSGK32ST.
FSGUIEXE.
FSMA32.
FSMB32.
FSPEX.
FSSM32.
F-STOPW.
GCASDTSERV.
GCASSERV.
GIANTANTISPYWAREMAIN.
GIANTANTISPYWAREUPDATER.
GUARDGUI.
GUARDNT.
HREGMON.
HRRES.
HSOCKPE.
HUPDATE.
IAMAPP.
IAMSERV.
ICLOAD95.
ICLOADNT.
ICMON.
ICSSUPPNT.
ICSUPP95.
ICSUPPNT.
IFACE.
INETUPD.
INOCIT.
INORPC.
INORT.
INOTASK.
INOUPTNG.
IOMON98.
ISAFE.
ISATRAY.
ISRV95.
ISSVC.
KAV.
KAVMM.
KAVPF.
KAVPFW.
KAVSTART.
KAVSVC.
KAVSVCUI.
KMAILMON.
KPFWSVC.
MCAGENT.
MCMNHDLR.
MCREGWIZ.
MCUPDATE.
MCVSSHLD.
MINILOG.
MYAGTSVC.
MYAGTTRY.
NAVAPSVC.
NAVAPW32.
NAVLU32.
NAVW32.
NEOWATCHLOG.
NEOWATCHTRAY.
NISSERV
NISUM.
NMAIN.
NOD32
NORMIST.
NOTSTART.
NPAVTRAY.
NPFMNTOR.
NPFMSG.
NPROTECT.
NSCHED32.
NSMDTR.
NSSSERV.
NSSTRAY.
NTRTSCAN.
NTOS.
NTXCONFIG.
NUPGRADE.
NVCOD.
NVCTE.
NVCUT.
NWSERVICE.
OFCPFWSVC.
OUTPOST
OP_MON.
PAVFIRES.
PAVFNSVR.
PAVKRE.
PAVPROT.
PAVPROXY.
PAVPRSRV.
PAVSRV51.
PAVSS.
PCCGUIDE.
PCCIOMON.
PCCNTMON.
PCCPFW.
PCCTLCOM.
PCTAV.
PERSFW.
PERTSK.
PERVAC.
PNMSRV.
POP3TRAP.
POPROXY.
PREVSRV.
PSIMSVC.
QHONLINE.
QHONSVC.
QHWSCSVC.
RAVMON.
RAVTIMER.
AVGNT
AVCENTER.
RFWMAIN.
RTVSCAN.
RTVSCN95.
RULAUNCH.
SALITY
SAVADMINSERVICE.
SAVMAIN.
SAVPROGRESS.
SAVSCAN.
SCANNINGPROCESS.
SDRA64.
SDHELP.
SHSTAT.
SITECLI.
SPBBCSVC.
SPHINX.
SPIDERCPL.
SPIDERML.
SPIDERNT.
SPIDERUI.
SPYBOTSD.
SPYXX.
SS3EDIT.
STOPSIGNAV.
SWAGENT.
SWDOCTOR.
SWNETSUP.
SYMLCSVC.
SYMPROXYSVC.
SYMSPORT.
SYMWSC.
SYNMGR.
TAUMON.
TBMON.
AVAST
TMLISTEN.
TMNTSRV.
TMPFW.
TMPROXY.
TNBUTIL.
TRJSCAN.
UP2DATE.
VBA32ECM.
VBA32IFS.
VBA32LDR.
VBA32PP3.
VBSNTW.
VCRMON.
VPTRAY.
VRFWSVC.
VRMONNT.
VRMONSVC.
VRRW32.
VSECOMR.
VSHWIN32.
VSMON.
VSSERV.
VSSTAT.
WATCHDOG.
WEBSCANX.
WEBTRAP.
WGFE95.
WINAW32.
WINROUTE.
WINSS.
WINSSNOTIFY.
WRCTRL.
XCOMMSVR.
ZAUINST
ZLCLIENT
ZONEALARM

 

Removable and remote drives

Virus:Win32/Sality.AT attempts to copy one of following files to the Windows temporary files folder (e.g. %TEMP%) and infects the copied file:

 

%SystemRoot%\system32\NOTEPAD.EXE

%SystemRoot%\system32\WINMINE.EXE

 

The virus copies the infected file to the root of all remote and removable drives as one of the following:

 

\<random>.pif

\<random>.exe

\<random>.cmd

 

The virus then writes an Autorun configuration file named "autorun.inf" pointing to the virus copy. When the drive is accessed from a computer supporting the Autorun feature, the virus is launched automatically.

Payload

Prevents booting Windows in safe mode

Win32/Sality.AT recursviely deletes all registry values and data under the following registry subkeys preventing the user from starting Windows in safe mode:

HKLM\System\CurrentControlSet\Control\SafeBoot
HKCU\System\CurrentControlSet\Control\SafeBoot

 

Disables security monitoring software

Win32/Sality.AT reads the system service descriptor table (SSDT) directly from the NT kernel ("ntoskrnl.exe") and passes the original SSDT to a buffer created by the driver component (Trojan:WinNT/Sality). System API calls to the SSDT are redirected to the clean version stored in the driver component. The behavior may block some HIPS or antivirus on-access detection methods that rely on SSDT hooks.

 

 

Deletes security-related files

This virus deletes security data files including security software detection database files or signatures that have the following file extensions found in all drives and network shares:

• .AVC
• .VDB

 

Terminates security-related services 
Win32/Sality attempts to stop and delete the following security-related services:

 

Agnitum Client Security Service
ALG
Amon monitor
aswUpdSv
aswMon2
aswRdr
aswSP
aswTdi
aswFsBlk
acssrv
AV Engine
avast! iAVS4 Control Service
avast! Antivirus
avast! Mail Scanner
avast! Web Scanner
avast! Asynchronous Virus Monitor
avast! Self Protection
AVG E-mail Scanner
Avira AntiVir Premium Guard
Avira AntiVir Premium WebGuard
Avira AntiVir Premium MailGuard
AVP
avp1
BackWeb Plug-in - 4476822
bdss
BGLiveSvc
BlackICE
CAISafe
ccEvtMgr
ccProxy
ccSetMgr
COMODO Firewall Pro Sandbox Driver
cmdGuard
cmdAgent
Eset Service
Eset HTTP Server
Eset Personal Firewall
F-Prot Antivirus Update Monitor
fsbwsys
FSDFWD
F-Secure Gatekeeper Handler Starter
FSMA
Google Online Services
InoRPC
InoRT
InoTask
ISSVC
KPF4
KLIF
LavasoftFirewall
LIVESRV
McAfeeFramework
McShield
McTaskManager
navapsvc
NOD32krn
NPFMntor
NSCService
Outpost Firewall main module
OutpostFirewall
PAVFIRES
PAVFNSVR
PavProt
PavPrSrv
PAVSRV
PcCtlCom
PersonalFirewal
PREVSRV
ProtoPort Firewall service
PSIMSVC
RapApp
SmcService
SNDSrvc
SPBBCSvc
SpIDer FS Monitor for Windows NT
SpIDer Guard File System Monitor
SPIDERNT
Symantec Core LC
Symantec Password Validation
Symantec AntiVirus Definition Watcher
SavRoam
Symantec AntiVirus
Tmntsrv
TmPfw
tmproxy
tcpsr
UmxAgent
UmxCfg
UmxLU
UmxPol
vsmon
VSSERV
WebrootDesktopFirewallDataService
WebrootFirewall
XCOMM

 

Terminates security-related processes

Win32/Sality attempts to terminate the following security-related processes:

 

_AVPM.
A2GUARD.
AAVSHIELD.
AVAST
ADVCHK.
AHNSD.
AIRDEFENSE
ALERTSVC
ALOGSERV
ALSVC.
AMON.
ANTI-TROJAN.
AVZ.
ANTIVIR
APVXDWIN.
ARMOR2NET.
ASHAVAST.
ASHDISP.
ASHENHCD.
ASHMAISV.
ASHPOPWZ.
ASHSERV.
ASHSIMPL.
ASHSKPCK.
ASHWEBSV.
ASWUPDSV.
ATCON.
ATUPDATER.
ATWATCH.
AVCIMAN.
AVCONSOL.
AVENGINE.
AVESVC.
AVGAMSVR.
AVGCC.
AVGCC32.
AVGCTRL.
AVGEMC.
AVGFWSRV.
AVGNT.
AVGNTDD
AVGNTMGR
AVGSERV.
AVGUARD.
AVGUPSVC.
AVINITNT.
AVKSERV.
AVKSERVICE.
AVKWCTL.
AVP.
AVP32.
AVPCC.
AVPM.
AVAST
AVSERVER.
AVSCHED32.
AVSYNMGR.
AVWUPD32.
AVWUPSRV.
AVXMONITOR9X.
AVXMONITORNT.
AVXQUAR.
BDMCON.
BDNEWS.
BDSUBMIT.
BDSWITCH.
BLACKD.
BLACKICE.
CAFIX.
CCAPP.
CCEVTMGR.
CCPROXY.
CCSETMGR.
CFIAUDIT.
CLAMTRAY.
CLAMWIN.
CLAW95.
CUREIT
DEFWATCH.
DRVIRUS.
DRWADINS.
DRWEB32W.
DRWEBSCD.
DRWEBUPW.
DWEBLLIO
DWEBIO
ESCANH95.
ESCANHNT.
EWIDOCTRL.
EZANTIVIRUSREGISTRATIONCHECK.
F-AGNT95.
FAMEH32.
FILEMON
FIRESVC.
FIRETRAY.
FIREWALL.
FPAVUPDM.
FRESHCLAM.
EKRN.
FSAV32.
FSAVGUI.
FSBWSYS.
F-SCHED.
FSDFWD.
FSGK32.
FSGK32ST.
FSGUIEXE.
FSMA32.
FSMB32.
FSPEX.
FSSM32.
F-STOPW.
GCASDTSERV.
GCASSERV.
GIANTANTISPYWAREMAIN.
GIANTANTISPYWAREUPDATER.
GUARDGUI.
GUARDNT.
HREGMON.
HRRES.
HSOCKPE.
HUPDATE.
IAMAPP.
IAMSERV.
ICLOAD95.
ICLOADNT.
ICMON.
ICSSUPPNT.
ICSUPP95.
ICSUPPNT.
IFACE.
INETUPD.
INOCIT.
INORPC.
INORT.
INOTASK.
INOUPTNG.
IOMON98.
ISAFE.
ISATRAY.
ISRV95.
ISSVC.
KAV.
KAVMM.
KAVPF.
KAVPFW.
KAVSTART.
KAVSVC.
KAVSVCUI.
KMAILMON.
KPFWSVC.
MCAGENT.
MCMNHDLR.
MCREGWIZ.
MCUPDATE.
MCVSSHLD.
MINILOG.
MYAGTSVC.
MYAGTTRY.
NAVAPSVC.
NAVAPW32.
NAVLU32.
NAVW32.
NEOWATCHLOG.
NEOWATCHTRAY.
NISSERV
NISUM.
NMAIN.
NOD32
NORMIST.
NOTSTART.
NPAVTRAY.
NPFMNTOR.
NPFMSG.
NPROTECT.
NSCHED32.
NSMDTR.
NSSSERV.
NSSTRAY.
NTRTSCAN.
NTOS.
NTXCONFIG.
NUPGRADE.
NVCOD.
NVCTE.
NVCUT.
NWSERVICE.
OFCPFWSVC.
OUTPOST
OP_MON.
PAVFIRES.
PAVFNSVR.
PAVKRE.
PAVPROT.
PAVPROXY.
PAVPRSRV.
PAVSRV51.
PAVSS.
PCCGUIDE.
PCCIOMON.
PCCNTMON.
PCCPFW.
PCCTLCOM.
PCTAV.
PERSFW.
PERTSK.
PERVAC.
PNMSRV.
POP3TRAP.
POPROXY.
PREVSRV.
PSIMSVC.
QHONLINE.
QHONSVC.
QHWSCSVC.
RAVMON.
RAVTIMER.
AVGNT
AVCENTER.
RFWMAIN.
RTVSCAN.
RTVSCN95.
RULAUNCH.
SALITY
SAVADMINSERVICE.
SAVMAIN.
SAVPROGRESS.
SAVSCAN.
SCANNINGPROCESS.
SDRA64.
SDHELP.
SHSTAT.
SITECLI.
SPBBCSVC.
SPHINX.
SPIDERCPL.
SPIDERML.
SPIDERNT.
SPIDERUI.
SPYBOTSD.
SPYXX.
SS3EDIT.
STOPSIGNAV.
SWAGENT.
SWDOCTOR.
SWNETSUP.
SYMLCSVC.
SYMPROXYSVC.
SYMSPORT.
SYMWSC.
SYNMGR.
TAUMON.
TBMON.
AVAST
TMLISTEN.
TMNTSRV.
TMPFW.
TMPROXY.
TNBUTIL.
TRJSCAN.
UP2DATE.
VBA32ECM.
VBA32IFS.
VBA32LDR.
VBA32PP3.
VBSNTW.
VCRMON.
VPTRAY.
VRFWSVC.
VRMONNT.
VRMONSVC.
VRRW32.
VSECOMR.
VSHWIN32.
VSMON.
VSSERV.
VSSTAT.
WATCHDOG.
WEBSCANX.
WEBTRAP.
WGFE95.
WINAW32.
WINROUTE.
WINSS.
WINSSNOTIFY.
WRCTRL.
XCOMMSVR.
ZAUINST
ZLCLIENT
ZONEALARM

 

Additionally, Virus:Win32/Sality.AT kills processes which have following modules loaded:

DWEBLLIO
DWEBIO

 

Modifies Windows settings

Virus:Win32/Sality.AT modifies the registry to disable Windows Registry Editor:

Sets value: "DisableRegistryTools"
With data: "1"

Under subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system

 

The virus modifies the registry to prevent viewing files with hidden attributes.

Sets value: "Hidden"
With data: "2"
Under subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer

Lowers computer security

Virus:Win32/Sality.AT modifies the registry to bypass the Windows firewall.

Sets value: "<virus file name>:*:enabled:ipsec"
With data: "<virus file name>"
Under subkey: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\List

 

The virus modifies other registry data that lower the security of the infected computer. Virus:Win32/Sality.AT modifies the following registry data to change Windows Security Center and Windows Firewall settings.

Sets value: "AntiVirusOverride"
with data: "1"
Under subkey: HKLM\SOFTWARE\Microsoft\Security Center

Sets value: "AntiVirusOverride"
with data: "1"
Under subkey: HKLM\SOFTWARE\Microsoft\Security Center\Svc

Sets value: "AntiVirusDisableNotify"
with data: "1"
Under subkey: HKLM\SOFTWARE\Microsoft\Security Center\Svc

Sets value: "FirewallOverride"
with data: "1"
Under subkey: HKLM\SOFTWARE\Microsoft\Security Center\Svc

Sets value: "FirewallDisableNotify"
with data: "1"
Under subkey: HKLM\SOFTWARE\Microsoft\Security Center\Svc

Sets value "EnableFirewall"
with data: "0"
Under subkey: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile

 

Downloads arbitrary files

Virus:Win32/Sality.AT attempts to download files from remote servers to the local drive, then decrypts and executes the downloaded files. We have observed the virus to connect to the following servers:

www.klkjwre9fqwieluoi.info
kukutrustnet777888.info
klkjwre77638dfqwieuoi888.info
89.119.67.154
kukutrustnet777.info
kukutrustnet888.info
kukutrustnet987.info

 

At the time of this writing, retrieved files were identified as the following:

 

• TrojanProxy:Win32/Pramro.F
• TrojanSpy:Win32/Keatep.B
   
  Despite the fact the Microsoft strives to make Windows operating systems as secure as possible, malware threats might still breach the computer security and infect the PC. Depending on the type of malware, various tools can be used. One of them is Win32/Sality Remover, an application developed by AVG for eradicating a specific Windows virus.
  
  Win32/Sality.AM is a variant of polymorphic file infectors targetting Windows executable files featuring .SCR or .EXE extensions. Win32/Sality.AM can run a damaging payload deleting files with specific extensions while also killing security-related processes and services.
  
  The benefit of using such a utility over a dedicated security solution is that removal tools specialize in detecting and removing specific viruses that might not be included in the virus definitions of the existing antivirus.
  
  Win32/Sality Remover does not need to be installed onto the target computer as it runs out-of-the-box, simply by double-clicking its file. It automatically starts scanning the PC yet users can stop the process when needed. During this scan, one can view the total number of analyzed files, the infected ones, as well as the removed ones.
  
  If any of the scanned files cannot be accessed because it is used by the operating system or by another program, Win32/Sality Remover can schedule the scan and clean for the next OS restart, so that it is no longer interrupted by any disturbances.
  
  This software can be run from the command-line, and depending on the parameters, it can be used to scan and disinfect a certain file, an entire folder or a drive. Needless to say, it is best if this action is performed by an expert, familiarized with Windows commands.
  
  Although Win32/Sality Remover is efficient in detecting and removing Win32/Sality.AM variants, one should not rely exclusively on this application for ensuring PC security. A full-featured antivirus solution is essential for keeping the computer malware-free.
    

 You can Download Sality REMOVAL

click Here