Virus.Win32.SALITY.RT

June 08, 2023

Analysis by: John Rainier Navato

ALIASES:

Virus.Win32.Sality.ag (KASPERSKY)

PLATFORM:

Windows

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

INFORMATION EXPOSURE:

Threat Type: Virus
Destructiveness: No
Encrypted: No
In the wild: Yes

OVERVIEW

Infection Channel:

Downloaded from the Internet, Dropped by other malware, Propagates via removable drives, Propagates via shared drives

This Virus arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It creates certain registry entries to disable applications related to security.

It drops copies of itself in all removable and physical drives found in the system. It drops copies of itself into network drives. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It modifies certain registry entries to hide Hidden files.

TECHNICAL DETAILS

File Size:

17,421,824 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

26 May 2023

Payload:

Drops files, Modifies system registry, Modifies files, Terminates processes, Disables AV, Connects to URLs/IPs, Hides files and processes

Arrival Details

This Virus arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Virus drops the following files:

%System%\drivers\{6 Random Characters}.sys ← Deleted afterwards
%User Temp%\{6 Random Characters}.exe ← Copy of %System%\ntkrnlpa.exe ← Deleted afterwards
%System Root%\{Random Characters}.pif/.exe
{Available Drive Roots Except for CD-ROM Drives}\{Random Characters}.pif/.exe
{Available Drive Roots Except for CD-ROM Drives}\autorun.inf

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

Other System Modifications

This Virus deletes the following folders:

%User Temp%\{Folder Name that Ends with _Rar}

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following line(s)/entry(ies) in the SYSTEM.INI file:

MCIDRV_VER
- DEVICEMB = {Random Integer Value}

It adds the following registry entries:

HKEY_CURRENT_USER\SOFTWARE\{Generated string from username}\
{Generated number from username}
{Random String 1 = 1

HKEY_CURRENT_USER\SOFTWARE\{Generated string from username}\
{Generated number from username}
{Random String 2} = 0

HKEY_CURRENT_USER\SOFTWARE\{Generated string from username}\
{Generated number from username}
{Random String 3} = 0

HKEY_CURRENT_USER\SOFTWARE\{Generated string from username}\
{Generated number from username}
{Random String 4} = 30

HKEY_CURRENT_USER\SOFTWARE\{Generated string from username}\
{Generated number from username}
{Random String 5} = 143

HKEY_CURRENT_USER\SOFTWARE\{Generated string from username}\
{Generated number from username}
{Random String 6} = {Random Value}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplication\
List
{Malware File Location}\{Malware File Name}.exe = {Malware File Location}\{Malware File Name}.exe:%s:*:Enabled:ipsec

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings
GlobalUsersOffline = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DoNotAllowExceptions = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DisableNotifications = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = 0

(Note: The default value data of the said registry entry is 1.)

It creates the following registry entries to disable applications related to security:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusOverride = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallOverride = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UpdatesDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UacDisableNotify = 1

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Control\Safeboot

HKEY_CURRENT_USER\System\CurrentControlSet\
Control\Safeboot

File Infection

This Virus infects the following file types:

.EXE/.exe
.SCR/.scr

It avoids infecting files that contain the following strings in their names:

AVPM
A2GUARD
A2CMD
A2SERVICE
A2FREE
AVAST
ADVCHK
AGB
AKRNL
AHPROCMONSERVER
AIRDEFENSE
ALERTSVC
AVIRA
AMON
TROJAN
AVZ
ANTIVIR
APVXDWIN
ARMOR2NET
ASHAVAST
ASHDISP
ASHENHCD
ASHMAISV
ASHPOPWZ
ASHSERV
ASHSIMPL
ASHSKPCK
ASHWEBSV
ASWUPDSV
ASWSCAN
AVCIMAN
AVCONSOL
AVENGINE
AVESVC
AVEVAL
AVEVL32
AVGAM
AVGCC
AVGCHSVX
AVGCSRVX
AVGNSX
AVGCC32
AVGCTRL
AVGEMC
AVGFWSRV
AVGNT
AVCENTER
AVGNTMGR
AVGSERV
AVGTRAY
AVGUARD
AVGUPSVC
AVGWDSVC
AVINITNT
AVKSERV
AVKSERVICE
AVKWCTL
AVP
AVP32
AVPCC
AVAST
AVSERVER
AVSCHED32
AVSYNMGR
AVWUPD32
AVWUPSRV
AVXMONITOR
AVXQUAR
BDSWITCH
BLACKD
BLACKICE
CAFIX
BITDEFENDER
CCEVTMGR
CFP
CFPCONFIG
CCSETMGR
CFIAUDIT
CLAMTRAY
CLAMWIN
CUREIT
DEFWATCH
DRVIRUS
DRWADINS
DRWEB
DEFENDERDAEMON
DWEBLLIO
DWEBIO
ESCANH95
ESCANHNT
EWIDOCTRL
EZANTIVIRUSREGISTRATIONCHECK
F-AGNT95
FAMEH32
FILEMON
FIREWALL
FORTICLIENT
FORTITRAY
FORTISCAN
FPAVSERVER
FPROTTRAY
FPWIN
FRESHCLAM
EKRN
FSAV32
FSAVGUI
FSBWSYS
F-SCHED
FSDFWD
FSGK32
FSGK32ST
FSGUIEXE
FSMA32
FSMB32
FSPEX
FSSM32
F-STOPW
GCASDTSERV
GCASSERV
GIANTANTISPYWARE
GUARDGUI
GUARDNT
GUARDXSERVICE
GUARDXKICKOFF
HREGMON
HRRES
HSOCKPE
HUPDATE
IAMAPP
IAMSERV
ICLOAD95
ICLOADNT
ICMON
ICSSUPPNT
ICSUPP95
ICSUPPNT
IPTRAY
INETUPD
INOCIT
INORPC
INORT
INOTASK
INOUPTNG
IOMON98
ISAFE
ISATRAY
KAV
KAVMM
KAVPF
KAVPFW
KAVSTART
KAVSVC
KAVSVCUI
KMAILMON
MAMUTU
MCAGENT
MCMNHDLR
MCREGWIZ
MCUPDATE
MCVSSHLD
MINILOG
MYAGTSVC
MYAGTTRY
NAVAPSVC
NAVAPW32
NAVLU32
NAVW32
NEOWATCHLOG
NEOWATCHTRAY
NISSERV
NISUM
NMAIN
NOD32
NORMIST
NOTSTART
NPAVTRAY
NPFMNTOR
NPFMSG
NPROTECT
NSCHED32
NSMDTR
NSSSERV
NSSTRAY
NTRTSCAN
NTOS
NTXCONFIG
NUPGRADE
NVCOD
NVCTE
NVCUT
NWSERVICE
OFCPFWSVC
OUTPOST
ONLINENT
OPSSVC
OP_MON
PAVFIRES
PAVFNSVR
PAVKRE
PAVPROT
PAVPROXY
PAVPRSRV
PAVSRV51
PAVSS
PCCGUIDE
PCCIOMON
PCCNTMON
PCCPFW
PCCTLCOM
PCTAV
PERSFW
PERTSK
PERVAC
PESTPATROL
PNMSRV
PREVSRV
PREVX
PSIMSVC
QUHLPSVC
QHONLINE
QHONSVC
QHWSCSVC
QHSET
RFWMAIN
RTVSCAN
RTVSCN95
SALITY
SAPISSVC
SCANWSCS
SAVADMINSERVICE
SAVMAIN
SAVPROGRESS
SAVSCAN
SCANNINGPROCESS
SDRA64
SDHELP
SHSTAT
SITECLI
SPBBCSVC
SPHINX
SPIDERCPL
SPIDERML
SPIDERNT
SPIDERUI
SPYBOTSD
SPYXX
SS3EDIT
STOPSIGNAV
SWAGENT
SWDOCTOR
SWNETSUP
SYMLCSVC
SYMPROXYSVC
SYMSPORT
SYMWSC
SYNMGR
TAUMON
TBMON
TMLISTEN
TMNTSRV
TMPROXY
TNBUTIL
TRJSCAN
VBA32ECM
VBA32IFS
VBA32LDR
VBA32PP3
VBSNTW
VCRMON
VPTRAY
VRFWSVC
VRMONNT
VRMONSVC
VRRW32
VSECOMR
VSHWIN32
VSMON
VSSERV
VSSTAT
WATCHDOG
WEBSCANX
WINSSNOTIFY
WRCTRL
XCOMMSVR
ZLCLIENT
ZONEALARM

It avoids infecting the following files:

Protected System Files
Files in CD-ROM drives

Propagation

This Virus drops copies of itself in all removable and physical drives found in the system.

It drops copies of itself into network drives.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

*Note: The order of the strings varies and the combination of uppercase and lowercase letters also varies*

[AutoRun]

;{Random Characters 1}
ShEll\OPeN\coMMaNd ={Random File Name}.{pif/exe}
;
shELl\Open\DefAUlT=1
;{Random Characters 2}
Open={Random File Name}.{pif/exe}
;{Random Characters 3}
shelL\ExPLorE\CommanNd={Random File Name}.{pif/exe}
;{Random Characters 4}
shell\aUToplay\CoMMANd ={Random FileName}.{pif/exe}
;{Random Characters 5}

Process Termination

This Virus terminates the following services if found on the affected system:

AVP
Agnitum Client Security Service
ALG
Amon monitor
aswUpdSv
aswMon2
aswRdr
aswSP
aswTdi
aswFsBlk
acssrv
AV Engine
avast! iAVS4 Control Service
avast! Antivirus
avast! Mail Scanner
avast! Web Scanner
avast! Asynchronous Virus Monitor
avast! Self Protection
AVG E-mail Scanner
Avira AntiVir Premium Guard
Avira AntiVir Premium WebGuard
Avira AntiVir Premium MailGuard
BGLiveSvc
BlackICE
CAISafe
ccEvtMgr
ccProxy
ccSetMgr
COMODO Firewall Pro Sandbox Driver
cmdGuard
cmdAgent
Eset Service
Eset HTTP Server
Eset Personal Firewall
F-Prot Antivirus Update Monitor
fsbwsys
FSDFWD
F-Secure Gatekeeper Handler Starter
FSMA
Google Online Services
InoRPC
InoRT
InoTask
ISSVC
KPF4
KLIF
LavasoftFirewall
LIVESRV
McAfeeFramework
McShield
McTaskManager
MpsSvc
navapsvc
NOD32krn
NPFMntor
NSCService
Outpost Firewall main module
OutpostFirewall
PAVFIRES
PAVFNSVR
PavProt
PavPrSrv
PAVSRV
PcCtlCom
PersonalFirewal
PREVSRV
ProtoPort Firewall service
PSIMSVC
RapApp
SharedAccess
SmcService
SNDSrvc
SPBBCSvc
SpIDer FS Monitor for Windows NT
SpIDer Guard File System Monitor
SPIDERNT
Symantec Core LC
Symantec Password Validation
Symantec AntiVirus Definition Watcher
SavRoam
Symantec AntiVirus
Tmntsrv
TmPfw
UmxAgent
UmxCfg
UmxLU
UmxPol
vsmon
VSSERV
WebrootDesktopFirewallDataService
WebrootFirewall
wscsvc
XCOMM

It terminates the following processes if found running in the affected system's memory:

AVPM
A2GUARD
A2CMD
A2SERVICE
A2FREE
AVAST
ADVCHK
AGB
AKRNL
AHPROCMONSERVER
AIRDEFENSE
ALERTSVC
AVIRA
AMON
TROJAN
AVZ
ANTIVIR
APVXDWIN
ARMOR2NET
ASHAVAST
ASHDISP
ASHENHCD
ASHMAISV
ASHPOPWZ
ASHSERV
ASHSIMPL
ASHSKPCK
ASHWEBSV
ASWUPDSV
ASWSCAN
AVCIMAN
AVCONSOL
AVENGINE
AVESVC
AVEVAL
AVEVL32
AVGAM
AVGCC
AVGCHSVX
AVGCSRVX
AVGNSX
AVGCC32
AVGCTRL
AVGEMC
AVGFWSRV
AVGNT
AVCENTER
AVGNTMGR
AVGSERV
AVGTRAY
AVGUARD
AVGUPSVC
AVGWDSVC
AVINITNT
AVKSERV
AVKSERVICE
AVKWCTL
AVP
AVP32
AVPCC
AVAST
AVSERVER
AVSCHED32
AVSYNMGR
AVWUPD32
AVWUPSRV
AVXMONITOR
AVXQUAR
BDSWITCH
BLACKD
BLACKICE
CAFIX
BITDEFENDER
CCEVTMGR
CFP
CFPCONFIG
CCSETMGR
CFIAUDIT
CLAMTRAY
CLAMWIN
CUREIT
DEFWATCH
DRVIRUS
DRWADINS
DRWEB
DEFENDERDAEMON
DWEBLLIO
DWEBIO
ESCANH95
ESCANHNT
EWIDOCTRL
EZANTIVIRUSREGISTRATIONCHECK
F-AGNT95
FAMEH32
FILEMON
FIREWALL
FORTICLIENT
FORTITRAY
FORTISCAN
FPAVSERVER
FPROTTRAY
FPWIN
FRESHCLAM
EKRN
FSAV32
FSAVGUI
FSBWSYS
F-SCHED
FSDFWD
FSGK32
FSGK32ST
FSGUIEXE
FSMA32
FSMB32
FSPEX
FSSM32
F-STOPW
GCASDTSERV
GCASSERV
GIANTANTISPYWARE
GUARDGUI
GUARDNT
GUARDXSERVICE
GUARDXKICKOFF
HREGMON
HRRES
HSOCKPE
HUPDATE
IAMAPP
IAMSERV
ICLOAD95
ICLOADNT
ICMON
ICSSUPPNT
ICSUPP95
ICSUPPNT
IPTRAY
INETUPD
INOCIT
INORPC
INORT
INOTASK
INOUPTNG
IOMON98
ISAFE
ISATRAY
KAV
KAVMM
KAVPF
KAVPFW
KAVSTART
KAVSVC
KAVSVCUI
KMAILMON
MAMUTU
MCAGENT
MCMNHDLR
MCREGWIZ
MCUPDATE
MCVSSHLD
MINILOG
MYAGTSVC
MYAGTTRY
NAVAPSVC
NAVAPW32
NAVLU32
NAVW32
NEOWATCHLOG
NEOWATCHTRAY
NISSERV
NISUM
NMAIN
NOD32
NORMIST
NOTSTART
NPAVTRAY
NPFMNTOR
NPFMSG
NPROTECT
NSCHED32
NSMDTR
NSSSERV
NSSTRAY
NTRTSCAN
NTOS
NTXCONFIG
NUPGRADE
NVCOD
NVCTE
NVCUT
NWSERVICE
OFCPFWSVC
OUTPOST
ONLINENT
OPSSVC
OP_MON
PAVFIRES
PAVFNSVR
PAVKRE
PAVPROT
PAVPROXY
PAVPRSRV
PAVSRV51
PAVSS
PCCGUIDE
PCCIOMON
PCCNTMON
PCCPFW
PCCTLCOM
PCTAV
PERSFW
PERTSK
PERVAC
PESTPATROL
PNMSRV
PREVSRV
PREVX
PSIMSVC
QUHLPSVC
QHONLINE
QHONSVC
QHWSCSVC
QHSET
RFWMAIN
RTVSCAN
RTVSCN95
SALITY
SAPISSVC
SCANWSCS
SAVADMINSERVICE
SAVMAIN
SAVPROGRESS
SAVSCAN
SCANNINGPROCESS
SDRA64
SDHELP
SHSTAT
SITECLI
SPBBCSVC
SPHINX
SPIDERCPL
SPIDERML
SPIDERNT
SPIDERUI
SPYBOTSD
SPYXX
SS3EDIT
STOPSIGNAV
SWAGENT
SWDOCTOR
SWNETSUP
SYMLCSVC
SYMPROXYSVC
SYMSPORT
SYMWSC
SYNMGR
TAUMON
TBMON
TMLISTEN
TMNTSRV
TMPROXY
TNBUTIL
TRJSCAN
VBA32ECM
VBA32IFS
VBA32LDR
VBA32PP3
VBSNTW
VCRMON
VPTRAY
VRFWSVC
VRMONNT
VRMONSVC
VRRW32
VSECOMR
VSHWIN32
VSMON
VSSERV
VSSTAT
WATCHDOG
WEBSCANX
WINSSNOTIFY
WRCTRL
XCOMMSVR
ZLCLIENT
ZONEALARM

Dropping Routine

This Virus drops the following files:

%User Temp%\{Random Characters 3}.exe ← Deleted afterwards
%User Temp%\{Random Characters 2}.exe ← Deleted afterwards
%User Temp%\{Random Characters 1}.exe ← Deleted afterwards

Download Routine

This Virus connects to the following website(s) to download and execute a malicious file:

http://{BLOCKED}.{BLOCKED}.{BLOCKED}.154/testo5/{Random Chararacters}
http://{BLOCKED}ustnet777.info/home.gif/{Random Chararacters}
http://{BLOCKED}ustnet888.info/home.gif/{Random Chararacters}
http://{BLOCKED}ustnet987.info/home.gif/{Random Chararacters}

Other Details

This Virus modifies the following registry entries to hide Hidden files:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = 2

It adds and runs the following services:

IpFilterDriver
ImagePath = %System%\drivers\ipfltdrv.sys

asmint32
ImagePath = %System%\drivers\{6 Random Character}.sys

It does the following:

It deletes all files with .exe file extensions in %User Temp% folder

SOLUTION

Minimum Scan Engine:

9.800

FIRST VSAPI PATTERN FILE:

18.467.00

FIRST VSAPI PATTERN DATE:

25 May 2023

VSAPI OPR PATTERN File:

18.467.00

VSAPI OPR PATTERN Date:

26 May 2023

Step 1

Trend Micro Predictive Machine Learning detects and blocks malware at the first sign of its existence, before it executes on your system. When enabled, your Trend Micro product detects this malware under the following machine learning name:

Troj.Win32.TRX.XXPE50FFF068

Step 2

Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.

Step 3

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 4

Restart in Safe Mode

[ Learn More ]

Step 5

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplication\List
- {Malware File Location}\{Malware File Name}.exe = {Malware File Location}\{Malware File Name}.exe:%s:*:Enabled:ipsec

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- AntiVirusOverride = 1
- AntiVirusDisableNotify = 1
- FirewallDisableNotify = 1
- FirewallOverride = 1
- UpdatesDisableNotify = 1
- UacDisableNotify = 1

In HKEY_CURRENT_USER\SOFTWARE\{Generated string from username}\{Generated number from username}
- {Random String 1} = 1
- {Random String 2} = 0
- {Random String 3} = 0
- {Random String 4} = 30
- {Random String 5} = 143
- {Random String 6} = {Random value}

To delete the registry value this malware/grayware created:

Open Registry Editor.
» For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
» For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2) users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>SharedAccess>Parameters>FirewallPolicy>StandardProfile>AuthorizedApplication>List
In the right panel, locate and delete the entry:
{Malware File Location}\{Malware File Name}.exe = {Malware File Location}\{Malware File Name}.exe:%s:*:Enabled:ipsec
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Security Center>Svc
In the right panel, locate and delete the entry:
AntiVirusOverride = 1
Again In the right panel, locate and delete the entry:
AntiVirusDisableNotify = 1
Again In the right panel, locate and delete the entry:
FirewallDisableNotify = 1
Again In the right panel, locate and delete the entry:
FirewallOverride = 1
Again In the right panel, locate and delete the entry:
UpdatesDisableNotify = 1
Again In the right panel, locate and delete the entry:
UacDisableNotify = 1
In the left panel, double-click the following:
HKEY_CURRENT_USER>SOFTWARE>{Generated string from username}>{Generated number from username}
In the right panel, locate and delete the entry:
{Random String 1} = 1
Again In the right panel, locate and delete the entry:
{Random String 2} = 0
Again In the right panel, locate and delete the entry:
{Random String 3} = 0
Again In the right panel, locate and delete the entry:
{Random String 4} = 30
Again In the right panel, locate and delete the entry:
{Random String 5} = 143
In the left panel, double-click the following:
HKEY_CURRENT_USER>SOFTWARE>{Generated string from username}>{Generated number from username} - {Random String 6}
In the right panel, locate and delete the entry:
{Random value} =
Close Registry Editor.

Step 6

Delete this registry key

[ Learn More ]

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- Svc
In HKEY_CURRENT_USER\SOFTWARE\{Generated string from username}
- {Generated number from username}
In HKEY_CURRENT_USER\SOFTWARE
- {Generated string from username}

Step 7

Restore this modified registry value

[ Learn More ]

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- AntiVirusOverride = 1
- AntiVirusDisableNotify = 1
- FirewallDisableNotify = 1
- FirewallOverride = 1
- UpdatesDisableNotify = 1
- UacDisableNotify = 1
In HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
- GlobalUsersOffline = 0
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
- EnableLUA = 0
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
- DoNotAllowExceptions = 0
- DisableNotifications = 1
- EnableFirewall = 0
In HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- Hidden = 2
In HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control
- Safeboot
In HKEY_CURRENT_USER\System\CurrentControlSet\Control
- Safeboot

Step 8

Disable this malware service

[ Learn More ]

asmint32

Step 9

Search and delete AUTORUN.INF files created by Virus.Win32.SALITY.RT that contain these strings

[ Learn More ]

Step 10

Search and delete these files

[ Learn More ]

There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.

%System%\drivers\{6 Random Characters}.sys
%User Temp%\{6 Random Characters}.exe
%System Root%\{Random Characters}.pif/.exe
{Available Drive Roots Except for CD-ROM Drives}\{Random Characters}.pif/.exe
%User Temp%\{Random Characters 1}.exe
%User Temp%\{Random Characters 2}.exe
%User Temp%\{Random Characters 3}.exe

Step 11

Restart in normal mode and scan your computer with your Trend Micro product for files detected as Virus.Win32.SALITY.RT. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Did this description help? Tell us how we did.

Virus.Win32.SALITY.RT

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

Virus.Win32.SALITY.RT

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

The Americas

Middle East & Africa

Europe

Asia & Pacific