About three weeks ago, I got some troubles with my laptop. This was after I plugged a USB 
FlashDisc into it. I clicked a random file in the USB Disc, stupid me, I didn't scan it before. As a result, there were 2 kinds of virus infected my laptop, the first one should still be considered as worm I guess. But the second one was a real threat to my laptop. It was SALITY !!!!
FlashDisc into it. I clicked a random file in the USB Disc, stupid me, I didn't scan it before. As a result, there were 2 kinds of virus infected my laptop, the first one should still be considered as worm I guess. But the second one was a real threat to my laptop. It was SALITY !!!! Indeed, this was also caused by my stupidity for neglecting the importance of AntiVirus. Hence, to avoid the same thing happens to you, guys, I suggest to use these AntiViruses :
Moreover, for you who often connect your PC or laptop to the internet. Those AntiViruses will be your PC/laptop's protectors from viruses' threat.
You might think that I'm just promoting others' products. Well yeah, I was also a person who was not really care about AntiViruses. But SALITY changed my mind afterwards.
Just to share you my experience, I worked hard to get rid of SALITY for the virus was really annoying me. With an assistance from a colleague, UCILELEK, I and him had to stay awake for the whole night, just to kill it
TEMPORARILY, as I thought it was solved but unfortunately appeared again and spread a massive threat just the day after. Damn !!! SALITY even ruined most of my Program masters and saved games. What a threat, ha?? Anyway, to answer my curiosity about SALITY, I managed to get more info about it. Here is what I found, just if you, guys, want to know more about it.
Continuing my previous post on SALITY VIRUS, here I would like to share some other facts about it which i just found.
=============================================================
Profile:
Name : Virus:W32/Sality.AA
Detection Names : Virus.Win32.Sality.aa
Win32.Sality.OG
Alias : W32.Sality.AE (Symantec)
Virus:Win32/Sality.AM (Microsoft)
Category : Malware
Type : virus
Platform : W32
===========================================================================Sality W32 is a typically program that secretly and maliciously integrates itself into program or data files. It spreads by integrating itself into more files each time the host program is run. It creates op1mutx9.
In registry modifications, Sality mutates these values:
===========================================================================• HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
GlobalUserOffline = 6684751
• HKLM\Software\Microsoft\Windows\CurrentVersion\policies\system
EnableLUA = 6422625
[Vista User Access Control Disabled]
• HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
[malware path] = [malware path]:*:Enabled:ipsec
[Windows Firewall Disabled]
• HKCU\Software\user914\1214104697
1919251317 = 3276857
• HKCU\Software\user914\1214104697
-456464662 = 3407926
• HKCU\Software\user914\1214104697
1462786655 = 3604530
• HKCU\Software\user914\1214104697
-912929324 = 3735602
• HKCU\Software\user914\1214104697
1006321993 = 3342390
• HKCU\Software\user914\1214104697
-1369393986 = 0600687474703A2F2F7777772E6D7573696B72616A742E736B2F6D61696E662E
67696600687474703A2F2F6D616365646F6E69612E6D79312E72752F6D61696E682E676966006874
74703A2F2F6A7273782E6A72652E6E65742E636E2F6C6F676F732E67696600687474
• HKCU\Software\user914\1214104697
549857331 = 865E52A75BF33F5D5AA15DAFA722193EDDA8540E6C496C04CF492EF296AFD1AFD
EDBC79CEA25E0F6F53B2D9CC0FA963F3A4CC745615E85AFE1E18AEA7E620D11174F3892E84
B5B5DD288784938E304B2D65C454E833D6AF929809110987E5B4B3E4D581071DA4948CB9F84
• HKCU\Software\user914
u1_0 = 655360
• HKCU\Software\user914
u2_0 = 655360
• HKCU\Software\user914
u3_0 = 655360
• HKCU\Software\user914
u4_0 = 655360
• HKLM\Software\Microsoft\Tracing\FWCFG
EnableFileTracing = 7471188
• HKLM\Software\Microsoft\Tracing\FWCFG
EnableConsoleTracing = 7471188
• HKLM\Software\Microsoft\Tracing\FWCFG
FileTracingMask = 7209065
• HKLM\Software\Microsoft\Tracing\FWCFG
ConsoleTracingMask = 7209065
• HKLM\Software\Microsoft\Tracing\FWCFG
MaxFileSize = 7077993
• HKLM\Software\Microsoft\Tracing\FWCFG
FileDirectory = %windir%\tracing
• HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
EnableFirewall = 7471209
[Windows Firewall Disabled]
• HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
DoNotAllowExceptions = 7340133
• HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden = 4718592
• HKCU\Software\Microsoft\Windows\CurrentVersion\policies\system
DisableTaskMgr = 6357076
[Task Manager Disabled]
• HKCU\Software\Microsoft\Windows\CurrentVersion\policies\system
DisableRegistryTools = 7929970
[Registry Editor Disabled]
• HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusOverride = 6619254
• HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusDisableNotify = 5111909
[Alerts for no Antivirus Disabled]
• HKLM\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify = 5111909
[Alerts for no Firewall Disabled]
• HKLM\SOFTWARE\Microsoft\Security Center
FirewallOverride = 6619254
• HKLM\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify = 5111909
[Alerts for no Windows-Updates Disabled]
• HKLM\SOFTWARE\Microsoft\Security Center
UacDisableNotify = 5111909
• HKLM\SOFTWARE\Microsoft\Security Center\Svc
AntiVirusOverride = 6619254
• HKLM\SOFTWARE\Microsoft\Security Center\Svc
AntiVirusDisableNotify = 5111909
[Alerts for no Antivirus Disabled]
• HKLM\SOFTWARE\Microsoft\Security Center\Svc
FirewallDisableNotify = 5111909
[Alerts for no Firewall Disabled]
• HKLM\SOFTWARE\Microsoft\Security Center\Svc
FirewallOverride = 6619254
• HKLM\SOFTWARE\Microsoft\Security Center\Svc
UpdatesDisableNotify = 5111909
[Alerts for no Windows-Updates Disabled]
• HKLM\SOFTWARE\Microsoft\Security Center\Svc
UacDisableNotify = 5111909
===========================================================================
In addtion, sality W32 is an appending file infector virus that uses an entry point obscuring technique to hide its presence on the system. What's sophisticated is that Sality has the ability to download and install additional malware on the system. Moreover, can also terminate the running AntiVirus program.
When Sality has infected your computer or laptop, [System]\drivers\[random].sys is dropped into the system and will be detected as Virus.Win32.Sality.ab.
Soon it will copy itself to removable drives and shared folders as one of the following :
• [randomname].exe• [randomname].pif
• [randomname].cmdt
After that Autorun.inf will be formed so that he malware will be executed when it is connected to a computer.
It also modifies %windir%\SYSTEM.INI by adding the following section :
• [MCIDRV_VER]DEVICE=[random alphanumeric string]
Once on the system, the virus searches the hard disk (starting with C:\) and infects any files with the following extensions:
• .exe• .scr
It also infects files with .EXE extensions that are referenced as data in the following registry keys:
• [HKCU\Software\Microsoft\Windows\CurrentVersion\run]
• [HLKM\Software\Microsoft\Windows\CurrentVersion\run]
The virus appends itself by creating a new 73728 bytes sized section named "[random characters]data". The section contains Sality.AA's obfuscated code.
When run, Sality.AA creates a mutex to ensure only one instance is running. It then modifies a large range of registry entries. The virus attempts to disable processes and services containing strings related to major antivirus software.
The malware connects to the following website to verify an Internet connection
• http://www.microsoft.com
The malware may connect to the following sites to download and execute additional malware :
• http://kukutrustnet777.info/[...].gif
• http://kukutrustnet888.info/[...].gif
• http://kukutrustnet987.info/[...].gif
• http://www.musikrajt.sk/[...].gif
• http://macedonia.my1.ru/[...].gif
• http://jrsx.jre.net.cn/[...].gif
• http://www.musikrajt.wz.cz/[...].gif
• http://www.solidarnosc.org.pl/lublin/[...].gif
• http://gotcha.goldeye.info/[...].gif
Downloaded files are encrypted. They are unencrypted by the malware to the %temp% folder and executed.
The following URLs may possibly be used to get further instructions:
• http://89.119.67.154/[...]/
• http://klkjwre77638dfqwieuoi888.[...]/
• http://kukutrustnet777888.[...]/
*** PS: I had to re-install my OS for SALITY had too much ruined my systems and programs
