W32.Sality.AE

W32.Sality.AE is a Trojan that modifies Windows registry to add an entry so that it can bypass installed firewall programs. Another payload of the virus is to download and execute additional threats from remote server. W32.Sality.AE can spread on computers by infecting executable files on local and remote drives. It is so harmful that it can delete files it sense belonging to legitimate security programs.

Alias: TROJ_AGENT.XOO, W32/Sality.ae, Sality.AG, Win32/Sality.Z, W32/Sality.AA

Threat Assessment By: Symantec

Damage Level: Medium

Systems Affected: Windows 2000, Windows NT, Windows XP

How to Remove W32.Sality.AE:

FIRST AID TO STOP W32.Sality.AE:
If this virus have infected the system, registry and legitimate Windows files are also compromised. System Restore can reinstate clean system files by restoring the configuration to an earlier date. If a restore point was created before you got infected with W32.Sality.AE, please restore Windows to previous configuration.

MANUAL REMOVAL OF W32.Sality.AE:
1. Update installed anti-virus application to have the latest definition file.
2. Reboot Windows in Safe Mode
- After turning on the power, press F8 on the keyboard.
- Select Safe Mode from the menu.

3. Thoroughly scan the system and clean/delete all infected file(s). Please see below.
4. Delete/Modify any values added to the registry if present. Refer to associated Windows Registry Entries.
- Click on Start. Search or Run regedit.exe to begin registry editor.

Note: You may refer to links on sidebar for a complete tutorial on Safe Mode and Registry Editor.

5. Exit registry editor and restart Windows.

ADDITIONAL TOOLS AND PROGRAMS:

Scan with Norton Power Eraser:
A free removal tool from Norton Antivirus was developed to remove virus and unfamiliar threats without using the traditional AV signatures. Download the tool and start scanning with Norton Power Eraser.

Technical Details and Additional Information:

Other functionalities of this Virus:
- W32.Sality.AE registers itself as WMI_MFC_TPSHOKER_80 service under Windows.
- The virus will stop any running process that belongs to legitimate antivirus programs.
- It connects to an specified URL to get commands and downloads addition malicious files.

Malicious Files Added by W32.Sality.AE:
%System%\drivers\[RANDOM NAME].sys
%DriveLetter%:\[RANDOM NAME].exe
%DriveLetter%:\[RANDOM NAME].cmd
%DriveLetter%:\[RANDOM NAME].pif
%DriveLetter%:\autorun.inf

File Location for Windows Versions:

  • %System% for all versions of Windows it is located under C:\Windows\System32

Associated Windows Registry Entries:
HKEY_CURRENT_USER\Software\[USER NAME]914
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WMI_MFC_TPSHOKER_80
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IPFILTERDRIVER
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\Firewall Policy\StandardProfile\AuthorizedApplications\List\”[INFECTED FILE]” = “[INFECTED FILE]:*:Enabled:ipsec”