W32.Sality.AE

21 April 2008 Trojan 15 Comments

W32.Sality.AE is a Trojan that modifies Windows registry to add an entry so that it can bypass installed firewall programs. Another payload of the virus is to download and execute additional threats from a remote server. W32.Sality.AE will spread on computers by infecting executable files on local and remote drives. It is so harmful that it can delete files that belong to security programs.

Alias: TROJ_AGENT.XOO, W32/Sality.ae, Sality.AG, Win32/Sality.Z, W32/Sality.AA

Damage Level: Medium

Systems Affected: Windows 2000/Server, Windows NT, Windows XP, Windows Vista

Characteristics
If W32.Sality.AE is active on the computer, it may drop several files and create various registry entries. Then, the Trojan will create an auto-loading function by registering itself as a Windows service using the following data:
Service Name: WMI_MFC_TPSHOKER_80
Display Name: WMI_MFC_TPSHOKER_80
Startup Type: Automatic
To avoid conflicts with security applications, W32.Sality.AE will stop services that are related to security programs like anti-virus and firewall. To put an end to this software, all files that are process on the said services will be deleted. Moreover, access to various security web sites is blocked by the Trojan to prevent essential updates.

The Trojan also search and infects executable listed under the following subkey:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache

Distribution
W32.Sality.AE may spread through the Internet in various means. Typically, it infects a computer and gathers email address from the address book of victim. It is configured to mass-mail itself to these contacts with the Trojan attached. On a local settings, W32.Sality.AE will attach a copy of itself to removable devices using executable files like .EXE, .CMD, and .PIF. It also includes an autorun.inf file to initiate the Trojan each time the drive is accessed.

Added Registry Entries:

HKEY_CURRENT_USER\Software\[USER NAME]914
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WMI_MFC_TPSHOKER_80
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IPFILTERDRIVER
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\Firewall Policy\StandardProfile\AuthorizedApplications\List\"[INFECTED FILE]" 
= "[INFECTED FILE]:*:Enabled:ipsec"

Associated Files and Folders:

%System%\drivers\[RANDOM NAME].sys
%DriveLetter%:\[RANDOM NAME].exe
%DriveLetter%:\[RANDOM NAME].cmd
%DriveLetter%:\[RANDOM NAME].pif
%DriveLetter%:\autorun.inf

File Location for Windows Versions:

• %System% for all versions of Windows it is located under C:\Windows\System32

Restore Windows Components

During an infection, W32.Sality.AE drops various files. The worm intentionally hides system files by setting options in the registry. With these accomplishments, the best solution is to return Windows to previous working state is trough System Restore. If previous restore point is saved, you may proceed with Windows System Restore.

Manual Removal Procedure

1. If an anti-virus program is present, update the definition file. Each anti-virus program has its own way to update the database. Please refer to your software manufacturer’s manual.

2. Reboot Windows in Safe Mode to ensure that only minimal Windows components are loaded.
- After turning on the power of the computer, press F8 on your keyboard.
- It will display the Boot Options menu, select Safe Mode.

3. Run a full system scan and clean/delete all infected files related to Backdoor.Cycbot.

4. Delete or modify any values added by Backdoor.Cycbot to the registry if present. Please see the reference.
- To edit the registry, click on Start > Run and type regedit.exe in the field.
- Alternatively, you may press Windows Key + R on your keyboard to open the RUN command.

5. Exit registry editor when done. You may now restart the computer.

Removal Tool

A free removal tool from Norton Antivirus was developed to remove virus and unfamiliar threats without using the traditional AV signatures. Download the tool from this location and start scanning the computer for viruses and Trojans.