Virus Information: Win32.Sality.A

Name: W32/Sality.A
Type: File Virus (Corrupt Exe Viruses)
OS (Which can be effected by this virus)

• Windows 95
• Windows 98
• Windows NT
• Windows ME
• Windows 2000
• Windows 2003
• Windows XP

Effect On Machine:

1. Disable Firewall
2. Enable Telnet for exploition of Virus
3. Modifications on Registry

Following Registry Modifications takes place

• HKLM\SOFTWARE\Microsoft\Security Center\Svc • "AntiVirusOverride"=dword:00000001
  • "AntiVirusDisableNotify"=dword:00000001
  • "FirewallDisableNotify"=dword:00000001
  • "FirewallOverride"=dword:00000001
  • "UpdatesDisableNotify"=dword:00000001
  • "UacDisableNotify"=dword:00000001
• Various Explorer settings:
  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  Actual value:
  • "Hidden"=dword:00000001
  New value:
  • "Hidden"=dword:00000002
  
  DisAble Windows XP Firewall:
  HKLM\SOFTWARE\Microsoft\Security Center
  Old value:
  • "AntiVirusDisableNotify"=dword:00000000
  • "FirewallDisableNotify"=dword:00000000
  • "UpdatesDisableNotify"=dword:00000000
  • "AntiVirusOverride"=dword:00000000
  • "FirewallOverride"=dword:00000000
  • "UacDisableNotify"=dword:00000000
  New value:
  • "AntiVirusDisableNotify"=dword:00000001
  • "FirewallDisableNotify"=dword:00000001
  • "UpdatesDisableNotify"=dword:00000001
  • "AntiVirusOverride"=dword:00000001
  • "FirewallOverride"=dword:00000001
  • "UacDisableNotify"=dword:00000001
  
  for Disable Regedit and Task Manager:
  HKCU\Software\Microsoft\Windows\CurrentVersion\policies\system
  New value:
  • "DisableTaskMgr"=dword:00000001
  • "DisableRegistryTools"=dword:00000001