| Malware name | Win32.Sality.Y | | Type | Virus | | Affected platform | Win32 | | Media-Type | application/executable | | MD5 checksum | 9B1A5040C460C4C21E757C9859FA4540 | | Static file | no | | Filesize | 172,543 Bytes | Alias names
(also known as) | | Sophos | W32/Sality-AM | | McAfee | W32/Sality.ag | | CA ETrust | Win32/Sality.AA |
| | Side effects | - Lowers security settings
- Registry modification
| | Propagation | - Local network
- Mapped network drives
|
|
Description:
Registry
The value of the following registry key is removed:
– [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot]
It creates the following entry in order to bypass the Windows XP firewall:
– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\List]
• "c:\\%filename%"="c:\\%filename%:*:Enabled:ipsec"
• "c:\windows\\system32\\ctfmon.exe"="c:\windows\\system32\\ctfmon.exe:*:Enabled:ipsec"
The following registry key is added:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system]
• "DisableTaskMgr"=dword:00000001
• "DisableRegistryTools"=dword:00000001
The following registry keys are changed:
– [HKLM\SOFTWARE\Microsoft\Security Center]
Old value:
• "AntiVirusDisableNotify"=dword:00000000
• "FirewallDisableNotify"=dword:00000000
• "UpdatesDisableNotify"=dword:00000000
• "AntiVirusOverride"=dword:00000000
• "FirewallOverride"=dword:00000000
New value:
• "AntiVirusDisableNotify"=dword:00000001
• "FirewallDisableNotify"=dword:00000001
• "UpdatesDisableNotify"=dword:00000001
• "AntiVirusOverride"=dword:00000001
• "FirewallOverride"=dword:00000001
• "UacDisableNotify"=dword:00000001
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
Old value:
• "Hidden"=dword:00000001
New value:
• "Hidden"=dword:00000002
