Discovered:

June 4, 2003

Updated:

May 20, 2010 4:30:57 PM

Also Known As:

W32/Kookoo-A [Sophos]

Type:

Virus

Systems Affected:

Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

W32.Sality is an entry-point obscuring (EPO) polymorphic file infector. It will infect executable files on local, removable and remote shared drives. The virus also creates a peer-to-peer (P2P) botnet and receives URLs of additional files to download. It then attempts to disable security software.

Infection
W32.Sality will infect executable files on local, removable and remote shared drives. It replaces the original host code at the entry point of the executable to redirect execution to the polymorphic viral code, which has been encrypted and inserted in the last section of the host file.

In addition to infecting local and remotely shared executable files, W32.Sality will purposely search for specific registry subkeys to infect the executable files that run when Windows starts.


Download Kaspersky's Sality Killer Tool :
Sality Killer Download