Registrycleanerz

Have you noticed that today computer viruses are concealing around us everywhere: at home , at work, in the internet cafes? In relation to this fact data collected by Kaspersky Lab’s 2009 antivirus product presents details of malicious, advertising, and potentially unwanted programs found on users’ computers. It revealed that Win32/Sality.AA virus has been dominating for two months and alongside with Sality.z, making Sality one of the most widespread and dangerous families of the recent past. Sality spys on you and steals your banking information possibly a very large international bank robbery crime ring. The infection is created by some changes it makes to your system. You are able to identify this threat, but you should better avoid it.

Sality is a virus that encompasses backdoor capabilities and executes keylogger and is able to infect executable files by putting its code to host files.Being installed, Sality virus will infect local executable files and delete all files which are related to anti-virus and anti-spyware applications, firewalls as well. When executed, Win32/Sality.AA drops a malicious component file to:

%System%\drivers\.sys

This component being a device driver acts as a ‘rootkit’ at kernel level.Altogether, it enables the virus to hide itself in the compromised system by changing data structures in the kernel and hiding its malicious activity. Bear in mind that this ‘rootkit’ method can only function on Windows NT-based operating systems, like NT/2000/XP/2003.

Sality.AA also will add the following registry entry as a part of the device driver installation routine:

HKLM\SYSTEM\CurrentControlSet\Services\abp470n5

It adds the following text to the “system.ini” file which is located in the %Windows% directory:

[MCIDRV_VER]
DEVICEMB=

The virus can be recognized by the following registry key with a lot of random subkeys and entries which are required for its malicious routine:

HKCU\Software\<3 random numbers>

Then, Sality attempts to run a keylogging module that collects all system and network information, records passwords and login names, steals all sensitive information and sends all the data to a predefined email address. After that, Sality opens a backdoor which enables the remote attacker to get the full control over the infected computer and this places any financial or banking information stored on your computer in danger and provokes a serious security threat.

Remember, that this virus has the following aliases:

If you want to prevent your PC from danger, you should use a good malware remover to detect Sality and automatically remove Sality altogether with other spyware, adware, trojans, and virus threats that are hiding in your PC.

Resources:
The leading Win32/Sality.AA virus
Description of Win32/Sality
Understanding computer virus
Sality removal