Skip to main content
Skip to main content
Microsoft Security Intelligence
Cart 0 items in shopping cart
Sign in
Published Apr 26, 2010 | Updated Sep 15, 2017

Virus:Win32/Sality.AT

Detected by Microsoft Defender Antivirus

Aliases: W32/Sality.B.gen!Eldorado (Command) W32/Sality.AT (Avira) Win32/Sality.AA (CA) Win32.Sector.21 (Dr.Web) Win32/Sality.NBA (ESET) Trojan.Win32.Vilsel.vyy (Kaspersky) W32/Sality.gen.e (McAfee) W32/Sality.BD (Norman) W32/Spamta.QO.worm (Panda) Win32.KUKU.kj (Rising AV) Troj/SalLoad-A (Sophos) PE_SALITY.BA (Trend Micro)

Summary

Windows Defender detects and removes this threat.

This virus stops some security software and prevents some Windows utilities from running. It also tries to download other files, including other malware, from a remote server.

It spreads by infecting Windows files and copying itself to removable and remote drives.

Find out ways that malware can get on your PC.

Use the following free Microsoft software to detect and remove this threat:

You should also run a full scan. A full scan might find other, hidden malware.

To recover your affected files you might need to re-install the affected software.

Disable Autorun

This threat tries to use the Windows Autorun function to spread via removable drives, like USB flash drives. You can disable Autorun to prevent worms from spreading:

Scan removable drives

Remember to scan any removable or portable drives. If you have Microsoft security software, see this topic on our software help page:

Enable the registry editor

This threat might prevent Registry Editor from running. To let the Registry Editor to run, follow these steps:

  1. Click Start then Run and type cmd to run a command prompt.
  2. In the command prompt, type the following and press Enter:
    reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
  3. Type exit.
Recovering from recurring infections on a network

You might need to take the following steps to completely remove this threat from an infected network, and to stop infections from recurring from this and other similar types of network-spreading malware:

  1. Ensure that an antivirus product is installed on all PCs connected to the network that can access or host shares.
  2. Ensure that all available network shares are scanned with an up-to-date antivirus product.
  3. Restrict permissions as appropriate for network shares on your network. Use access control to restrict who can use files.
  4. Remove any unnecessary network shares or mapped drives.

It might also be necessary to temporarily change the permission on network shares to read-only until the disinfection process is complete.

Remove program exceptions in the firewall

This threat might add itself to your Windows Firewall exception list. This means it can go online without being blocked. To remove it from the exception list, do the following:

For Windows 8 :

  1. Open Windows Firewall by swiping in from the right edge of the screen, tapping Search (or if you're using a mouse, pointing to the upper-right corner of the screen, moving the mouse pointer down, and then clicking Search), entering firewall in the search box, tapping or clicking Settings, and then tapping or clicking Windows Firewall.
  2. In the left pane, tap or click let an app or feature through Windows Firewall.
  3. Tap or click Change settings. You might be asked for an admin password or to confirm your choice.
  4. Select the check box next to the app you want to let, select the network types you want to let communication on, and then click OK.

For Windows 7:

  1. Click Start, select Control Panel, then System and Security.
  2. Select Windows Firewall.
  3. On the menu on the left, select let a program through Windows Firewall. If you're prompted, type the password or provide confirmation.
  4. Click Change Settings. If you're prompted, type the password or provide confirmation.
  5. Select <program name> from the list of leted programs and features. Click Remove.
  6. Click OK.

For Windows Vista:

  1. Click Start, select Control Panel, then Security Center.
  2. On the menu on the left, select Windows Firewall.
  3. On the menu on the left, select let a program through Windows Firewall. If you are prompted, type the password or provide confirmation.
  4. Select <program name> from the list of leted programs and features. Click Delete.
  5. Click OK.
Additional remediation instructions for this threat

This threat might make lasting changes to your PC's settings that won't be restored when it's cleaned. The following steps can help change these settings back to what you want:

Follow us