Skip to main content Threats Blogs Antimalware updates Definition change log Windows security Microsoft Defender ATP Microsoft Threat Protection Malicious Software Removal Tool (MSRT) Safety Scanner Microsoft Defender Offline Submit a file View submission history Report unsafe site Attack surface reduction Sources of infection Avoid tech support scams Troubleshoot detection and removal Up-to-date software Developer resources Threat naming Threat identification criteria Security industry alliances Microsoft Security Azure Dynamics 365 Microsoft 365 Microsoft Teams Windows 365 Microsoft AI Azure Space Mixed reality Microsoft HoloLens Microsoft Viva Quantum computing Sustainability Education Automotive Financial services Government Healthcare Manufacturing Retail Find a partner Become a partner Partner Network Microsoft Marketplace Software companies Blog Microsoft Advertising Developer Center Documentation Events Licensing Microsoft Learn Microsoft Research View Sitemap
Published Apr 26, 2010 | Updated Sep 15, 2017

Virus:Win32/Sality.AT

Detected by Microsoft Defender Antivirus

Aliases: W32/Sality.B.gen!Eldorado (Command) W32/Sality.AT (Avira) Win32/Sality.AA (CA) Win32.Sector.21 (Dr.Web) Win32/Sality.NBA (ESET) Trojan.Win32.Vilsel.vyy (Kaspersky) W32/Sality.gen.e (McAfee) W32/Sality.BD (Norman) W32/Spamta.QO.worm (Panda) Win32.KUKU.kj (Rising AV) Troj/SalLoad-A (Sophos) PE_SALITY.BA (Trend Micro)

Summary

Windows Defender detects and removes this threat.

This virus stops some security software and prevents some Windows utilities from running. It also tries to download other files, including other malware, from a remote server.

It spreads by infecting Windows files and copying itself to removable and remote drives.

Find out ways that malware can get on your PC.

Use the following free Microsoft software to detect and remove this threat:

You should also run a full scan. A full scan might find other, hidden malware.

To recover your affected files you might need to re-install the affected software.

Disable Autorun

This threat tries to use the Windows Autorun function to spread via removable drives, like USB flash drives. You can disable Autorun to prevent worms from spreading:

Scan removable drives

Remember to scan any removable or portable drives. If you have Microsoft security software, see this topic on our software help page:

Enable the registry editor

This threat might prevent Registry Editor from running. To let the Registry Editor to run, follow these steps:

  1. Click Start then Run and type cmd to run a command prompt.
  2. In the command prompt, type the following and press Enter:
    reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
  3. Type exit.
Recovering from recurring infections on a network

You might need to take the following steps to completely remove this threat from an infected network, and to stop infections from recurring from this and other similar types of network-spreading malware:

  1. Ensure that an antivirus product is installed on all PCs connected to the network that can access or host shares.
  2. Ensure that all available network shares are scanned with an up-to-date antivirus product.
  3. Restrict permissions as appropriate for network shares on your network. Use access control to restrict who can use files.
  4. Remove any unnecessary network shares or mapped drives.

It might also be necessary to temporarily change the permission on network shares to read-only until the disinfection process is complete.

Remove program exceptions in the firewall

This threat might add itself to your Windows Firewall exception list. This means it can go online without being blocked. To remove it from the exception list, do the following:

For Windows 8:

  1. Open Windows Firewall by swiping in from the right edge of the screen, tapping Search (or if you're using a mouse, pointing to the upper-right corner of the screen, moving the mouse pointer down, and then clicking Search), entering firewall in the search box, tapping or clicking Settings, and then tapping or clicking Windows Firewall.
  2. In the left pane, tap or click let an app or feature through Windows Firewall.
  3. Tap or click Change settings. You might be asked for an admin password or to confirm your choice.
  4. Select the check box next to the app you want to let, select the network types you want to let communication on, and then click OK.

For Windows 7:

  1. Click Start, select Control Panel, then System and Security.
  2. Select Windows Firewall.
  3. On the menu on the left, select let a program through Windows Firewall. If you're prompted, type the password or provide confirmation.
  4. Click Change Settings. If you're prompted, type the password or provide confirmation.
  5. Select <program name> from the list of leted programs and features. Click Remove.
  6. Click OK.

For Windows Vista:

  1. Click Start, select Control Panel, then Security Center.
  2. On the menu on the left, select Windows Firewall.
  3. On the menu on the left, select let a program through Windows Firewall. If you are prompted, type the password or provide confirmation.
  4. Select <program name> from the list of leted programs and features. Click Delete.
  5. Click OK.
Additional remediation instructions for this threat

This threat might make lasting changes to your PC's settings that won't be restored when it's cleaned. The following steps can help change these settings back to what you want:

Follow us
Surface Laptop Ultra Surface Pro Surface Laptop Surface RTX Spark Dev Box Explore Copilot Explore Microsoft products Windows 11 apps Account profile Download Center Microsoft Store support Returns Order tracking Certified Refurbished Why buy from Microsoft Store Flexible Payments Microsoft in education Devices for education Microsoft Teams for Education Microsoft 365 Education How to buy for your school Educator training and development Deals for students and parents AI for education
Microsoft AI Microsoft Security Dynamics 365 Microsoft 365 Microsoft Power Platform Microsoft Teams Microsoft Copilot Small Business Azure Microsoft Developer Microsoft Learn Support for AI marketplace apps Microsoft Tech Community Microsoft Marketplace Software companies Visual Studio Careers About Microsoft Company news Privacy at Microsoft Investors Diversity and inclusion Accessibility Sustainability
English (United States)
Your Privacy Choices Opt-Out Icon Your Privacy Choices
Consumer Health Privacy Sitemap Contact Microsoft Privacy Manage cookies Terms of use Trademarks Safety & eco Recycling About our ads