Win32/Sality [Threat Name] go to Threat

Win32/Sality.NAJ [Threat Variant Name]

Win32/Sality.NAJ is a polymorphic file infector. It is able to spread via shared folders.

The following file is dropped into the %windir% folder:

The library is loaded and injected in all processes.

The following Registry entry is set:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
- "GlobalUserOffline" = 0

The virus modifies the following file:

The virus infects files referenced by the following Registry entries:

This causes the virus to be executed on every system start.

The virus searches for executables on local drives.

The virus also searches for executables in shared folders of remote machines.

Infection is attempted only if an executable is not in a folder that contains one of the following strings in the name:

Several other criteria are applied when choosing a file to infect.

Files are infected by adding a new section that contains the virus .

The size of the inserted code is 20480 B .

The virus deletes files with the following extensions:

The virus deletes executable files, that contain one of the following strings in the name:

The following programs are terminated:

The virus tries to download and execute several files from the Internet.