Virus ‘Mal/Sality-D’ is an entry-point obscuring polymorphic file infector. It will infect executable files on local, removable and remote shared drives. The virus also creates a peer-to-peer botnet and receives URLs of additional files to download. It then attempts to disable security software. The Virus ‘Mal/Sality-D’ family of threats has been around for some timeand may have originated in Russia. At that time, Virus ‘Mal/Sality-D’ was a less complicated file infector, prepending its viral code to a host file and having back door capability and keylogging functionality.
Virus ‘Mal/Sality-D’ will infect executable files on local, removable and remote shared drives. It replaces the original host code at the entry point of the executable to redirect execution to the polymorphic viral code, which has been encrypted and inserted in the last section of the host file. It spreads by infecting executable files on local, removable and remote shared drives. Infected files will have their original, initial instructions overwritten by complex code instructions with the encrypted viral code body located in the last section of the file.
Virus ‘Mal/Sality-D’ usually targets all files in drive C: that have .exe or .scr file extensions, beginning with the root folder, and injects its code into them. Infected files increase in size by a varying amount. Some Sality variants can infect legitimate files which are then moved to available removable drives and shared network folders. The Sality variant also creates an autorun.inf file in the root of all these drives that points to the infected file. When a drive is accessed from a PC supporting the Autorun feature, the file is launched automatically.
Virus ‘Mal/Sality-D’ commonly searches for and tries to end or close security applications, particularly antivirus and personal firewall programs. It tries to end or close security applications containing the same strings as the files it avoids infecting in the spreads via file infection section. The threat participates in a P2P botnet and receives URLs of additional files to download. Downloading and executing other malware or security risks is one of the primary goals of this virus. A compromised host carries with it a list of HTTP URLs that point to resources to be downloaded, decrypted, and executed. These URLs can also point to more URLs. The encryption used is RC4 with static keys embedded in the compromised host. Virus ‘Mal/Sality-D’ also attempts to disable security software and modify security configurations. It alters the safe mode functionality to ensure it remains on the compromised computer. To help hide its presence and ensure continuity of execution, it will inject itself into all running processes except processes that belong to the system, the local service or the network service.
How to Remove Virus ‘Mal/Sality-D’
Use the instructions below to automatically remove Virus ‘Mal/Sality-D’ and other malware, as well as automatically repair internet browser settings if needed.
Remove with Reason Core Security
Install the free version of Reason Core Security.
When the installation begins, you will see the Reason Core Security Setup which will guide you through the installation process.
Once installed, Reason Core Security will automatically start a quick "welcome" process. When this completes it will run an initial scan which should find this and all additional adware threats on your computer. When it finds it and the scan completes, you will be asked to run a quick or full scan.
After the scan you will see Virus ‘Mal/Sality-D’ and other malware, adware and PUPs Reason Core Security has detected. Check all items you want to remove and click the "Remove Checked" button.
Reason Core Security will now remove Virus ‘Mal/Sality-D’ and other malware it has found.
Remove with Malwarebytes Anti-Malware
Install the free or paid version of Malwarebytes Anti-Malware.
Once Malwarebytes is installed, run the program. If you are using the free version of Malwarebytes you will be prompted to update the database, please do so.
On the first tab labeled “Scanner” select the Perform full scan option and click the Scan button to perform a full system scan. Malwarebytes will automatically detect Virus ‘Mal/Sality-D’ and additional third-party malware infecting the computer system.
Once the malware scan is over, Malwarebytes will prompt a notice stating malicious objects were detected. Select the malicious objects and click the Remove Selected button to completely remove the malicious files from your computer
Ways to Prevent Virus ‘Mal/Sality-D’ Infections
Take the following steps to protect your PC from Virus ‘Mal/Sality-D’ and other viruses. Suggested tools and security programs within installed software helps prevent the same threats on your PC.
Install an effective anti-malware program
Your first line of defense would be an effective security program that provides real-time protection. We have a list of anti-malware programs that are tried and tested. It does not only scan files but also monitors your PC and blocks infections from occuring. Click on the link below to download our recommended anti-malware program.
» Download Protection Software
Always update your installed software
Software publishers constantly releases updates for programs whenever a flaw or security exploit is discovered. Getting these updates makes your computer more secured and help prevents Trojans, viruess, malware, and Virus ‘Mal/Sality-D’ similar threats. If in case your program is not set for automatic updatse, it usually offered from the publisher's web site, which you can download anytime.
Secure your web browser
It is becoming increasingly popular for attackers to compromise computers through vulnerable web browsers. An insecure web browser can lead to viruses being installed on your computer without your knowledge, attackers taking control of your computer, stealing your information, or even using your computer to attack other computers. We highly encourage you to maximize the setup to tighten the security of your browser. While making your browser more secure helps reduce the risk that someone will be able to use it to compromise your computer, it is still important to have safe computing habits so attackers get fewer chances to try. Don't click on unknown or unsolicited links or open unexpected attachments. Don't download files, programs or tools unless you are positive they are safe.
Apply full caution when using the Internet
The Internet is full of fraud, malware, scams and many forms of computer threats including Virus ‘Mal/Sality-D’. Implement full caution with links that you may receive from emails, social networking sites, and instant messaging programs. It might lead you to malicious sites that can cause harm to your computer. Avoid strange web sites that offer free services and software downloads as these downloaders typically bundle unwanted software that lead to virus infections.
No comments:
Post a Comment