W32.Sality – Computer Virus

 

Computer virus is a program with included, hidden features in its script – harmful to the computer system. There is many different types of viruses and many different strains within each type with possible mutations before, during or after the infection.

Virus On Computer – Principle of Operation

W32.Sality computer viruses are in the family of W32.Sality polymorphic viruses. They can modify their own code decryption during subsequent infections every single file, which greatly hinders their detection by antivirus programs.

Infection occurs by running an infected file. Once the file containing malicious code is installed on your computer, it will prevent normal operation of the computer user and will block access to selected programs. This reduces significantly the ability to detect and remove it by the user while working on an infected Windows system.

Characteristics Of This Types Of Computer Virus

This Types Of Computer Virus infects files: EXE and. SCR with sizes up to 40MB. Can spread resources infecting network drives, as well as popular flash drives by adding the virus to run the startup file autorun.inf. Its most painful ability is to block access to the Windows Registry Editor Regedit and Task Manager taskmgr. Here is a list of their destructive procedures installed as a windows service in the system to guard against their removal from the memory and the hard drive by adding an entry in the following registry key:

HKLM \ SYSTEM \ CurrentControlSet \ Services \ abp470n5
(Abp470n5 sample depends on the variety name of the virus)

HKLM \ Software \ name_computer3_random_characters

and adds an entry in the system.ini file:

[MCIDRV_VER]
DEVICEMB = random number value

W32.Sality – Attempts to Connect To The Infected Pages and Download other Malware Such as Trojan & Adware

Examples of addresses of the parties:

http://klkjwre77638dfqwieuoi888.info

http://kukutrustnet777888.info

http://www.klkjwre9fqwieluoi.info

Deletes files with extensions. VDB and. AVC

Modifies registry keys in order to weaken the built Windows Security :

HKLM \ SOFTWARE \ Microsoft \ Security Center \ AntiVirusOverride = dword: 00000001
HKLM \ SOFTWARE \ Microsoft \ Security Center \ AntiVirusDisableNotify = dword: 00000001
HKLM \ SOFTWARE \ Microsoft \ Security Center \ FirewallDisableNotify = dword: 00000001
HKLM \ SOFTWARE \ Microsoft \ Security Center \ FirewallOverride = dword: 00000001
HKLM \ SOFTWARE \ Microsoft \ Security Center \ UpdatesDisableNotify = dword: 00000001
HKLM \ SOFTWARE \ Microsoft \ Security Center \ UacDisableNotify = dword: 00000001
HKLM \ SOFTWARE \ Microsoft \ Security Center \ Svc \ AntiVirusOverride = dword: 00000001
HKLM \ SOFTWARE \ Microsoft \ Security Center \ Svc \ AntiVirusDisableNotify = dword: 00000001
HKLM \ SOFTWARE \ Microsoft \ Security Center \ Svc \ FirewallDisableNotify = dword: 00000001
HKLM \ SOFTWARE \ Microsoft \ Security Center \ Svc \ FirewallOverride = dword: 00000001
HKLM \ SOFTWARE \ Microsoft \ Security Center \ Svc \ UpdatesDisableNotify = dword: 00000001
HKLM \ SOFTWARE \ Microsoft \ Security Center \ Svc \ UacDisableNotify = dword: 00000001
HKLM \ SYSTEM \ CurrentControlSet \ Services \ SharedAccess \ Parameters \ FirewallPolicy \ StandardProfile \ AuthorizedApplications \ List \ “” = “: *: Enabled: ipsec”
HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System \ EnableLUA = 0
HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Internet Setting \ GlobalUserOffline = 0
HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System \ DisableTaskMgr = dword: 00000001
HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System \ DisableRegistryTools = dword: 00000001

W32.Sality – Turns Off the Display of Hidden Files by Windows Explorer:

HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \ Hidden = 2
disables firewall service system and services of popular security programs:

Agnitum Client Security Service
Amon monitor ALG
aswUpdSv
aswMon2
aswRdr
aswSP
aswTdi
aswFsBlk
acssrv
AV Engine
avast!
iAVS4
Control Service
avast! Antivirus
avast! Mail Scanner
avast! Web Scanner
avast! Asynchronous Virus Monitor
avast! Self Protection
AVG Email Scanner
Avira AntiVir Premium Guard
Avira AntiVir Premium WebGuard
Avira AntiVir Premium MailGuard avp1
BackWeb Plug-in – 4476822
bdss
BGLiveSvc
BlackICE
CAISafe
ccEvtMgr
ccProxy
ccSetMgr
Eset Service
Eset HTTP Server
Eset Personal Firewall
F-Prot Antivirus Update Monitor
fsbwsys
FSDFWD
F-Secure Gatekeeper Handler Starter
FSMA
Google Online Services
InoRPC
InoRT
InoTask
ISSVC
KPF4
KLIF
LavasoftFirewall
LIVESRV McAfeeFramework McShield
McTaskManager
navapsvc
NOD32krn
NPFMntor
NSCService
Outpost Firewall main module
OutpostFirewall
PAVFIRES
PAVFNSVR
PavProt
PavPrSrv
PAVSRV
PcCtlCom
PersonalFirewal
PREVSRV
ProtoPort Firewall service
PSIMSVC RapApp
SmcService
SNDSrvc
SPBBCSvc
SpIDer FS Monitor for Windows NT
SpIDer Guard File System Monitor
SPIDERNT
Symantec Core LC
Symantec Password Validation
Symantec AntiVirus Definition Watcher
SavRoam Symantec AntiVirus
Tmntsrv
TmPfw
tmproxy
tcpsr
UmxAgent
UmxCfg
UmxLU
UmxPol
vsmon
VSSERV
WebrootDesktopFirewallDataService
WebrootFirewall
XCOMM
AVP

W32.Sality – Stops the Processes and Deletes Files Security Programs:

_AVPM.
A2GUARD.
AAVSHIELD.
AVAST
ADVCHK.
AHNSD.
AirDefense
ALERTSVC
ALOGSERV
ALSVC.
AMON.
ANTI-TROJAN.
AntiVir
APVXDWIN.
Armor2Net.
ASHAVAST.
ASHDISP.
ASHENHCD.
ASHMAISV.
ASHPOPWZ.
ASHSERV.
ASHSIMPL.
ASHSKPCK.
ASHWEBSV.
ASWUPDSV.
ATCON.
ATUPDATER.
ATWATCH.
AVCIMAN.
AVCONSOL.
AVENGINE.
AVESVC.
AVGAMSVR.
AVGCC.
AVGCC32.
AVGCTRL.
AVGEMC.
AVGFWSRV.
AVGNT.
AVGNTDD
AVGNTMGR
AVGSERV.
AVGUARD.
AVGUPSVC.
AVINITNT.
AVKSERV.
AVKSERVICE.
AVKWCTL.
AVP32.
AVPCC.
AVPM.
AVAST
AVSERVER.
AVSCHED32.
AVSYNMGR.
AVWUPD32.
AVWUPSRV.
AVXMONITOR9X.
AVXMONITORNT.
AVXQUAR.
BDMCON.
BDNEWS.
BDSUBMIT.
BDSWITCH.
Blackd.
BlackICE.
CAFIX.
CCAPP.
CCEVTMGR.
CCPROXY.
CCSETMGR.
CFIAUDIT.
CLAMTRAY.
ClamWin.
CLAW95.
CureIt
DEFWATCH.
DRVIRUS.
DRWADINS.
DRWEB32W.
DRWEBSCD.
DRWEBUPW.
DWEBLLIO
DWEBIO
ESCANH95.
ESCANHNT.
EWIDOCTRL.
EZANTIVIRUSREGISTRATIONCHECK.
F-AGNT95.
FAMEH32.
FILEMON
FIRESVC.
FireTray.
FIREWALL.
FPAVUPDM.
F-PROT95.
Freshclam.
EKRN.
FSAV32.
FSAVGUI.
FSBWSYS.
F-SCHED.
FSDFWD.
FSGK32.
FSGK32ST.
FSGUIEXE.
FSMA32.
FSMB32.
FSPEX.
FSSM32.
F-STOPW.
GCASDTSERV.
GCASSERV.
GIANTANTISPYWAREMAIN.
GIANTANTISPYWAREUPDATER.
GUARDGUI.
GUARDNT.
HREGMON.
HRRES.
HSOCKPE.
HUPDATE.
IAMAPP.
IAMSERV.
ICLOAD95.
ICLOADNT.
ICMON.
ICSSUPPNT.
ICSUPP95.
ICSUPPNT.
IFACE.
INETUPD.
INOCIT.
INORPC.
INORT.
INOTASK.
INOUPTNG.
IOMON98.
ISAF.
ISATRAY.
ISRV95.
ISSVC.
KAVMM.
KAVPF.
KAVPFW.
KAVSTART.
KAVSVC.
KAVSVCUI.
KMAILMON.
KPFWSVC.
MCAGENT.
MCMNHDLR.
MCREGWIZ.
MCUPDATE.
MCVSSHLD.
Minilog.
MYAGTSVC.
MYAGTTRY.
NAVAPSVC.
NAVAPW32.
NAVLU32.
NAVW32.
NOD32
NEOWATCHLOG.
NEOWATCHTRAY.
NISSERV
NISUM.
NMAIN.
NOD32
NORMIST.
NOTSTART.
NPAVTRAY.
NPFMNTOR.
NPFMSG.
NPROTECT.
NSCHED32.
NSMDTR.
NSSSERV.
NSSTRAY.
NTRTSCAN.
NTOS.
NTXCONFIG.
NUPGRADE.
NVCOD.
NVCTE.
NVCUT.
NWSERVICE.
OFCPFWSVC.
OUTPOST
OP_MON.
PAVFIRES.
PAVFNSVR.
PAVKRE.
PAVPROT.
PAVPROXY.
PAVPRSRV.
PAVSRV51.
PAVSS.
PCCGUIDE.
PCCIOMON.
PCCNTMON.
PCCPFW.
PCCTLCOM.
PCTAV.
PERSFW.
PERTSK.
PERVAC.
PNMSRV.
POP3Trap.
POPROXY.
PREVSRV.
PSIMSVC.
QHM32.
QHONLINE.
QHONSVC.
QHPF.
QHWSCSVC.
RAVMON.
RAVTIMER.
AVGNT
AVCENTER.
RFWMAIN.
RTVSCAN.
RTVSCN95.
RULAUNCH.
SAVADMINSERVICE.
SAVMAIN.
SAVPROGRESS.
SAVSCAN.
SCANNINGPROCESS.
CureIt
SDHELP.
SHSTAT.
SITECLI.
SPBBCSVC.
SPHINX.
SPIDERCPL.
SPIDERML.
SPIDERNT.
SPIDERUI.
SPYBOTSD.
SPYXX.
SS3EDIT.
STOPSIGNAV.
SWAGENT.
SWDOCTOR.
SWNETSUP.
SYMLCSVC.
SYMPROXYSVC.
SYMSPORT.
SYMWSC.
SYNMGR.
TAUMON.
TBMON.
AVAST
TFAK.
THAV.
THSM.
TMAS.
TMLISTEN.
TMNTSRV.
TMPFW.
TMPROXY.
TNBUTIL.
TRJSCAN.
Up2date.
VBA32ECM.
VBA32IFS.
VBA32LDR.
VBA32PP3.
VBSNTW.
VCHK.
VCRMON.
VETTRAY.
VIRUSKEEPER.
VPTRAY.
VRFWSVC.
VRMONNT.
VRMONSVC.
VRRW32.
VSECOMR.
VSHWIN32.
Vsmon.
VSSERV.
VSSTAT.
WATCHDOG.
WebProxy.
WEBSCANX.
WEBTRAP.
WGFE95.
WINAW32.
WinRoute.
WINSS.
WINSSNOTIFY.
WRCTRL.
XCOMMSVR.
ZAUINST
ZLCLIENT
ZoneAlarm

Filters also have access to selected developer’s virus scripts to impede the collection of tools, or describe its activity:

upload_virus
Sality-remove
virusinfo.
CureIt.
drweb.
onlinescan.
spywareinfo.
ewido.
VirusScan.
windowsecurity.
spywareguide.
BitDefender.
pandasoftware.
agnmitum.
VirusTotal.
sophos.
TrendMicro.
etrust.com
symantec.
mcafee.
f-secure.
eset.com
kaspersky

Recommended Action

Delete the computer virus file before it will become active and introduce into the system other malicious software that requires dedicated and complex handling procedures.
The best way is to use top antivirus software tool. There is nothing right now that can compare in its effectivnes to BitDefender.

Email Virus Technology – Email And Spam – Security And Our Kids

 

High Tech! Is It a Good Thing?
Our world nowadays changes quickly and subtly, sometimes without you noticing it. Scientists are in a constant search of creating gadgets that would make the life of human race easier and more convenient. The bad guys use increasingly better email virus technology to take advantage of us and our kids. Almost everything that you see around you are products of technology, designed and created to fit the needs, good or bad of us humans.

Email Viruses v.s. Email Messaging

The ease of access to internet can be regarded as one of the best products of our Scientists’ brilliant ideas and wide imaginations. They were able to connect people from different races who are thousands of miles away from each other. Through email technology, family that were separated to earn a living never felt like they are half-the-world away from those people they value the

most. Email is one of the most used features of internet, a modern time’s version of letters, cards and the likes, delivered in no time at no cost.

Email technology, also enables businesses from different corners of the world to contact their potential clients. However, it is true that every single thing that was created artificially in this world has two sides – the GOOD, which is the reason why it was created in the first place and the BAD, (email viruses), which usually comes out later as a byproduct of human abuse.

Can Email Virus Get to Our Kids?

Many parents are alarmed because of the undeniable harm the internet may bring to their kids who may be quickly convinced by an enticing looking cartoon characters, colorful fonts and other attractive objects, not resembling an email virus, but often found in our inbox and used as a means of entering our computer system and compromising it in minutes. If you think that this would be the worst that ever could happened to you, the answer is – no, because the personal and financial information stolen can cause you irreparable damage and loss for years to come.

What Is Parent To Do?

Since you cannot always keep an eye on your kids, avoiding this problem can be very challenging. So, what can you do? The best thing that you can do right now is to keep all your incoming email and spam away from your computer. Yes, it is very possible to do this now-days with the help of a email antivirus
software, developed by a company in New Zealand. This software is easy to use and helps you keep away spam email and harmful attachments. This kind of email security tool will make you and your family feel at ease that everything that is clicked, visited or downloaded by your kids is scanned or quarantined.

Is There A Solution To An Email Security Problem?

Email antivirus software is like your shield from the online world, knocking at your door. It protects your family and the kids from being inundated with harmful and undesirable data. As a responsible computer owner and a parent, be aware of the threats to your family and avoid digital waste that can seriously impact your lifestyle. Online world is only harmful when you don’t know how to keep yourself and your family away from harm. A  solution to the email security problem, you will really like is here.

14 Ways to Online Security

 

We all know that online security is crucial. Whether we hear about it or not, bad things are happening constantly in digital space. Things like cyber bullying, a transaction gone bad or a relationship ended up tragically. Most crimes however are about malicious programming scripts. Here you will find proven methods, that will allow you to limit the danger, safely use your computer and surf you favorite sites on the net.

1. Remember to activate you firewall. The best option is the medium level of online security with options to set the rules. If you are not sure if you are able to handle the manual settings of the rules, then just choose medium to high level of security.

Antivirus and Antispyware Program – Really Important!

2. Install and activate a really good antivirus and antispyware program, a software that offers real protection in real time. One that comes to mind is an internationally leading security piece of software (hands down) called BitDefender.

3. Update your security software, as well as the virus and spyware definitions constantly. Does your security software do it automatically? Even a good free antivirus software usually doesn’t have that important functionality,

4. Don’t open files of unknown origin.

5. Don’t use websites of banks, email services or community portals without a current certificate.

Internet Security Software And Email Security Software

6. Don’t use non reputable publishing (ftp) and internet security software. It may be adding unwanted scripts to the websites’ source code.

7. Once in a while scan your computer and check your network processes – ask someone, who knows, if you can’t do it yourself. Sometimes a malicious scripts initiate their own internet connections, sending your passwords and other private information. Sometimes, especially if you use an inferior internet security software, a malicious script will find its way to your computer – you have to find it and remove it from your computer system.

8. Check files downloaded from internet by scanning them, even if they are looking harmless. No such thing, as being to careful in a digital realm.

9. Try limit you visits to the sites offering fantastic attractions, like free: money, movies, music or easy money through sending spam. Very often these types of sites contain computer virus, trojans and other digital threats!

10. If you have to go to a site that you’re not sure of, then use proxies gates.

11. Important rule involving your own online security: Do Not Leave you personal information on unchecked websites and services, when you’re absolutely not sure if this is visible to the third party.

12. Do not send through email anything of crucial importance.

13. Remember that no bank will send you an email, asking for your password or login information to verification purposes.

14.The last, but maybe the most important way to keep your computer safe is to get an email security software that will help you ensure that no harm will come to you through many innocent but deadly, self executing malicious emails. The one tool that stands out is Mailwasher.

The Most Common Hacker Attacks Based On The Open DLL Gaps

 

Open DLL Gaps – the inconsistencies occurring between the software and the operating system, making it vulnerable to Hacker Attacks

Access to the system
Through these gaps attackers gain access rights through already registered users and install malicious codes, such as Trojans.

Cross-side scripting (XSS)
Attacks by XSS vulnerabilities web applications they replace modules in the current session to capture a user’s logins or other related data.

Theft of information
Hackers can read through these gaps any confidential information such as logins, PIN numbers or documents.

Data Manipulation
Cyber criminals can change and read the information without full access to the system, such as SQL database.

DOS attacks
Attacks that consume extremely many system resources (eg memory or bandwidth) to crash the system or a single application.

Security Bypass
Using these vulnerabilities attackers circumvent security features of software, such as encrypted records or certificates confirming the identity of the e-bank.