PE_SALITY.ER

Infection Channel:

Infects files

This File infector modifies registry entries to disable various system services. This action prevents most of the system functions to be used.

It infects files by overwriting code in the entry point and saving the overwritten code in the virus body. It then appends the virus body to the host file.

It drops copies of itself in all removable and physical drives found in the system. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

File Size:

Varies

File Type:

PE

Memory Resident:

Yes

Initial Samples Received Date:

02 Nov 2010

Payload:

Disables services, Terminates processes, Downloads files

Arrival Details

This malware arrives via the following means:

It arrives as a file infected by PE_SALITY.ER-O.

Installation

This File infector injects codes into the following process(es):

EXPLORER.EXE

Other System Modifications

This File infector adds the following line(s)/entry(ies) in the SYSTEM.INI file:

[MCIDRV_VER]
DEVICEMB={random numbers}

It adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER\Software\Afukx

It modifies registry entries to disable the following system services:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess
Start = 4

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
Start = 4

(Note: The default value data of the said registry entry is 2.)

It modifies the following registry entries to hide files with Hidden attributes:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = 2

(Note: The default value data of the said registry entry is 1.)

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
{malware path and file name} = {malware path and file name}:*:Enabled:ipsec

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%WINDOWS%\Explorer.EXE = %WINDOWS%\Explorer.EXE:*:Enabled:ipsec

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Control\SafeBoot\Minimal

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Control\SafeBoot\Network

File Infection

This File infector infects the following file types:

EXE
SCR

It overwrites code found in the entry point of a target file. It then appends the virus body to the target file. The overwritten code is saved in the virus body.

It avoids infecting files that contain the following strings in their names:

DAEMON.
NOTEPAD.EXE
WINMINE.EXE

This is the Trend Micro detection for files infected by:

PE_SALITY.ER-O

Propagation

This File infector drops copies of itself in all removable and physical drives found in the system.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

;{garbage characters}
shell\open\command = {random}.exe/cmd/pif
shell\open\default = 1
;{garbage characters}
shell\autoplay\command = {random}.exe/cmd/pif
;{garbage characters}
Note: The order of autorun.inf strings may vary and may contain a combination of uppercase and lowercase letters.
;{garbage characters}
[AutoRun]
;{garbage characters}
shell\explore\command = {random}.exe/cmd/pif
;{garbage characters}
open = {random file name}.exe

Process Termination

This File infector terminates processes or services that contain any of the following strings if found running in the affected system's memory:

A2GUARD.
AAVSHIELD.
ADVCHK.
AHNSD.
AIRDEFENSE
ALERTSVC
ALOGSERV
ALSVC.
AMON.
ANTI-TROJAN.
ANTIVIR
APVXDWIN.
ARMOR2NET.
ASHAVAST.
ASHDISP.
ASHENHCD.
ASHMAISV.
ASHPOPWZ.
ASHSERV.
ASHSIMPL.
ASHSKPCK.
ASHWEBSV.
ASWUPDSV.
ATCON.
ATUPDATER.
ATWATCH.
AVAST
AVCENTER.
AVCIMAN.
AVCONSOL.
AVENGINE.
AVESVC.
AVGAMSVR.
AVGCC.
AVGCC32.
AVGCTRL.
AVGEMC.
AVGFWSRV.
AVGNT
AVGNT.
AVGNTDD
AVGNTMGR
AVGSERV.
AVGUARD.
AVGUPSVC.
AVINITNT.
AVKSERV.
AVKSERVICE.
AVKWCTL.
AVP32.
AVPCC.
AVPM.
AVSCHED32.
AVSERVER.
AVSYNMGR.
AVWUPD32.
AVWUPSRV.
AVXMONITOR9X.
AVXMONITORNT.
AVXQUAR.
BDMCON.
BDNEWS.
BDSUBMIT.
BDSWITCH.
BLACKD.
BLACKICE.
CAFIX.
CCAPP.
CCEVTMGR.
CCPROXY.
CCSETMGR.
CFIAUDIT.
CLAMTRAY.
CLAMWIN.
CLAW95.
CUREIT
DEFWATCH.
DRVIRUS.
DRWADINS.
DRWEB32W.
DRWEBSCD.
DRWEBUPW.
DWEBIO
DWEBLLIO
EKRN.
ESCANH95.
ESCANHNT.
EWIDOCTRL.
EZANTIVIRUSREGISTRATIONCHECK.
F-AGNT95.
F-SCHED.
F-STOPW.
FAMEH32.
FILEMON
FIRESVC.
FIRETRAY.
FIREWALL.
FPAVUPDM.
FRESHCLAM.
FSAV32.
FSAVGUI.
FSBWSYS.
FSDFWD.
FSGK32.
FSGK32ST.
FSGUIEXE.
FSMA32.
FSMB32.
FSPEX.
FSSM32.
GCASDTSERV.
GCASSERV.
GIANTANTISPYWAREMAIN.
GIANTANTISPYWAREUPDATER.
GUARDGUI.
GUARDNT.
HREGMON.
HRRES.
HSOCKPE.
HUPDATE.
IAMAPP.
IAMSERV.
ICLOAD95.
ICLOADNT.
ICMON.
ICSSUPPNT.
ICSUPP95.
ICSUPPNT.
IFACE.
INETUPD.
INOCIT.
INORPC.
INORT.
INOTASK.
INOUPTNG.
IOMON98.
ISAFE.
ISATRAY.
ISRV95.
ISSVC.
KAVMM.
KAVPF.
KAVPFW.
KAVSTART.
KAVSVC.
KAVSVCUI.
KMAILMON.
KPFWSVC.
MCAGENT.
MCMNHDLR.
MCREGWIZ.
MCUPDATE.
MCVSSHLD.
MINILOG.
MYAGTSVC.
MYAGTTRY.
NAVAPSVC.
NAVAPW32.
NAVLU32.
NAVW32.
NEOWATCHLOG.
NEOWATCHTRAY.
NISSERV
NISUM.
NMAIN.
NOD32
NORMIST.
NOTSTART.
NPAVTRAY.
NPFMNTOR.
NPFMSG.
NPROTECT.
NSCHED32.
NSMDTR.
NSSSERV.
NSSTRAY.
NTOS.
NTRTSCAN.
NTXCONFIG.
NUPGRADE.
NVCOD.
NVCTE.
NVCUT.
NWSERVICE.
OFCPFWSVC.
OP_MON.
OUTPOST
PAVFIRES.
PAVFNSVR.
PAVKRE.
PAVPROT.
PAVPROXY.
PAVPRSRV.
PAVSRV51.
PAVSS.
PCCGUIDE.
PCCIOMON.
PCCNTMON.
PCCPFW.
PCCTLCOM.
PCTAV.
PERSFW.
PERTSK.
PERVAC.
PNMSRV.
POP3TRAP.
POPROXY.
PREVSRV.
PSIMSVC.
QHONLINE.
QHONSVC.
QHWSCSVC.
RAVMON.
RAVTIMER.
RFWMAIN.
RTVSCAN.
RTVSCN95.
RULAUNCH.
SALITY
SAVADMINSERVICE.
SAVMAIN.
SAVPROGRESS.
SAVSCAN.
SCANNINGPROCESS.
SDHELP.
SDRA64.
SHSTAT.
SITECLI.
SPBBCSVC.
SPHINX.
SPIDERCPL.
SPIDERML.
SPIDERNT.
SPIDERUI.
SPYBOTSD.
SPYXX.
SS3EDIT.
STOPSIGNAV.
SWAGENT.
SWDOCTOR.
SWNETSUP.
SYMLCSVC.
SYMPROXYSVC.
SYMSPORT.
SYMWSC.
SYNMGR.
TAUMON.
TBMON.
TMAS.
TMLISTEN.
TMNTSRV.
TMPFW.
TMPROXY.
TNBUTIL.
TRJSCAN.
UP2DATE.
VBA32ECM.
VBA32IFS.
VBA32LDR.
VBA32PP3.
VBSNTW.
VCRMON.
VPTRAY.
VRFWSVC.
VRMONNT.
VRMONSVC.
VRRW32.
VSECOMR.
VSHWIN32.
VSMON.
VSSERV.
VSSTAT.
WATCHDOG.
WEBSCANX.
WEBTRAP.
WGFE95.
WINAW32.
WINROUTE.
WINSS.
WINSSNOTIFY.
WRCTRL.
XCOMMSVR.
ZAUINST
ZLCLIENT
ZONEALARM

Download Routine

This File infector accesses the following websites to download files:

http://{BLOCKED}mediaproduction.com/images/xs.jpg
http://{BLOCKED}e.co.uk/images/xs.jpg
http://{BLOCKED}rnajd.com/images/logo.gif
http://{BLOCKED}l.net/images/xs.jpg
http://{BLOCKED}oletarianparty.org/logof.gif
http://{BLOCKED}scapeuk.com/xs.jpg
http://{BLOCKED}so.com.br/s.jpg
http://{BLOCKED}rtltd.com/img/xs.jpg
http://{BLOCKED}monline.com/s.jpg
http://{BLOCKED}wing-tomorrow.org/images/s.jpg
http://{BLOCKED}.{BLOCKED}.222.206/logos.gif
http://{BLOCKED}icoverseas.net/images/xs2.jpg
http://{BLOCKED}o.cz/logo.gif
http://{BLOCKED}nhotel.com/images/logof.gif

NOTES:

This file infector drops the following copy of itself in all physical and removable drives:

{Drive Letter}:\{random file name}.{random extension}

Where {random extension} can be any of the following:

exe
cmd
pif

This file infector adds the following registry entries to disable Windows firewall and to lower Windows security settings:

HKEY_CURRENT_USER\Software\MicrosoftWindows\CurrentVersion\Internet Settings
GlobalUserOffline = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center
UpdatesDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center
UacDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center\Svc
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center\Svc
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center\Svc
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center\Svc
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center\Svc
UpdatesDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center\Svc
UacDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftWindows\CurrentVersion\policies\system
EnableLUA = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSetServices\SharedAccess\ParametersFirewallPolicy\StandardProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSetServices\SharedAccess\ParametersFirewallPolicy\StandardProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSetServices\SharedAccess\ParametersFirewallPolicy\StandardProfile
DisableNotifications = "1"

It appends the string below in the abovementioned URLs:

?{randomchars}={randomdigits}

It saves the downloaded files in %User Temp% folder using random file names.

It then executes the downloaded file. As a result, malicious routines of downloaded file are exhibited on the affected system.

Infection Routine

Before file infection, the malware does the following:

delete files with extension .VDB, .KEY and .AVC
deletes files with file names that start with 'drw'
deletes files with file names related to security applications

It then infects files in all drives including shared folders. However, it avoids infecting files inside folders containing the string "SYSTEM". It also avoids traversing the windows folder. It also avoids infecting files having file names with more than 250 characters.

Disable Service

It also stops and deletes the following AV-related services:

acssrv
Agnitum
Amon
AntiVir
AntiVirus
aswFsBlk
aswMon2
aswRdr
aswSP
aswTdi
aswUpdSv
Asynchronous
AV
avast!
AVG
Avira
BackWeb Plug-in - 4476822
BGLiveSvc
BlackICE
CAISafe
ccEvtMgr
ccProxy
ccSetMgr
Client
cmdAgent
cmdGuard
COMODO
Control
Core
Definition
Driver
E-mail
Engine
Eset
F-Prot
F-Secure
File
Firewall
for
FS
fsbwsys
FSDFWD
Gatekeeper
Google
Guard
Handler
HTTP
iAVS4
InoRPC
InoRT
InoTask
ISSVC
LavasoftFirewall
LC
LIVESRV
Mail
MailGuard
main
McAfeeFramework
McShield
McTaskManager
module
monitor
navapsvc
NOD32krn
NPFMntor
NSCService
NT
Online
Outpost
OutpostFirewall
Password
PAVFIRES
PAVFNSVR
PavProt
PavPrSrv
PAVSRV
PcCtlCom
Personal
PersonalFirewal
Premium
PREVSRV
Pro
Protection
ProtoPort
PSIMSVC
RapApp
Sandbox
SavRoam
Scanner
Security
Self
Server
service
Services
SmcService
SNDSrvc
SPBBCSvc
SpIDer
SPIDERNT
Starter
Symantec
System
tcpsr
Tmntsrv
TmPfw
tmproxy
UmxAgent
UmxCfg
UmxLU
UmxPol
Update
Validation
Virus
vsmon
VSSERV
Watcher
Web
WebGuard
WebrootDesktopFirewallDataService
WebrootFirewall
Windows
XCOMM

Minimum Scan Engine:

9.200

VSAPI OPR PATTERN File:

9.818.08

VSAPI OPR PATTERN Date:

26 Mar 2013

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Identify and terminate files detected as PE_SALITY.ER

[ Learn More ]

Windows Task Manager may not display all running processes. In this case, please use a third-party process viewer, preferably Process Explorer, to terminate the malware/grayware/spyware file. You may download the said tool here.
If the detected file is displayed in either Windows Task Manager or Process Explorer but you cannot delete it, restart your computer in safe mode. To do this, refer to this link for the complete steps.
If the detected file is not displayed in either Windows Task Manager or Process Explorer, continue doing the next steps.

Step 3

Restore these modified registry values

[ Learn More ]

Important:Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator's help. You may also check out this Microsoft article first before modifying your computer's registry.

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: Hidden = 2
  To: Hidden = 1
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess
- From: Start = 4
  To: Start = 2
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc
- From: Start = 4
  To: Start = 2

Step 4

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry. Before you could do this, you must restart in Safe Mode. For instructions on how to do this, you may refer to this page If the preceding step requires you to restart in safe mode, you may proceed to edit the system registry.

In HKEY_CURRENT_USER\Software
- Afukx

Step 5

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
- GlobalUserOffline = 0
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- AntiVirusOverride = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- AntiVirusDisableNotify = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- FirewallDisableNotify = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- FirewallOverride = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- UpdatesDisableNotify = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- UacDisableNotify = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- AntiVirusOverride = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- AntiVirusDisableNotify = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- FirewallDisableNotify = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- FirewallOverride = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- UpdatesDisableNotify = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- UacDisableNotify = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
- EnableLUA = 0
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
- EnableFirewall = 0
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
- DoNotAllowExceptions = 0
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
- DisableNotifications = 1
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- {malware path and file name} = {malware path and file name}:*:Enabled:ipsec
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- %WINDOWS%\Explorer.EXE = %WINDOWS%\Explorer.EXE:*:Enabled:ipsec

To delete the registry value this malware/grayware created:

Open Registry Editor.
» For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
» For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
» For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings
In the right panel, locate and delete the entry:
GlobalUserOffline = 0
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Security Center
In the right panel, locate and delete the entry:
AntiVirusOverride = 1
Again In the right panel, locate and delete the entry:
AntiVirusDisableNotify = 1
Again In the right panel, locate and delete the entry:
FirewallDisableNotify = 1
Again In the right panel, locate and delete the entry:
FirewallOverride = 1
Again In the right panel, locate and delete the entry:
UpdatesDisableNotify = 1
Again In the right panel, locate and delete the entry:
UacDisableNotify = 1
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Security Center>Svc
In the right panel, locate and delete the entry:
AntiVirusOverride = 1
Again In the right panel, locate and delete the entry:
AntiVirusDisableNotify = 1
Again In the right panel, locate and delete the entry:
FirewallDisableNotify = 1
Again In the right panel, locate and delete the entry:
FirewallOverride = 1
Again In the right panel, locate and delete the entry:
UpdatesDisableNotify = 1
Again In the right panel, locate and delete the entry:
UacDisableNotify = 1
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>system
In the right panel, locate and delete the entry:
EnableLUA = 0
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>SharedAccess>Parameters>FirewallPolicy>StandardProfile
In the right panel, locate and delete the entry:
EnableFirewall = 0
Again In the right panel, locate and delete the entry:
DoNotAllowExceptions = 0
Again In the right panel, locate and delete the entry:
DisableNotifications = 1
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>SharedAccess>Parameters>FirewallPolicy>StandardProfile>AuthorizedApplications>List
In the right panel, locate and delete the entry:
{malware path and file name} = {malware path and file name}:*:Enabled:ipsec
Again In the right panel, locate and delete the entry:
%WINDOWS%\Explorer.EXE = %WINDOWS%\Explorer.EXE:*:Enabled:ipsec
Close Registry Editor.

Step 6

Search and delete AUTORUN.INF files created by PE_SALITY.ER that contain these strings

[ Learn More ]

;{garbage characters}
[AutoRun]
;{garbage characters}
shell\explore\command = {random}.exe/cmd/pif
;{garbage characters}
open = {random file name}.exe
;{garbage characters}
shell\open\command = {random}.exe/cmd/pif
shell\open\default = 1
;{garbage characters}
shell\autoplay\command = {random}.exe/cmd/pif
;{garbage characters}

To identify and delete AUTORUN.INF files created:

For Windows 2000, Windows XP, and Windows Server 2003:

Right-click the Start button then choose Search... or Find..., depending on the version of Windows you are running.
In the File name* input box, type:
AUTORUN.INF
In the Look in: drop-down list, select a drive, then press Enter.
Select the file, then open using Notepad.
Check if the following lines are present in the file:
;{garbage characters}
[AutoRun]
;{garbage characters}
shell\explore\command = {random}.exe/cmd/pif
;{garbage characters}
open = {random file name}.exe
;{garbage characters}
shell\open\command = {random}.exe/cmd/pif
shell\open\default = 1
;{garbage characters}
shell\autoplay\command = {random}.exe/cmd/pif
;{garbage characters}
If the lines are present, delete the file.
Repeat steps 3 to 6 for the remaining AUTORUN.INF files in other remaining removable drives.
Close Search Results.

*Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

For Windows Vista, Windows 7, Windows Server 2003, Windows 8, Windows 8.1, and Windows Server 2012:

Open a Windows Explorer window.
- For Windows Vista, 7, and Server 2008 users, click Start>Computer.
- For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen, then click File Explorer.
In the Search Computer/This PC input box, type:
AUTORUN.INF
Select the file, then open using Notepad.
Check if the following lines are present in the file:
;{garbage characters}
[AutoRun]
;{garbage characters}
shell\explore\command = {random}.exe/cmd/pif
;{garbage characters}
open = {random file name}.exe
;{garbage characters}
shell\open\command = {random}.exe/cmd/pif
shell\open\default = 1
;{garbage characters}
shell\autoplay\command = {random}.exe/cmd/pif
;{garbage characters}
If the lines are present, delete the file.
Repeat steps 3 to 5 for the remaining AUTORUN.INF files in other remaining removable drives.
Close Search Results.

Step 7

Remove the following string/s that this malware/grayware added to these system configuration files

[ Learn More ]

[MCIDRV_VER]
DEVICEMB={random numbers}

Step 8

Scan your computer with your Trend Micro product to clean files detected as PE_SALITY.ER. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 9

Restore files from backup Only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on your computer again.

Did this description help? Tell us how we did.

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Related Malware

資源

支援

關於趨勢科技

香港暨澳門辦事處

PE_SALITY.ER

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Related Malware

資源

支援

關於趨勢科技

香港暨澳門辦事處

美洲

中東及非洲

歐洲

亞太地區