PE_SALITY.ER

 Analysis by: Roland Marco Dela Paz
 Modified by: Michael Cabel

 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: File infector

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Infects files

This File infector modifies registry entries to disable various system services. This action prevents most of the system functions to be used.

It infects files by overwriting code in the entry point and saving the overwritten code in the virus body. It then appends the virus body to the host file.

It drops copies of itself in all removable and physical drives found in the system. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

  TECHNICAL DETAILS

File Size:

Varies

File Type:

PE

Memory Resident:

Yes

Initial Samples Received Date:

02 Nov 2010

Payload:

Disables services, Terminates processes, Downloads files

Arrival Details

This malware arrives via the following means:

  • It arrives as a file infected by PE_SALITY.ER-O.

Installation

This File infector injects codes into the following process(es):

  • EXPLORER.EXE

Other System Modifications

This File infector adds the following line(s)/entry(ies) in the SYSTEM.INI file:

  • [MCIDRV_VER]
  • DEVICEMB={random numbers}

It adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER\Software\Afukx

It modifies registry entries to disable the following system services:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess
Start = 4

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
Start = 4

(Note: The default value data of the said registry entry is 2.)

It modifies the following registry entries to hide files with Hidden attributes:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = 2

(Note: The default value data of the said registry entry is 1.)

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
{malware path and file name} = {malware path and file name}:*:Enabled:ipsec

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%WINDOWS%\Explorer.EXE = %WINDOWS%\Explorer.EXE:*:Enabled:ipsec

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Control\SafeBoot\Minimal

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Control\SafeBoot\Network

File Infection

This File infector infects the following file types:

  • EXE
  • SCR

It overwrites code found in the entry point of a target file. It then appends the virus body to the target file. The overwritten code is saved in the virus body.

It avoids infecting files that contain the following strings in their names:

  • DAEMON.
  • NOTEPAD.EXE
  • WINMINE.EXE

This is the Trend Micro detection for files infected by:

  • PE_SALITY.ER-O

Propagation

This File infector drops copies of itself in all removable and physical drives found in the system.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

;{garbage characters}
shell\open\command = {random}.exe/cmd/pif
shell\open\default = 1
;{garbage characters}
shell\autoplay\command = {random}.exe/cmd/pif
;{garbage characters}
Note: The order of autorun.inf strings may vary and may contain a combination of uppercase and lowercase letters.
;{garbage characters}
[AutoRun]
;{garbage characters}
shell\explore\command = {random}.exe/cmd/pif
;{garbage characters}
open = {random file name}.exe

Process Termination

This File infector terminates processes or services that contain any of the following strings if found running in the affected system's memory:

  • A2GUARD.
  • AAVSHIELD.
  • ADVCHK.
  • AHNSD.
  • AIRDEFENSE
  • ALERTSVC
  • ALOGSERV
  • ALSVC.
  • AMON.
  • ANTI-TROJAN.
  • ANTIVIR
  • APVXDWIN.
  • ARMOR2NET.
  • ASHAVAST.
  • ASHDISP.
  • ASHENHCD.
  • ASHMAISV.
  • ASHPOPWZ.
  • ASHSERV.
  • ASHSIMPL.
  • ASHSKPCK.
  • ASHWEBSV.
  • ASWUPDSV.
  • ATCON.
  • ATUPDATER.
  • ATWATCH.
  • AVAST
  • AVCENTER.
  • AVCIMAN.
  • AVCONSOL.
  • AVENGINE.
  • AVESVC.
  • AVGAMSVR.
  • AVGCC.
  • AVGCC32.
  • AVGCTRL.
  • AVGEMC.
  • AVGFWSRV.
  • AVGNT
  • AVGNT.
  • AVGNTDD
  • AVGNTMGR
  • AVGSERV.
  • AVGUARD.
  • AVGUPSVC.
  • AVINITNT.
  • AVKSERV.
  • AVKSERVICE.
  • AVKWCTL.
  • AVP32.
  • AVPCC.
  • AVPM.
  • AVSCHED32.
  • AVSERVER.
  • AVSYNMGR.
  • AVWUPD32.
  • AVWUPSRV.
  • AVXMONITOR9X.
  • AVXMONITORNT.
  • AVXQUAR.
  • BDMCON.
  • BDNEWS.
  • BDSUBMIT.
  • BDSWITCH.
  • BLACKD.
  • BLACKICE.
  • CAFIX.
  • CCAPP.
  • CCEVTMGR.
  • CCPROXY.
  • CCSETMGR.
  • CFIAUDIT.
  • CLAMTRAY.
  • CLAMWIN.
  • CLAW95.
  • CUREIT
  • DEFWATCH.
  • DRVIRUS.
  • DRWADINS.
  • DRWEB32W.
  • DRWEBSCD.
  • DRWEBUPW.
  • DWEBIO
  • DWEBLLIO
  • EKRN.
  • ESCANH95.
  • ESCANHNT.
  • EWIDOCTRL.
  • EZANTIVIRUSREGISTRATIONCHECK.
  • F-AGNT95.
  • F-SCHED.
  • F-STOPW.
  • FAMEH32.
  • FILEMON
  • FIRESVC.
  • FIRETRAY.
  • FIREWALL.
  • FPAVUPDM.
  • FRESHCLAM.
  • FSAV32.
  • FSAVGUI.
  • FSBWSYS.
  • FSDFWD.
  • FSGK32.
  • FSGK32ST.
  • FSGUIEXE.
  • FSMA32.
  • FSMB32.
  • FSPEX.
  • FSSM32.
  • GCASDTSERV.
  • GCASSERV.
  • GIANTANTISPYWAREMAIN.
  • GIANTANTISPYWAREUPDATER.
  • GUARDGUI.
  • GUARDNT.
  • HREGMON.
  • HRRES.
  • HSOCKPE.
  • HUPDATE.
  • IAMAPP.
  • IAMSERV.
  • ICLOAD95.
  • ICLOADNT.
  • ICMON.
  • ICSSUPPNT.
  • ICSUPP95.
  • ICSUPPNT.
  • IFACE.
  • INETUPD.
  • INOCIT.
  • INORPC.
  • INORT.
  • INOTASK.
  • INOUPTNG.
  • IOMON98.
  • ISAFE.
  • ISATRAY.
  • ISRV95.
  • ISSVC.
  • KAVMM.
  • KAVPF.
  • KAVPFW.
  • KAVSTART.
  • KAVSVC.
  • KAVSVCUI.
  • KMAILMON.
  • KPFWSVC.
  • MCAGENT.
  • MCMNHDLR.
  • MCREGWIZ.
  • MCUPDATE.
  • MCVSSHLD.
  • MINILOG.
  • MYAGTSVC.
  • MYAGTTRY.
  • NAVAPSVC.
  • NAVAPW32.
  • NAVLU32.
  • NAVW32.
  • NEOWATCHLOG.
  • NEOWATCHTRAY.
  • NISSERV
  • NISUM.
  • NMAIN.
  • NOD32
  • NORMIST.
  • NOTSTART.
  • NPAVTRAY.
  • NPFMNTOR.
  • NPFMSG.
  • NPROTECT.
  • NSCHED32.
  • NSMDTR.
  • NSSSERV.
  • NSSTRAY.
  • NTOS.
  • NTRTSCAN.
  • NTXCONFIG.
  • NUPGRADE.
  • NVCOD.
  • NVCTE.
  • NVCUT.
  • NWSERVICE.
  • OFCPFWSVC.
  • OP_MON.
  • OUTPOST
  • PAVFIRES.
  • PAVFNSVR.
  • PAVKRE.
  • PAVPROT.
  • PAVPROXY.
  • PAVPRSRV.
  • PAVSRV51.
  • PAVSS.
  • PCCGUIDE.
  • PCCIOMON.
  • PCCNTMON.
  • PCCPFW.
  • PCCTLCOM.
  • PCTAV.
  • PERSFW.
  • PERTSK.
  • PERVAC.
  • PNMSRV.
  • POP3TRAP.
  • POPROXY.
  • PREVSRV.
  • PSIMSVC.
  • QHONLINE.
  • QHONSVC.
  • QHWSCSVC.
  • RAVMON.
  • RAVTIMER.
  • RFWMAIN.
  • RTVSCAN.
  • RTVSCN95.
  • RULAUNCH.
  • SALITY
  • SAVADMINSERVICE.
  • SAVMAIN.
  • SAVPROGRESS.
  • SAVSCAN.
  • SCANNINGPROCESS.
  • SDHELP.
  • SDRA64.
  • SHSTAT.
  • SITECLI.
  • SPBBCSVC.
  • SPHINX.
  • SPIDERCPL.
  • SPIDERML.
  • SPIDERNT.
  • SPIDERUI.
  • SPYBOTSD.
  • SPYXX.
  • SS3EDIT.
  • STOPSIGNAV.
  • SWAGENT.
  • SWDOCTOR.
  • SWNETSUP.
  • SYMLCSVC.
  • SYMPROXYSVC.
  • SYMSPORT.
  • SYMWSC.
  • SYNMGR.
  • TAUMON.
  • TBMON.
  • TMAS.
  • TMLISTEN.
  • TMNTSRV.
  • TMPFW.
  • TMPROXY.
  • TNBUTIL.
  • TRJSCAN.
  • UP2DATE.
  • VBA32ECM.
  • VBA32IFS.
  • VBA32LDR.
  • VBA32PP3.
  • VBSNTW.
  • VCRMON.
  • VPTRAY.
  • VRFWSVC.
  • VRMONNT.
  • VRMONSVC.
  • VRRW32.
  • VSECOMR.
  • VSHWIN32.
  • VSMON.
  • VSSERV.
  • VSSTAT.
  • WATCHDOG.
  • WEBSCANX.
  • WEBTRAP.
  • WGFE95.
  • WINAW32.
  • WINROUTE.
  • WINSS.
  • WINSSNOTIFY.
  • WRCTRL.
  • XCOMMSVR.
  • ZAUINST
  • ZLCLIENT
  • ZONEALARM

Download Routine

This File infector accesses the following websites to download files:

  • http://{BLOCKED}mediaproduction.com/images/xs.jpg
  • http://{BLOCKED}e.co.uk/images/xs.jpg
  • http://{BLOCKED}rnajd.com/images/logo.gif
  • http://{BLOCKED}l.net/images/xs.jpg
  • http://{BLOCKED}oletarianparty.org/logof.gif
  • http://{BLOCKED}scapeuk.com/xs.jpg
  • http://{BLOCKED}so.com.br/s.jpg
  • http://{BLOCKED}rtltd.com/img/xs.jpg
  • http://{BLOCKED}monline.com/s.jpg
  • http://{BLOCKED}wing-tomorrow.org/images/s.jpg
  • http://{BLOCKED}.{BLOCKED}.222.206/logos.gif
  • http://{BLOCKED}icoverseas.net/images/xs2.jpg
  • http://{BLOCKED}o.cz/logo.gif
  • http://{BLOCKED}nhotel.com/images/logof.gif

NOTES:

This file infector drops the following copy of itself in all physical and removable drives:

  • {Drive Letter}:\{random file name}.{random extension}

Where {random extension} can be any of the following:

  • exe
  • cmd
  • pif

This file infector adds the following registry entries to disable Windows firewall and to lower Windows security settings:

HKEY_CURRENT_USER\Software\MicrosoftWindows\CurrentVersion\Internet Settings
GlobalUserOffline = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center
UpdatesDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center
UacDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center\Svc
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center\Svc
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center\Svc
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center\Svc
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center\Svc
UpdatesDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftSecurity Center\Svc
UacDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftWindows\CurrentVersion\policies\system
EnableLUA = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSetServices\SharedAccess\ParametersFirewallPolicy\StandardProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSetServices\SharedAccess\ParametersFirewallPolicy\StandardProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSetServices\SharedAccess\ParametersFirewallPolicy\StandardProfile
DisableNotifications = "1"

It appends the string below in the abovementioned URLs:

  • ?{randomchars}={randomdigits}

It saves the downloaded files in %User Temp% folder using random file names.

It then executes the downloaded file. As a result, malicious routines of downloaded file are exhibited on the affected system.

Infection Routine

Before file infection, the malware does the following:

  • delete files with extension .VDB, .KEY and .AVC
  • deletes files with file names that start with 'drw'
  • deletes files with file names related to security applications

It then infects files in all drives including shared folders. However, it avoids infecting files inside folders containing the string "SYSTEM". It also avoids traversing the windows folder. It also avoids infecting files having file names with more than 250 characters.

Disable Service

It also stops and deletes the following AV-related services:

  • acssrv
  • Agnitum
  • Amon
  • AntiVir
  • AntiVirus
  • aswFsBlk
  • aswMon2
  • aswRdr
  • aswSP
  • aswTdi
  • aswUpdSv
  • Asynchronous
  • AV
  • avast!
  • AVG
  • Avira
  • BackWeb Plug-in - 4476822
  • BGLiveSvc
  • BlackICE
  • CAISafe
  • ccEvtMgr
  • ccProxy
  • ccSetMgr
  • Client
  • cmdAgent
  • cmdGuard
  • COMODO
  • Control
  • Core
  • Definition
  • Driver
  • E-mail
  • Engine
  • Eset
  • F-Prot
  • F-Secure
  • File
  • Firewall
  • for
  • FS
  • fsbwsys
  • FSDFWD
  • Gatekeeper
  • Google
  • Guard
  • Handler
  • HTTP
  • iAVS4
  • InoRPC
  • InoRT
  • InoTask
  • ISSVC
  • LavasoftFirewall
  • LC
  • LIVESRV
  • Mail
  • MailGuard
  • main
  • McAfeeFramework
  • McShield
  • McTaskManager
  • module
  • monitor
  • navapsvc
  • NOD32krn
  • NPFMntor
  • NSCService
  • NT
  • Online
  • Outpost
  • OutpostFirewall
  • Password
  • PAVFIRES
  • PAVFNSVR
  • PavProt
  • PavPrSrv
  • PAVSRV
  • PcCtlCom
  • Personal
  • PersonalFirewal
  • Premium
  • PREVSRV
  • Pro
  • Protection
  • ProtoPort
  • PSIMSVC
  • RapApp
  • Sandbox
  • SavRoam
  • Scanner
  • Security
  • Self
  • Server
  • service
  • Services
  • SmcService
  • SNDSrvc
  • SPBBCSvc
  • SpIDer
  • SPIDERNT
  • Starter
  • Symantec
  • System
  • tcpsr
  • Tmntsrv
  • TmPfw
  • tmproxy
  • UmxAgent
  • UmxCfg
  • UmxLU
  • UmxPol
  • Update
  • Validation
  • Virus
  • vsmon
  • VSSERV
  • Watcher
  • Web
  • WebGuard
  • WebrootDesktopFirewallDataService
  • WebrootFirewall
  • Windows
  • XCOMM

  SOLUTION

Minimum Scan Engine:

9.200

VSAPI OPR PATTERN File:

9.818.08

VSAPI OPR PATTERN Date:

26 Mar 2013

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Identify and terminate files detected as PE_SALITY.ER

[ Learn More ]
  1. Windows Task Manager may not display all running processes. In this case, please use a third-party process viewer, preferably Process Explorer, to terminate the malware/grayware/spyware file. You may download the said tool here.
  2. If the detected file is displayed in either Windows Task Manager or Process Explorer but you cannot delete it, restart your computer in safe mode. To do this, refer to this link for the complete steps.
  3. If the detected file is not displayed in either Windows Task Manager or Process Explorer, continue doing the next steps.

Step 3

Restore these modified registry values

[ Learn More ]

Important:Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator's help. You may also check out this Microsoft article first before modifying your computer's registry.

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
    • From: Hidden = 2
      To: Hidden = 1
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess
    • From: Start = 4
      To: Start = 2
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc
    • From: Start = 4
      To: Start = 2

Step 4

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry. Before you could do this, you must restart in Safe Mode. For instructions on how to do this, you may refer to this page If the preceding step requires you to restart in safe mode, you may proceed to edit the system registry.

  • In HKEY_CURRENT_USER\Software
    • Afukx

Step 5

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
    • GlobalUserOffline = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • AntiVirusOverride = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • AntiVirusDisableNotify = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • FirewallDisableNotify = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • FirewallOverride = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • UpdatesDisableNotify = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • UacDisableNotify = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • AntiVirusOverride = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • AntiVirusDisableNotify = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • FirewallDisableNotify = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • FirewallOverride = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • UpdatesDisableNotify = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • UacDisableNotify = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
    • EnableLUA = 0
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
    • EnableFirewall = 0
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
    • DoNotAllowExceptions = 0
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
    • DisableNotifications = 1
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
    • {malware path and file name} = {malware path and file name}:*:Enabled:ipsec
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
    • %WINDOWS%\Explorer.EXE = %WINDOWS%\Explorer.EXE:*:Enabled:ipsec

Step 6

Search and delete AUTORUN.INF files created by PE_SALITY.ER that contain these strings

[ Learn More ]
 ;{garbage characters}
[AutoRun]
;{garbage characters}
shell\explore\command = {random}.exe/cmd/pif
;{garbage characters}
open = {random file name}.exe
;{garbage characters}
shell\open\command = {random}.exe/cmd/pif
shell\open\default = 1
;{garbage characters}
shell\autoplay\command = {random}.exe/cmd/pif
;{garbage characters}

Step 7

Remove the following string/s that this malware/grayware added to these system configuration files

[ Learn More ]
  • [MCIDRV_VER]
  • DEVICEMB={random numbers}

Step 8

Scan your computer with your Trend Micro product to clean files detected as PE_SALITY.ER. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 9

Restore files from backup Only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on your computer again.


Did this description help? Tell us how we did.

Related Malware