Virus.Win32.Sality_698548b517

by malwarelabrobot on August 17th, 2013 in Malware Descriptions.

Trojan.Win32.Patched.dj (Kaspersky), Virus.Win32.Sality.ah (v) (VIPRE), Trojan.Win32.Rozena!IK (Emsisoft), Trojan.NSIS.StartPage.FD, Virus.Win32.Sality.FD, Virus.Win32.Sality.2.FD, VirusSality.YR, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, Virus, WormAutorun


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary
Technical Details
Removal Recommendations

MD5: 698548b5173c11a9be5dbfe828574a56
SHA1: f40de0edb0972eb62fc01688134f5743e1a475a0
SHA256: a44eba61cfa7d049d14804fe4a6eda3a65df18aaac8f19290d90180a56f91601
SSDeep: 6144:cQrImvMPZnw0ENuM1GIKAs8LfffihaXV l/wggD5adZ4zytbL0:Rew0El1LKAs8TfihaXMGggYn4zkQ
Size: 344763 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:41


Summary:

Virus. A program that recursively replicates a possibly evolved copy of itself.

Payload

Behaviour Description
WormAutorun A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.


Process activity

The Virus creates the following process(es):

WINMINE.EXE:3252
WINMINE.EXE:3156
WINMINE.EXE:3396
NOTEPAD.EXE:2212
NOTEPAD.EXE:3212
NOTEPAD.EXE:3496
NOTEPAD.EXE:208
NOTEPAD.EXE:3420
NOTEPAD.EXE:1168
NOTEPAD.EXE:1820
NOTEPAD.EXE:192
NOTEPAD.EXE:3184
NOTEPAD.EXE:3328
NOTEPAD.EXE:3532
NOTEPAD.EXE:276
NOTEPAD.EXE:3352
NOTEPAD.EXE:2424
NOTEPAD.EXE:2396
NOTEPAD.EXE:3164
NOTEPAD.EXE:1884
netsh.exe:2752

The Virus injects its code into the following process(es):

698548b5173c11a9be5dbfe828574a56.exe:2636

File activity

The process 698548b5173c11a9be5dbfe828574a56.exe:2636 makes changes in a file system.
The Virus creates and/or writes to the following file(s):

%WinDir%\system.ini (72 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\AdobeARM.exe (31 bytes)
%Program Files%\Wireshark\wireshark.exe (13963 bytes)
D:\disablejavawarnsec.exe (1008 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (1336 bytes)
%Program Files%\Wireshark\WinPcap_4_0_1.exe (4096 bytes)
%WinDir%\ws2help.dll (2755 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winguqbv.exe (601 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (272 bytes)
%WinDir%\explorer.exe.local (12 bytes)
%WinDir%\Wplugin.dll (601 bytes)

The Virus deletes the following file(s):

D:\70770 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0006F0CB_Rar\698548b5173c11a9be5dbfe828574a56.exe (0 bytes)
C:\70369 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winguqbv.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0006F0CB_Rar (0 bytes)

Registry activity

The process WINMINE.EXE:3252 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "30 56 E4 6D AD 3A 30 DB F8 1A 7B 99 4C 26 9E 1F"

The process WINMINE.EXE:3156 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 E5 C8 E1 5B 08 11 17 7A 17 48 4A 1D 8C 9D 8F"

The process WINMINE.EXE:3396 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 13 C8 61 FC 07 3F 8F 5E 2B 82 5B 5B E5 EF B4"

The process NOTEPAD.EXE:2212 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1F 2D A0 1E A1 4A 0A E3 B3 C3 0E 16 6B D9 FE B4"

The process NOTEPAD.EXE:3212 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7A CB 29 F4 CD 5A 2C B7 5D 56 E5 DF 37 4C EE A3"

The process NOTEPAD.EXE:3496 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A 88 7D 2E DB C5 3F 4A 58 3E EB 56 F6 AD 1D B7"

The process NOTEPAD.EXE:208 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B CD 41 38 11 4C 0E B0 09 37 76 E0 FB 69 6B 4C"

The process NOTEPAD.EXE:3420 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "46 93 91 1A 18 38 52 15 6D FB 6F 91 95 6D 99 62"

The process NOTEPAD.EXE:1168 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 FD AE CE 5C A3 9C D3 ED DC E6 00 54 6D 27 9D"

The process NOTEPAD.EXE:1820 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 17 2F 79 65 15 AB 85 02 3D E0 51 A7 67 22 A9"

The process NOTEPAD.EXE:192 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "15 02 FB 3A AA E0 94 B5 B1 85 6E A7 F1 2D 5D B5"

The process NOTEPAD.EXE:3184 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 E7 64 74 D5 87 9B 9A 0E 6A 00 0C 92 1E 46 56"

The process NOTEPAD.EXE:3328 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 80 B7 57 38 28 54 9A D6 C8 6F C6 A1 DC C9 94"

The process NOTEPAD.EXE:3532 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "61 14 D2 EB EF E4 3F 67 FB 87 51 B4 FA B1 4C E1"

The process NOTEPAD.EXE:276 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "57 44 3D AE 3D 5D F1 A7 59 DF E3 B3 2E 9F 62 73"

The process NOTEPAD.EXE:3352 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA 18 9B A2 00 1F 16 9D 22 82 C9 92 51 C7 EE 8B"

The process NOTEPAD.EXE:2424 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8D 52 0C 35 72 03 C8 CC 0B B7 3C 3E 98 40 D1 5B"

The process NOTEPAD.EXE:2396 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "96 53 B7 EF 3C 41 5D 11 F5 ED F9 3C F3 55 28 5F"

The process NOTEPAD.EXE:3164 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C2 85 DC FB DA FB 69 A8 1B 22 52 06 6C 58 2F 76"

The process NOTEPAD.EXE:1884 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F0 0E 3B 0D F9 D5 5F B4 CB 10 B4 E7 51 81 3A F4"

The process 698548b5173c11a9be5dbfe828574a56.exe:2636 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\adm914]
"a4_0" = "0"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system]
"DisableRegistryTools" = "1"

[HKCU\Software\adm914\695404737]
"43014726" = "0800687474703A2F2F6D697263312E6E65742F6C6F676F732E67696600687474703A2F2F71386E6A6D2E636F6D2F6C6F676F732E67696600687474703A2F2F6D616365646F6E69612E6D79312E72752F6D61696E682E67696600687474703A2F2F6C6573746172697377656574686F6D652E636F6D2F6C6F676F732E67696600687474703A2F2F65646D61747269782E75732F696D616765732F6D61696E662E67696600687474703A2F2F76616E6976696C6173686F73706974616C2E636F6D2F696D616765732F6C6F676F732E67696600687474703A2F2F6C616E65746B697A6C61722E736F6D65652E636F6D2F6D61696E682E67696600687474703A2F2F6379616E6F2E636F6D2E62722F6C6F676F732E676966"

[HKCU\Software\adm914\695404737]
"14338242" = "0"

[HKCU\Software\adm914\695404737]
"7169121" = "50"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"

[HKCU\Software\adm914\695404737]
"35845605" = "279"

[HKCU\Software\adm914]
"a1_0" = "3432392762"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKCU\Software\adm914\695404737]
"28676484" = "35"

[HKCU\Software\adm914]
"a3_0" = "17001001"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKCU\Software\adm914\695404737]
"50183847" = "6CED967A2F85C918F63B22C6C2CAC6F7E778F2FAAC2D377F121E6EEC2D93F2117F2CBBBE189096B0DF7F8496A993A27C2450DAB30620A7E380290553F0789DE320C534BBF688C7AF75441712A38CAA907103DE2B642F362CB1F9218A8B3AC1098C36382DAFA3BB4603A532C99521AD8E0500582A5DF2EF25A9A3C9C35C312DA0"

[HKCU\Software\adm914]
"a2_0" = "5517"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 7E C3 D9 25 A1 4D E8 52 4C FC 17 5B B3 62 85"

[HKCU\Software\adm914\695404737]
"21507363" = "0"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system]
"DisableTaskMgr" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"698548b5173c11a9be5dbfe828574a56.exe" = "c:\698548b5173c11a9be5dbfe828574a56.exe:*:Enabled:ipsec"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

The process netsh.exe:2752 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 4C B9 EA 82 30 9D D3 CB 5F E6 B1 0F D9 EA 8A"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

Network activity (URLs)

No activity has been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    WINMINE.EXE:3252
    WINMINE.EXE:3156
    WINMINE.EXE:3396
    NOTEPAD.EXE:2212
    NOTEPAD.EXE:3212
    NOTEPAD.EXE:3496
    NOTEPAD.EXE:208
    NOTEPAD.EXE:3420
    NOTEPAD.EXE:1168
    NOTEPAD.EXE:1820
    NOTEPAD.EXE:192
    NOTEPAD.EXE:3184
    NOTEPAD.EXE:3328
    NOTEPAD.EXE:3532
    NOTEPAD.EXE:276
    NOTEPAD.EXE:3352
    NOTEPAD.EXE:2424
    NOTEPAD.EXE:2396
    NOTEPAD.EXE:3164
    NOTEPAD.EXE:1884
    netsh.exe:2752

  2. Delete the original Virus file.
  3. Delete or disinfect the following files created/modified by the Virus:

    %WinDir%\system.ini (72 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\AdobeARM.exe (31 bytes)
    %Program Files%\Wireshark\wireshark.exe (13963 bytes)
    D:\disablejavawarnsec.exe (1008 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (1336 bytes)
    %Program Files%\Wireshark\WinPcap_4_0_1.exe (4096 bytes)
    %WinDir%\ws2help.dll (2755 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\winguqbv.exe (601 bytes)
    %Program Files%\Common Files\Java\Java Update\jusched.exe (272 bytes)
    %WinDir%\explorer.exe.local (12 bytes)
    %WinDir%\Wplugin.dll (601 bytes)

  4. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
  5. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now