W32.Sality.PE

Posted: January 23, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	8/10
Infected PCs:	5

First Seen:	January 23, 2012
Last Seen:	February 18, 2022
OS(es) Affected:	Windows

W32.Sality.PE is a variant of the Sality virus that has spread in massive numbers throughout Vietnam. However, computers in different places of the globe are also vulnerable to attacks by W32.Sality.PE, which uses advanced techniques to propagate, conceal itself and disable the security of its host computers. As a virus, W32.Sality.PE will infect pre-existing files on your hard drive, but W32.Sality.PE can also download and install other PC threats, such as scamware, spyware or browser hijackers. SpywareRemove.com malware analysts have noted that all variants of Sality are major security risks, and this includes W32.Sality.PE. Although W32.Sality.PE will attempt to disable many types of anti-malware products that could remove W32.Sality.PE, with patience and careful usage of standard anti-malware strategies, W32.Sality.PE can be removed by a sufficiently competent anti-virus program.

W32.Sality.PE – the Number-One Threat to the Vietnamese Web

Although W32.Sality.PE and other Sality viruses have existed since 2010, recent reports of W32.Sality.PE’s surge in propagation have led to W32.Sality.PE being considered a top risk in 2012. W32.Sality.PE may spread itself to your PC in any of the following ways, while simultaneously avoiding your security software with polymorphic code changes:

W32.Sality.PE, like many types of Sality viruses, may copy itself to another file and then copy that file to removable drives or network-shared locations on your PC. These files will install W32.Sality.PE by default whenever another computer accesses that location, in the same manner that worms use to proliferate.
W32.Sality.PE in particular has also been noted to be spread via social networking-based links. These links are posted a little help from chatting features for popular websites like Facebook and Twitter, and are often caused by the original user's account being hijacked by W32.Sality.PE's security attacks.

Since W32.Sality.PE, as a virus, is difficult to detect and may show no unusual files to indicate its presence, it's no surprise to SpywareRemove.com malware researchers that W32.Sality.PE has used the two methods noted above to flood Vietnam. Vietnamese file sources, websites, and links should be treated with caution, since avoiding a possible W32.Sality.PE infection is much simpler than removing W32.Sality.PE.

What to Be Aware of Before You Pry W32.Sality.PE Out of Your PC

As a recent type of Sality variant, W32.Sality.PE may indulge in other attacks besides the ones noted below. However, W32.Sality.PE's most common and most dangerous attacks can include the following, all of which are designed to compromise your computer's security for future assaults:

W32.Sality.PE may delete files that are used to update anti-malware programs. It can identify these files by their extensions, such as .vdb or .key.
W32.Sality.PE may shut down programs that are related to PC security or safety. In addition to targeting anti-malware products and firewalls, W32.Sality.PE can also terminate Google Online Services, SpIDer Guard File System Monitor, McAfee Framework, Eset HTTP Server and BlackICe, among other products.
Similarly, W32.Sality.PE can also blockade your web-surfing habits by blocking sites that are linked to popular brands of PC security companies.
W32.Sality.PE may also be used to steal passwords and other private information with keylogging and other types of spyware-based attacks.
Unauthorized Registry changes by W32.Sality.PE may also result in other undesirable security weaknesses, such as an inability to launch Windows in Safe Mode.

Finally, W32.Sality.PE can also download and install other PC threats with concealed and encrypted P2P-based transactions. Although deleting the W32.Sality.PE virus may, therefore, be extremely difficult, SpywareRemove.com malware analysts nonetheless recommend that you use suitable anti-malware products and strategies to do so as soon as you suspect that W32.Sality.PE is lurking on your PC. Allowing W32.Sality.PE to remain on your computer should always be considered a security hazard of absolutely intolerable levels.

W32.Sality.PE

Threat Metric

W32.Sality.PE – the Number-One Threat to the Vietnamese Web

What to Be Aware of Before You Pry W32.Sality.PE Out of Your PC

Leave a Reply