Win32/Sality.NAR is a polymorphic file infector. When executed the virus drops in folder %system%\drivers\ the following file: %variable% stands for a random text.

The following files are dropped into the %temp% folder: %variableA%, %variableB% stand for a random text. The files are then executed.


The virus registers itself as a system service using the following name: The following Registry entries are created: The performed command creates an exception in the Windows Firewall program.

The following Registry entries are set: The following Registry entries are deleted: Win32/Sality.NAR is a polymorphic file infector. The virus searches local and network drives for files with one of the following extensions: Files are infected by adding a new section that contains the virus . The host file is modified in a way that causes the virus to be executed prior to running the original code.

The virus infects files referenced by the following Registry entries: This causes the virus to be executed on every system start. The virus copies itself into the root folders of removable drives using a random filename. The filename has one of the following extensions: The following file is dropped in the same folder: Thus, the virus ensures it is started each time infected media is inserted into the computer. The following files are deleted: The following services are disabled: The virus terminates processes with any of the following strings in the name: The virus contains a list of URLs. It tries to download several files from the addresses.

These are stored in the following locations: %variable% stands for a random text. The files are then executed.

The virus creates and runs a new thread with its own program code within the following processes:
The virus modifies the following file: The virus writes the following entries to the file: The %number% stands for a random number.