Threat Search: 

ThreatExpert's Statistics for Virus.Win32.Sality.aa [Ikarus]:

Virus.Win32.Sality.aa [Ikarus] is also known as:
Threat AliasNumber of Incidents
Virus.Win32.Sality.aa [Kaspersky Lab]15
Virus:Win32/Sality.AM [Microsoft]15
W32/Sality-AM [Sophos]14
W32.Sality.AE [Symantec]13
PE_SALITY.JER [Trend Micro]6
W32/Sality.ah [McAfee]6
W32/Sality.ao [McAfee]5
PE_SALITY.EN [Trend Micro]3
PE_SALITY.EN-O [Trend Micro]1
Trojan.Jonben.A [PC Tools]1
W32.Imaut [Symantec]1
W32/Sality [McAfee]1
W32/Sality.ag [McAfee]1
W32/Sality.al [McAfee]1
W32/Sality.an [McAfee]1
W32/Vetor-A [Sophos]1

Virus.Win32.Sality.aa [Ikarus] has the following possible countries of origin:
OriginNumber of Incidents
China1
Japan1
Republic of Korea1
Russian Federation1
Spain1
Taiwan1
United Kingdom1

Virus.Win32.Sality.aa [Ikarus] is known to be created as:
%System%\blastclnnn.exe
%System%\scvhsot.exe
%Temp%\00055a0e_rar\scvhsot.exe
%Temp%\000592b2_rar\scvhsot.exe
%Temp%\0005934e_rar\hinhem.scr
%Temp%\0005938d_rar\blastclnnn.exe
%Windir%\hinhem.scr
%Windir%\scvhsot.exe
Notes:
  • %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
  • %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
  • %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.