Sality is a long-running family of polymorphic Windows file infectors. Variants insert malicious code into executable files, interfere with security software, spread through removable media or shares, and may join peer-to-peer infrastructure to obtain additional components.
Because many files can be altered across a system or network, Sality cleanup is more complex than deleting one detected executable.
What does Sality mean?
In cybersecurity, Sality is the family name used for this Windows malware, including detections such as Win32/Sality. It is not a description of one specific file: different variants and security vendors may use additional suffixes. Confirm the complete detection name and affected file before choosing a recovery method.
How Sality infects files
File-infecting variants modify eligible Windows executables so the malicious code runs when an infected program starts. Polymorphism changes portions of the malware between infections, making simple hash matching less effective. Damaged or incorrectly cleaned files may no longer work.
How it spreads
- Execution of an already infected program.
- Writable network shares containing executable files.
- Removable drives and unsafe autorun-related behavior in older environments.
- Other malware that installs a Sality variant.
- Reintroduction from an unclean backup, software repository, or neighboring device.
Additional malicious behavior
Depending on the variant, Sality can terminate security processes, modify system settings, block access to security sites, create persistence, and download more malware. Some variants communicate through a peer-to-peer network, which avoids dependence on one fixed command server.
Warning signs
Possible indicators include many unrelated executable files receiving detections, security software closing or failing to update, programs becoming corrupted, unknown network activity, and infections returning after cleanup. These signs are not unique to Sality, so preserve samples and use reliable family identification.
Immediate response
- Disconnect the affected device from networks and removable storage.
- Stop using shared software repositories until they are checked.
- Preserve alerts, hashes, logs, and representative samples.
- Scan neighboring systems and removable media with updated tools.
- Protect credentials from a known-clean device if theft is possible.
Cleaning vs. rebuilding
A vendor-supported disinfecting tool may repair some known variants, but large numbers of modified files create integrity risk. If system files, security components, or trusted software repositories are affected, rebuilding from known-good media is often safer. Restore documents and data, not executable files of uncertain origin.
Recovery checklist
Patch the rebuilt system, update security tools, disable unnecessary legacy sharing and autorun behavior, rotate exposed credentials, and scan backups before restoration. Verify business applications from original signed installers. Monitor for renewed detections and peer-to-peer traffic before reconnecting broadly.
Preventing reinfection
Use application control, least privilege, supported operating systems, segmented networks, protected software repositories, and removable-media policy. Download programs only from official sources. Do not copy an executable from an infected machine merely because it still launches.
Sality vs. a Trojan
Sality is notable for infecting and replicating through executable files. A Trojan disguises itself or relies on users to run it and does not self-replicate by definition. A Sality infection can still download Trojan payloads.