W32/Salay-A

Aliases	W32/Generic.Delphi.a W32.Salay
Category	Viruses and Spyware
Type	Worm
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


How it spreads	Network shares
Affected operating systems	Windows
Characteristics	Installs itself in the registry
Included in our products from	December 2005 (4.00)
Protection available since	9 November 2005 10:48:49 (GMT)
Detected by	All Sophos products

W32/Salay-A is a network worm for the Windows platform.

The worm copies itself to the Windows system folder as dosw.exe and creates the following registry entry in order to run each time a user logs on:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows DOS
"<Windows system folder>\dosw.exe"

The worm spreads through network shares protected by weak passwords.

Get reports about the latest virus and spyware threats delivered to your computer