Dropped:Win32.Sality.RA (B) removal instruction

The Dropped:Win32.Sality.RA (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Dropped:Win32.Sality.RA (B) virus can do?

• Sample contains Overlay data
• Reads data out of its own binary image
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Deletes executed files from disk
• Yara detections observed in process dumps, payloads or dropped files

How to determine Dropped:Win32.Sality.RA (B)?

File Info:
name: 75A5A94BB79931BA8126.mlw
path: /opt/CAPEv2/storage/binaries/bf10ca071924edef163e306bf7645de28dbcd0e87cc66424b777de561bd4fa3d
crc32: 009038D9
md5: 75a5a94bb79931ba8126ba5ef397c551
sha1: 19a78b6020004193f47da6fa9f80fad872066123
sha256: bf10ca071924edef163e306bf7645de28dbcd0e87cc66424b777de561bd4fa3d
sha512: d384541cf5d711fdd2f92d2ce211517f6aa0819c1bac44939a2304972cc7f5c73696f936d517122dfca17c50fc037e9874b0b8a5154d34fff033b39caab32e23
ssdeep: 3072:/fN0LwH/hUmnWud5Rov8/Z5EPO+sQJxAozIjTNR6pbBcIgTJs:3NxPhEvyZ5/wzIHN0pbBfg9s
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DBA39E517391A03AE0E31A7036B85B6467793C301F3893EFDF113B9A5DB4AD59A30B22
sha3_384: 8206f7017481d498d49c270aa826bbb580a00f413d0b28a389dcb037d37e48658805181cd2b86405015a6f69683fe1ce
ep_bytes: 60e8000000005883e83d508db800b0fc
timestamp: 2003-09-28 00:37:23

Version Info:
0: [No Data]

Dropped:Win32.Sality.RA (B) also known as:

How to remove Dropped:Win32.Sality.RA (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.