About “TrojanDropper:Win32/Sality.AU” infection

The TrojanDropper:Win32/Sality.AU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDropper:Win32/Sality.AU virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• CAPE detected the embedded win api malware family
• Operates on local firewall’s policies and settings
• Deletes executed files from disk
• Attempts to disable UAC
• Attempts to modify or disable Security Center warnings
• Attempts to block SafeBoot use by removing registry keys
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara detections observed in process dumps, payloads or dropped files

How to determine TrojanDropper:Win32/Sality.AU?

File Info:
name: BD593D8401487F8E48ED.mlw
path: /opt/CAPEv2/storage/binaries/794dbb5fea4b1d3782f8a7b3250f71a9545c6cdfa9097fe4c06a9036746f7fcb
crc32: 2727C4C2
md5: bd593d8401487f8e48edffe207705f2b
sha1: c50826313f710c471a8e883eab611e15cc35daf0
sha256: 794dbb5fea4b1d3782f8a7b3250f71a9545c6cdfa9097fe4c06a9036746f7fcb
sha512: d033d16bf875064986d3e642f1fb9f68f6859ddafe8ed84fc7aafea3a2a461ffee764a667742f5107fa594b5a4b27d5757948fb2e47a2a00f1b3ec2bd5731488
ssdeep: 3072:4Pd6OOmfccFaV3A6m48FDaAwuJK7YUUPY+8Kg:4l6OFfcBNh8FOAwuSVUQ+u
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T164C312D77F4AEC8FDC4580BF29115A0863C2A63273D38558A0B382CA5E517949A7BDCF
sha3_384: b66b4421c55d3538c11c8e410dec505a8bc29b1bae2b6c89f54746ed06675bedd768a6affc6cccdc9f76661611e0f637
ep_bytes: 558bec6a02ff1524100010e81efdffff
timestamp: 2010-11-05 20:30:50

Version Info:
0: [No Data]

TrojanDropper:Win32/Sality.AU also known as:

How to remove TrojanDropper:Win32/Sality.AU?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.