What is “TrojanDropper:Win32/Sality.AU”?

The TrojanDropper:Win32/Sality.AU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDropper:Win32/Sality.AU virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• CAPE detected the embedded win api malware family
• Operates on local firewall’s policies and settings
• Attempts to disable UAC
• Attempts to modify or disable Security Center warnings
• Attempts to block SafeBoot use by removing registry keys
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara detections observed in process dumps, payloads or dropped files

How to determine TrojanDropper:Win32/Sality.AU?

File Info:
name: 308A34F4E05A24B4F869.mlw
path: /opt/CAPEv2/storage/binaries/2037a51e8c264bac746b8409697b99b854b136c5c4c608a96174cd34e245fa16
crc32: 4262C3EA
md5: 308a34f4e05a24b4f869565874cc5839
sha1: 3ad811b967ca5151ff767d027a52f7886b309f39
sha256: 2037a51e8c264bac746b8409697b99b854b136c5c4c608a96174cd34e245fa16
sha512: 221a7dd1351bd05bb6d2fddb4aaf9b05756a6c0f08b4166e2de92feda3846bc24c1e1ab4afbda8e97b34ca8f9177b741362d9e07718ccd9dd92f38efdeb15569
ssdeep: 1536:307ISg5s1xtZJX96R5c997CwaYnWZt0OioC93bpnkyXO9CBXjybMSyTWWS1h2:30BQR5UxCwaCg0AS3FkT9CFMMKze
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T16EC3023963D2EA4EFBA243F6A3CD50A09BF8F03D41459085D4D7B122B224665A6FB493
sha3_384: 57636af52b1a023678ad3944b005b4845acfd08f017ba4b355aa746861c1ebeab043b2cc0240c9071e619acaf071c13f
ep_bytes: 558bec6a02ff1524100010e81efdffff
timestamp: 2010-11-05 20:30:50

Version Info:
0: [No Data]

TrojanDropper:Win32/Sality.AU also known as:

How to remove TrojanDropper:Win32/Sality.AU?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.