TrojanDropper:Win32/Sality.AU removal instruction

The TrojanDropper:Win32/Sality.AU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDropper:Win32/Sality.AU virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• CAPE detected the embedded win api malware family
• Operates on local firewall’s policies and settings
• Attempts to disable UAC
• Attempts to modify or disable Security Center warnings
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara detections observed in process dumps, payloads or dropped files

How to determine TrojanDropper:Win32/Sality.AU?

File Info:
name: D67C358E2C46E505E427.mlw
path: /opt/CAPEv2/storage/binaries/e3a302e93a743b96c93dfe080b82c991dffd28ee9583a538ae45e6c496153ca3
crc32: 272B7F50
md5: d67c358e2c46e505e4279d3268d41da6
sha1: df9119cd77e1b688f8e60adfdef56d4d99fe9d57
sha256: e3a302e93a743b96c93dfe080b82c991dffd28ee9583a538ae45e6c496153ca3
sha512: 18415d7853f0f511904d23b901ab848de1979af0056681ddb6d23269037e287febbef5010a2428a1f26bd5877d374197e43676d5c24221ecc915e1d8b7a373a7
ssdeep: 1536:97iirJf3ZK3nzAzC3mOvj4gxQjtpqwUUD8xsAN8ds39ts7v7bVW7IewVG74h:9eirJPZKXHRbpuSUDYATD7A7ING
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T1AEC312218EA372B1DD174FB9224FC900B013E6F5F637945EB453091FF49A92DB239292
sha3_384: ab15f8675c364b8ee67bb5bc750b384928d7730a44ddbcaa9f29ea1758b54da29e7a86293e1d506440d29a79fcbe36d7
ep_bytes: 558bec6a02ff1524100010e81efdffff
timestamp: 2010-11-05 20:30:50

Version Info:
0: [No Data]

TrojanDropper:Win32/Sality.AU also known as:

How to remove TrojanDropper:Win32/Sality.AU?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.