Should I remove “TrojanDropper:Win32/Sality.AU”?

The TrojanDropper:Win32/Sality.AU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDropper:Win32/Sality.AU virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• CAPE detected the embedded win api malware family
• Operates on local firewall’s policies and settings
• Attempts to disable UAC
• Attempts to modify or disable Security Center warnings
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara detections observed in process dumps, payloads or dropped files

How to determine TrojanDropper:Win32/Sality.AU?

File Info:
name: BD4D6A903BA8B70E9447.mlw
path: /opt/CAPEv2/storage/binaries/3aa34aa908b3155bc4f76d84ab7a5bdef6c2f18d01b411969c0f62e77036b834
crc32: 5F9B6C56
md5: bd4d6a903ba8b70e9447c2d76015be38
sha1: 2eb240610f77401e1c96b8c0381b79211bb67289
sha256: 3aa34aa908b3155bc4f76d84ab7a5bdef6c2f18d01b411969c0f62e77036b834
sha512: 086d2028d3416b15ae720e981a694eb88cd41d08c268052e3225c1e5b9800ca21816006713c761bf503c53051794eb20c55a11ad1ed7805e2ed8686b34c3823c
ssdeep: 1536:+RKgweLi291mANEEVFuAg8QW52iOiNfbl+o+4OGGPvtX0YLxJCJgMunEHPMBKApt:lZeLX12nAhQrQMo+4hGP2OCQEvMHpNH
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T138C30244B42AD1EAC369097F4B259C274406FB2D3396E6960DEA1F9E282DECD2C73135
sha3_384: 8a7fef55acf1eeb09dec20feeea40e87268cbc4ba72c7d7c40688a7f061f7092d6056850d27f927a77aac4d73074d0f2
ep_bytes: 558bec6a02ff1524100010e81efdffff
timestamp: 2010-11-05 20:30:50

Version Info:
0: [No Data]

TrojanDropper:Win32/Sality.AU also known as:

How to remove TrojanDropper:Win32/Sality.AU?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.