Sinisterly
Help - Sality Virus Infection - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Computers (https://sinister.li/Forum-Computers)
+--- Forum: Antivirus & Protection (https://sinister.li/Forum-Antivirus-Protection)
+--- Thread: Help - Sality Virus Infection (/Thread-Help-Sality-Virus-Infection)

Help - Sality Virus Infection - l4ur15 - 07-31-2014

Hey guys! Smile Im a kinda new here so i couldnt make my own thread but here the story goes. Once i was turning on my old windows xp machine and then i noticed that task manager was blocked. So i checked on the internet - might be some virus. After some while fired up my AV‘s - Malware bytes, Adw cleaner and some tools to remove virus. Both of AV's are "removing" virus, but after reboot its back. I tried to remove it from safe mode, hirens boot live cd but no success. Could someone please help me with virus removal? Its blocking task manager, reg editor and msconfig. Its called [win95] sality virus. It screwed all exe files in my usb stick and infected alots of setups and programs on my hdd. I have tried many AV's and even sality removal tools - no luck. Its very nasty because every time its back. Please help ASAP. Now it refuses turn on win xp. Now i can turn on only mini xp and live linux systems. Well im not giving up but i dont want to configure my system again. I am downloading non official updates for xp too.

RE: Help - Sality Virus Infection - Deque - 07-31-2014

-split to its own topic-

As it seems only certain subtypes of Sality can be disinfected, but a lot of them are not recoverable.
Have a look at this picture:

[Image: 2006-011714-3948-99.5.PNG]

This virus destroys parts of its host files by overwriting.
That means your system can not be recovered to the state before the infection, because overwritten parts can not be recovered.
You already tried Sality disinfectors, so I don't see any chance for something else.
Even if you get rid of Sality, you will have to deal with other nasty malware on your system that Sality downloaded and installed.
I would whipe the system and USB drive and everything that got into contact with the computer, and reinstall the OS.

RE: Help - Sality Virus Infection - l4ur15 - 07-31-2014

(07-31-2014, 07:43 PM)Deque Wrote: -split to its own topic-

Do you know the exact type of the virus? As it seems only certain subtypes of Sality can be disinfected, but a lot of them are not recoverable.
Have a look at this picture:

[Image: 2006-011714-3948-99.5.PNG]

This virus destroys parts of its host files by overwriting.
That means your system can not be recovered to the state before the infection, because overwritten parts can not be recovered.
You already tried Sality disinfectors, so I don't see any chance for something else.
Even if you get rid of Sality, you will have to deal with other nasty malware on your system that Sality downloaded and installed.
I would whipe the system and USB drive and everything that got into contact with the computer, and reinstall the OS.

Big thanks for reply! I dont know its type. Then ill have to reinstall my system without backup... starting from a zero again... Thats why i hate windows. Now im gonna choose linux as a main os. Unfortunately i have no experience with RE so im helpless. But thanks anyway!

RE: Help - Sality Virus Infection - Deque - 07-31-2014

(07-31-2014, 08:00 PM)l4ur15 Wrote: Big thanks for reply! I dont know its type. Then ill have to reinstall my system without backup... starting from a zero again... Thats why i hate windows. Now im gonna choose linux as a main os.

You are welcome. Sorry that I couldn't really help you.

Btw, this is what a sality infected file looks like. I downloaded Virus.Win32.Sality.i from openmalware.org and ran it through my visualizer. I don't know how much you dealt with reverse engineering before and if that's even telling you something. But there is a fat encrypted virus body in that file, which is the part that is relatively bright on the left picture that shows the local entropy. Kernel32.dll imports to LoadLibraryA and GetProcAddress have been added there and obscured, they are usually a good hint for process injectors.

Spoiler:
[Image: 7QmvquR.png]


^this is your enemy.

RE: Help - Sality Virus Infection - Isaac - 07-31-2014

Format your Hard Drive and Install a freash copy of Windows. That's pretty much the only thing you can do at this point.

RE: Help - Sality Virus Infection - l4ur15 - 08-01-2014

(07-31-2014, 09:20 PM)XrpmX13 Wrote: Format your Hard Drive and Install a freash copy of Windows. That's pretty much the only thing you can do at this point.

Already done! Hard formated both devices and installed ubuntu. Tnx for reply.