Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Sality is making me violent!


  • Please log in to reply
21 replies to this topic

#1 Question_Everything

Question_Everything

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:09:40 AM

Posted 19 March 2014 - 11:59 AM

Hey guys long time lurker first time poster pretty sure I got sality. One of my computer allergic mates "had to" show me some film via USB and tadaa!
I should have bit the bullet last week but stubbornly I attempted to remove this flaming mongrel of a thing.
I managed to reformat and reinstall as well as deleting its partition but it must be a mother in law because it just won't die!
Now is it has also infected my missus laptop which she needs for graphic design...

My laptop is a toshiba satellite l510 with vista 64x and the girls is a asus a73s with win 7 64x.
3 USB sticks are infected and I'm confident it must be partying on the external hdd as well.

It's possible I can borrow a clean laptop from a mate but I don't really want another person raging at me as I think I read somewhere it can infect the network?

Help me or get me a shovel so I can dig my own grave as the missus is furious :/

BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,026 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:07:40 PM

Posted 19 March 2014 - 12:05 PM

Having already reformatted it would be best to get a deeper look. Please follow this Preparation Guide, do steps 6,7 and 8 and post in a new topic.
Let me know if all went well.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,054 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:12:40 AM

Posted 19 March 2014 - 12:08 PM

@boopme: They are just going to say reformat again - the user keeps reinfecting themselves, no point in trying to clean. It's probably better if they can make a linux boot disk and then reinstall from there. Then disable autoruns and clean USBs/external drives.

 

xXToffeeXx~


~If I am helping you and you have not had a reply from me in two days, please send me a PM~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,026 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:07:40 PM

Posted 19 March 2014 - 12:13 PM

Ok, sounds good... Please continue with Toffee
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,054 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:12:40 AM

Posted 19 March 2014 - 12:15 PM

Hi,
 
Sorry for jumping in Boopme, I just think it makes more sense this way.
 
Do you have another computer which you can use to download programs and a blank CD, Question_Everything?
 
xXToffeeXx~


EDIT... No problem, to me it's all about the TEam fixing the OP's compy ~~boopme

Edited by boopme, 19 March 2014 - 12:36 PM.

~If I am helping you and you have not had a reply from me in two days, please send me a PM~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#6 Question_Everything

Question_Everything
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:09:40 AM

Posted 19 March 2014 - 12:30 PM

I wasn't expecting such quick replies but it's daytime where your at! Toffee currently I'm surrounded by infectious waste :(

Although I think my lady has an ancient laptop although I'm unsure whether it even works. My mate definitely has a working laptop but it's 330am here so I have to wait till later.

In the meantime is there anything I can try? I have 3 laptops here infected one has bugger all on it- the one I tried to fix...

#7 Question_Everything

Question_Everything
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:09:40 AM

Posted 19 March 2014 - 12:41 PM

Btw I did start what boop suggested but stopped to reply here oh and I'm currently replying from an iPad

Edit- I also have a hirens boot cd if that can be of assistance...

Edited by Question_Everything, 19 March 2014 - 12:47 PM.


#8 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,054 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:12:40 AM

Posted 19 March 2014 - 01:24 PM

Hi,

 

Well, if that computer that has nothing on it then you could reformat it, or if you do not like that idea then you can try Kaspersky's sality removal tool and AVG's sality removal tool (please note, I cannot be certain on whether it will actually clean the infection or whether windows will still be functional after running these tools) on that computer.

Really we need at least one clean computer to work with, and disconnect the rest of the infected computers (except if you plan to work on one of them, and don't have another computer) if you can.

 

I'm fine with waiting, just keep me updated on what you want to do.

 

xXToffeeXx~


Edited by xXToffeeXx, 19 March 2014 - 01:25 PM.

~If I am helping you and you have not had a reply from me in two days, please send me a PM~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#9 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,265 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:07:40 PM

Posted 19 March 2014 - 03:15 PM

Win32/Sality is a dangerous polymorphic file infector which infects .exe, .scr files, creates a peer-to-peer (P2P) botnet that compromises your computer, downloads more malicious files to your computer, steals sensitive system information/passwords and sends it back to the attacker.

-- Note: As with most malware infections, the threat name may be different depending on the anti-virus or anti-malware program which detected it. Each security vendor uses their own naming conventions to identify various types of malware.With this particular infection, the safest solution and only sure way to remove it effectively is to reformat and reinstall the OS.

Why?

As an entry-point obscuring (EPO) polymorphic file infector, the virus gains control of the host body by overwriting the file with complex and encrypted code instructions. The goal of the complex code is to make analysis more difficult for researchers to see the real purpose and functionality implemented in the code...Infected files will have their original, initial instructions overwritten by complex code instructions with the encrypted viral code body located in the last section of the file.

Symantec's Assessment of Win/32Sality


As with many other malware, Sality disables antivirus software and prevents access to certain antivirus and security websites. Sality can also prevent booting into Safe Mode and may delete security-related files found on infected systems. To spread via the autorun component, Sality generally drops a .cmd, .pif, and .exe to the root of discoverable drives, along with an autorun.inf file which contains instructions to load the dropped file(s) when the drive is accessed.

About Sality Virus

Sality is commonly spread via a flash drive (usb, pen, thumb, jump) where it can infect executable files on local, removable and remote shared drives. The infection is often contracted by visiting remote, crack and keygen sites. These type of sites are infested with a smörgåsbord of malware and a major source of system infection.

Since Win32.Sality is not effectively disinfectable, your best option is to perform a full reformat as there is no guarantee this infection can be completely removed. In most instances it may have caused so much damage to your system files that it cannot be completely cleaned or repaired. In many cases the infected files cannot be deleted and anti-malware scanners cannot disinfect them properly.

Many experts in the security community believe that once infected with this type of malware, the best course of action is to wipe the drive clean, reformat and reinstall the OS. Please read:

Whenever a system has been compromised by a backdoor payload, it is impossible to know if or how much the backdoor has been used to affect your system...There are only a few ways to return a compromised system to a confident security configuration. These include:
Reimaging the system
Restoring the entire system using a full system backup from before the backdoor infection
Reformatting and reinstalling the system

Backdoors and What They Mean to You

This is what Jesper M. Johansson, Security Program Manager at Microsoft TechNet has to say: Help: I Got Hacked. Now What Do I Do?.

The only way to clean a compromised system is to flatten and rebuild. Thats right. If you have a system that has been completely compromised, the only thing you can do is to flatten the system (reformat the system disk) and rebuild it from scratch (reinstall Windows and your applications).


.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,265 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:07:40 PM

Posted 19 March 2014 - 03:17 PM

I do not know of any security vendor who will guarantee complete removal of file infectors since they cannot ensure that some files will not get corrupted during the disinfection process. This means that infected executables and system files can become unusable after attempting to repair them and afterward, there is still no guarantee the virus is really gone. Since many of the affected files are legitimate critical files required by the operating system, deletion is not a viable option. Even many anti-virus vendors admit that some malicious programs like file infectors cannot be properly disinfected by their products.
 

File infectors are not on the top of their popularity nowadays (theres not a wide variety of them ITW, but the few active such as Sality or Virut are difficult to defeat). One reason is the frequency of their updates and the complexity of their polymorphism, another reason is the fact, that these viruses are not perfectly tuned. If the file infector should be successful (and transparent to the normal system behavior), it simply should not produce corrupted files (the process crashes will quickly point out whats going on). I will show you some examples of bugs in file infectors (below in this article). The problem is that these bugs often make the infected binaries uncurable...

avast: Buggy file infectors


...You can see some tools claiming theyre able to clean even the most complex infections, but believe me, theres no guarantee to restore the system to its original state. A cleaned file (in my opinion) means a file that has no malicious functionality and does not contain any (even inactive) traces of the infection. My daily practice offers me many files cleaned from the Virut infection with some 3rd party tools, but they still contain significant parts of the infection and are thus detected by our engine....

avast: File infectors part 2


...it is quite interesting to look at modern day polymorphic viruses and whether their propensity to junk files is wholly by accident or whether there is the occassional element of intent involved...a mass infection that leaves behind a large number of irreparably corrupt files can still be very damaging. Some members of the Virut/Vetor family will randomly choose not to leave an infection marker after infection. This leaves the way open to multiple infections (more headaches for anti virus companies) but also increases the chances that the end file will be corrupt...

Sophos: To Junk Or Not To Junk


...In many cases, files cannot simply be deleted as this would affect the stability or even basic functionality of the operating system and other software. Instead, the infected host program must be disinfected by removing the virus code from it and by carefully restoring the original contents and file structure if possible. This means detection and removal are still an issue for antivirus software....

Avira: Cleaning polymorphic infected files


The suggestions in this article are not intended to 100% guarantee removal of all threats...The file infector employs a technique to make sure its corrupted .DLL format will replace the targeted extensions found within the system. When the computer is rebooted it incidentally boots the infected file and continues its advancement throughout the system...

Norton (Symantec): File infector


There are bugs in the viral code. When the virus produces infected files, it also creates non-functional files that also contain the virus...Due to the damaged caused to files...it's possible to find repaired but corrupted files. They became corrupted by the incorrect writing of the viral code during the process of infection. Undetected, corrupted files (possibly still containing part of the viral code) can also be found. This is caused by incorrectly written and non-function viral code present in these files.

AVG: polymorphic infector


...you can try via rescue cd, or slave mounted hard drive. but there's no guarantee that some files won't get corrupted through the disinfection process.

Kaspersky: file infector


...for infected users we have to offer no hope - fdisk - format and re-install is the only solution open to them...

avast: a file infector and why we cannot give false hope!

There are no guarantees when it comes to malware removal and dealing with file infectors as severity of damage will vary. In my experience, users may find their system performing better for a short time after attempted disinfection only to have it become progressively worst again as the malware continues to reinfect thousands of files. Some folks will try every tool or rescue disk they can find in futile attempts to repair critical system files. If something goes awry during the malware removal process the computer may become unstable or unbootable and you could loose access to all your data. In the end most folks end up reformatting out of frustration after spending hours (and days) attempting to repair and remove the infected files.

That's why most security experts say the best course of action is to wipe the drive clean, reformat and reinstall the OS.

If I guide someone with Virut (or any other File Infector) present and their Antivirus cannot properly disinfect it, then I recommend a format and reinstall...dealing with such infections is a waste of time and that's why I prefer the fastest and safest solution - which is a format and reinstall...After all, I think it would be irresponsible to let the malware "stew" (download/spread/run more malware) for another couple of days/weeks if you already know it's a lost case.

miekiemoes' Blog: Virut and other File infectors - Throwing in the Towel?
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#11 Question_Everything

Question_Everything
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:09:40 AM

Posted 20 March 2014 - 02:15 AM

Hey quietman thanks for the response I kinda figured it was a lost cause but one can dream! Haha

Yeah it think it's time just to nuke everything, problem I have is this twit has infected pretty much my group of friends computers! Grrr

The kinda good news is We have a dinosaur of a laptop here that has a personality to match that is not infected running xp.

Also I have two burnt windows discs one is 7 and the other vista. I'm skeptical of he vista disc as it was burnt on my missus laptop when I was unaware of its infection :/ as I said earlier I have hirens boot cd too but that was also burnt on her laptop...

I may have to trek it out to the old mans place as his pcs are not infected for anti malware if the old laptop plays up while trying to solve this.

So when your all rested give me the battle plans! XD

#12 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,265 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:07:40 PM

Posted 20 March 2014 - 06:13 AM

If you're not sure how to reformat and reinstall Windows, please review:

Windows XP users can refer to these instructions:

Windows Vista users can refer to these instructions:

Windows 7 users can refer to these instructions:

Note: If you're using an IBM, Sony, HP, Compaq, Toshiba, Gateway or Dell machine, you may not have an original CD Disk. By policy Microsoft no longer allows OEM manufactures to include the original Windows CD-ROM on computers sold with Windows preinstalled. Instead, most computers manufactured and sold by OEM vendors come with a vendor-specific Recovery Disk or Recovery Partition for performing a clean "factory restore" that will reformat your hard drive, remove all data and restore the computer to the state it was in when you first purchased it. Please read Technology Advisory Recovery Media.

If the recovery partition has become infected, you will need to contact the manufacturer, explain what happened and ask them to send full recovery disks to use instead. If you lost or misplaced your recovery disks, again you can contact and advise the manufacturer. In many cases they will send replacements as part of their support or charge a small fee.

If you need additional assistance with reformatting or partitioning, you can start a new topic in the appropriate Windows Operating System Subforum.


.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#13 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,265 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:07:40 PM

Posted 20 March 2014 - 06:13 AM

Caution: If you are considering backing up data and reformatting or doing a factory restore with a vendor-specific Recovery Disk/Recovery Partition due to malware infection, keep in mind with file infectors, there is always a chance of backed up data reinfecting your system. If the data is important to you, then you can try to salvage some of it but there is no guarantee so be forewarned that you may have to start over again afterwards if reinfected by attempting to recover your data. Only back up your important documents, personal data files, photos, music, videos to a CD or DVD drive, not a flash drive or external hard drive as they may become compromised in the process. The safest practice is not to backup any executable files (*.exe), screensavers (*.scr), dynamic link library (*.dll), autorun (*.ini) or script files (.php, .asp, .htm, .html, .xml) files because they may be infected by malware. Avoid backing up compressed files (.zip, .cab, .rar) that have executables inside them as some types of malware can penetrate compressed files and infect the .exe files within them. Other types of malware may even disguise itself by hiding a file extension or by adding double file extensions and/or space(s) in the file's name to hide the real extension as shown here (click Figure 1 to enlarge) so be sure you look closely at the full file name. If you cannot see the file extension, you may need to reconfigure Windows to show file name extensions. Then make sure you scan the backed up data with your anti-virus prior to to copying it back to your hard drive.

If your CD/DVD drive is unusable or there isn't one installed, another word of caution if you are considering backing up to an external usb hard drive as your only alternative. External drives are more susceptible to infection and can become compromised in the process of backing up data. I'm not saying you should not try using such devices but I want to make you aware of all your options and associated risks so you can make an informed decision if its worth that risk.If your computer will not boot properly, please refer to:Again, do not back up any files with the following file extensions: .exe, .scr, .bat, .com, .cmd, .msi, .pif, .ini, .htm, .html, .hta, .php, .asp, .xml, .zip, .rar, .cab as they may be infected.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#14 Question_Everything

Question_Everything
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:09:40 AM

Posted 20 March 2014 - 06:35 AM

Yeah after all the dicking around I have done trying to get it off its burrowed in deep. We have saved some docs, pics and videos but no executables; I'm well aware it's going to be lurking on those devices regardless.

she has a factory disc for the asus but that's about it. Also my missus neglected to tell me she had another laptop!? Which was a shame because by the time I found out she had connected to the router and sality claimed another victim.

Can this menace infect Apple? Just worried about other things now (iPad smartphones), also how do I get it off the network/router?

I tried to get my laptop to boot from DVD in bios but it's standing its ground. I think I'll have to try for those recovery discs although I'm not worried about the files I just want to use my bleep again!!

I'm going to give format and reinstall again just because I got nothin to do now haha damn you internet.

Cheers for the help ;)

#15 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,054 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:12:40 AM

Posted 20 March 2014 - 09:22 AM

Hi,

 

It's best if you reinstall one at a time, keeping the other computers offline or off during the process. Then download and install an antivirus and do a scan. If you are connecting a usb then you need to disable autoruns first. Any files from the infected computer should be scanned too before transferring them over.

 

Nope, sality is a windows virus only. Your router should not be affected, but it will spread through networked shares so be careful of those.

 

xXToffeeXx~


Edited by xXToffeeXx, 20 March 2014 - 09:22 AM.

~If I am helping you and you have not had a reply from me in two days, please send me a PM~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users