Author Topic: Win32:Sality-AD  (Read 4536 times)

0 Members and 1 Guest are viewing this topic.

comecats

  • Guest
Win32:Sality-AD
« on: November 07, 2006, 02:24:38 PM »
Hi
My computer is saying I have a virus called Win32:sality-AD.
I have avast installed and never had any problems with it before but everytime I try and delete the virus it pops up 10 seconds later still saying i habe the virus.
Please help, I don't know what to do

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: Win32:Sality-AD
« Reply #1 on: November 07, 2006, 02:46:44 PM »
Welcome. Can you say what is the infected file name, where was it found (C:\windows\system32\infected-file-name.xxx)?
What avast! version and VPS file (virus database) number, for instance, 0646-1 (see About dialog of avast!), are you using?
The best things in life are free.

comecats

  • Guest
Re: Win32:Sality-AD
« Reply #2 on: November 07, 2006, 03:22:00 PM »
I am using version 4.7 of avast

Datei-Name                    C:\WINDOWS\System32\vmmdiag32.exe
Malware-Name                Win32:Sality-AD
Malware-type                   Virus/Worm
VPS Version                    0646-1,  11/07/2006

I hope that with this information it is possible to find some solution

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: Win32:Sality-AD
« Reply #3 on: November 07, 2006, 03:30:35 PM »
I am using version 4.7 of avast

Datei-Name                    C:\WINDOWS\System32\vmmdiag32.exe
Malware-Name                Win32:Sality-AD
Malware-type                   Virus/Worm
VPS Version                    0646-1,  11/07/2006

I hope that with this information it is possible to find some solution
Can you please try:

1) Disable System Restore on Windows XP: http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;310405
2) Clean your temporary files.
3) Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot.
4) Use a-squared, Free AVG Antispyware, SUPERantispyware or Spyware Terminator (trojan removers).
5) Boot and then enable your System Restore again (number 1).
The best things in life are free.

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89164
  • No support PMs thanks
Re: Win32:Sality-AD
« Reply #4 on: November 07, 2006, 03:48:34 PM »
Deletion isn't really a good first option (you have none left), 'first do no harm' don't delete, send virus to the chest and investigate.

Windows in its infinite wisdom protects files in use (even malware) or in system folders, so it is likely that avast! can't delete or move files in use. So schedule boot-time scan in avast's menu if you have XP, win2k or NT, otherwise boot into safe mode and run an avast scan. This should ensure that the file isn't in use and avast should be able to deal with it.

That is why you can't delete it, so you should schedule a boot-time scan, etc. follow Tech's instruction.

You might also consider proactive protection, in order to place files in the system folders and create registry entries you need permission. Prevention is much better and theoretically easier than cure.

Whilst browsing or collecting email, etc. if you get infected then the malware by default inherits the same permissions that you have for your user account. So if the user account has administrator rights, the malware has administrator rights and can reap havoc. With limited rights the malware can't put files in the system folders, create registry entries, etc. This greatly reduces the potential harm that can be done by an undetected or first day virus, etc.

Check out the link to DropMyRights (in my signature below) - Browsing the Web and Reading E-mail Safely as an Administrator. This obviously applies to those NT based OSes that have administrator settings, winNT, win2k, winXP.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.4.6112 (build 24.4.9067.762) UI 1.0.803/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

comecats

  • Guest
Re: Win32:Sality-AD
« Reply #5 on: November 07, 2006, 05:41:40 PM »
Tech, I thank for much to you the aid that you rendered to me…
seems that the solved problem this.

no longer it appears the warning of warning of avast

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89164
  • No support PMs thanks
Re: Win32:Sality-AD
« Reply #6 on: November 07, 2006, 05:57:00 PM »
Now you have a little quiet time without all he** breaking loose, I suggest you spend a little time checking out the DropMyRights link, prevention is much less painful than cure.

Welcome to the forums.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.4.6112 (build 24.4.9067.762) UI 1.0.803/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security