W/32 Sality.virus

Hi There.

I have a usb stick that has been infected with the w/32 sality virus and has spread to other computers i have.

Bit Defender has picked up the virus on my main computer but has only disinfected the infected files , does this mean the virus cant be deleted.

When I open usb drive I get the choose program box to open file with and iam unable to open the contents of portable drive , when I reboot Iam then able to open drive but not sure if it is still infected? Bit defender says its clean , but after another reboot the choose program box appears again.

The virus has also infected another computer which has no internet connection , I have installed bit defender on this computer but it is unable to start/function saying that the required services are unable to start and the liitle icon on task bar is greyed out. I tryed installing spybot but the virus stops that from running also.

This has been a really nasty virus for me and at the moment I see no way of completly getting rid of it , is there a utily/remover that will delete it from the computer with no internet connection?

Hope you can help

Thx

Find more posts tagged with

Comments

rootkit

Post here a full scan log

turtlemoon

Hello

thx for prompt reply

Do want a scan log of the usb drive or the main drive of my 1st computer

I cant give you a scan log from 2nd computer as bit defender wont start up.

thx

turtlemoon

Out of curiosity i used windows exlorer instead of the drive icon in my computer to open usb drive and was able to open contents of drive using explorer.

Did a scan of the drive with BD and it said it was clean , mybe it is something else that is causing the open program with box to appear when i try to open drive from my computer.

turtlemoon

Below is scan log of usb stick

BitDefender Log File

Product : BitDefender Antivirus 2009

Version : BitDefender UIScanner v.12

Scanning task : Contextual Scan

Log date : 23:56:26 21/10/2008

Log path : C:\Documents and Settings\Norbert\Application Data\BitDefender\Desktop\Profiles\Logs\contextual\1224629786_1_00.xml

Scan Paths:Path 0000: M:\

Scan Options:Scan for viruses : Yes

Scan for adware : Yes

Scan for spyware : Yes

Scan for applications : Yes

Scan for dialers : Yes

Scan for rootkits : No

Target Selection Options:Scan registry keys : No

Scan cookies : No

Scan boot sectors : No

Scan memory processes : No

Scan archives : Yes

Scan runtime packers : Yes

Scan emails : Yes

Scan all files : Yes

Heuristic Scan : Yes

Scanned extensions :

Excluded extensions :

Target Processing:Default action for infected objects : Disinfect

Default action for suspicious objects : None

Default action for hidden objects : None

Default action for encrypted infected objects : None

Default action for encrypted suspicious objects : None

Default action for password-protected objects : None

Scan engines summaryNumber of virus signatures : 1927369

Archive plugins : 43

Email plugins : 6

Scan plugins : 12

System plugins : 5

Unpack plugins : 7

Overall scan summaryScanned items : 53461

Infected items : 0

Suspicious items : 0

Resolved items : 0

Unresolved items : 0

Password-protected items : 0

Individual viruses found : 0

Scanned directories : 156

Scanned boot sectors : 0

Scanned archives : 27612

Input-output errors : 0

Scan time : 00:05:01

Files per second : 178

Scanned processes summaryScanned : 0

Infected : 0

Scanned registry keys summaryScanned : 0

Infected : 0

Scanned cookies summaryScanned : 0

Infected : 0

theslaz

This quote below is from one of my replies to this thread. Do what it says; these two programs have never let me down! The "Redirecting" part you can ignore; that is if you can connect to the internet. But look through the log closely. If you have a virus it will show some where in the log. If you still have problems just do a Google; there are numerous forums that will help you out. "Bitdefender" won't! They could care the least! All they want is your money for a subscription!

"You can google your problem and you will find numerous forums that deal with virus infected computers. Your problem is a common one.I had the same problem as you. Ran "Malwarebytes Anti-Malware" and it cleaned up everything. Google it and you will find the free download. You also can try "Hijackthis"; another free program; run the scan and it will create a log. Look at the log and find any entries that refer to "Redirecting". Delete those entries and you will be able to surf the web again to the sites you want. Good luck.

P.S. Don't expect any help from BD. Their support is a lot to be desired!"

Below is scan log of usb stick

BitDefender Log File

Product : BitDefender Antivirus 2009

Version : BitDefender UIScanner v.12

Scanning task : Contextual Scan

Log date : 23:56:26 21/10/2008

Log path : C:\Documents and Settings\Norbert\Application Data\BitDefender\Desktop\Profiles\Logs\contextual\1224629786_1_00.xml

Scan Paths:Path 0000: M:\

Scan Options:Scan for viruses : Yes

Scan for adware : Yes

Scan for spyware : Yes

Scan for applications : Yes

Scan for dialers : Yes

Scan for rootkits : No

Target Selection Options:Scan registry keys : No

Scan cookies : No

Scan boot sectors : No

Scan memory processes : No

Scan archives : Yes

Scan runtime packers : Yes

Scan emails : Yes

Scan all files : Yes

Heuristic Scan : Yes

Scanned extensions :

Excluded extensions :

Target Processing:Default action for infected objects : Disinfect

Default action for suspicious objects : None

Default action for hidden objects : None

Default action for encrypted infected objects : None

Default action for encrypted suspicious objects : None

Default action for password-protected objects : None

Scan engines summaryNumber of virus signatures : 1927369

Archive plugins : 43

Email plugins : 6

Scan plugins : 12

System plugins : 5

Unpack plugins : 7

Overall scan summaryScanned items : 53461

Infected items : 0

Suspicious items : 0

Resolved items : 0

Unresolved items : 0

Password-protected items : 0

Individual viruses found : 0

Scanned directories : 156

Scanned boot sectors : 0

Scanned archives : 27612

Input-output errors : 0

Scan time : 00:05:01

Files per second : 178

Scanned processes summaryScanned : 0

Infected : 0

Scanned registry keys summaryScanned : 0

Infected : 0

Scanned cookies summaryScanned : 0

Infected : 0

turtlemoon

Hello.

Iam still having problems with 1 of my computers regarding the sality virus.

No matter what virus software I install , be it spybot , superantispyware , Bitdefender , avast all have been disabled by the virus and cannot run.

I tryed malwarebytes which managed to do a scan and found the problems relating to task manager being disabled and regedit disabled but upon reboot the virus strikes again.

There must be something I can use that disables/delete's the virus that does not require an internet connection.

Iam a little disapointed by the lack of help regarding my problem , and iam seriously considering another antivirus product.

Thx for any help offered.

Niels

Hello theslaz,

This is only a user forum. If you want to get real support you need to log in into your online account or contact liveassistance.

Kind regards,

Niels

Hello turtlemoon,

Please download this bootable image. Burn it as an bootable image. Print the following instructions. See here for how to update. Put the bootable disk and reboot that pc. And perform a scan.

Please download flash disinfector from this location. Attach your portable drive. Now double click on Flash_Disinfector to run it and follow the steps.

Can you please download combofix you will find it here. Print the following instructions and read them carefully. Please post the output of the scan into your next post.

Kind regards,

Niels

theslaz

That is where "Hijackthis" comes in. It will show a log of everything that is running on your computer as well as a list of all the commands that are executed by your computer on start up. Delete the proper entries and you'll disable the virus. If your not sure what to disable; do a google and go to a forum that will help you out. Also Combofix will help you; but again you have to be careful. Just follow the directions and do everything it suggests. Keep picking away; you'll get rid of it!

I have dumped BitDefender and am currently subscribed to another anti virus program. BitDefender is a lot to be desired. Too many problems. I still have problems with BitDefender in that it won't go away. I've used it's own uninstall program and it still comes back trying to make entries in my registry! My "Ad-Aware" program blocks it from doing so; but it is annoying. Poorly written program as far as I'm concerned. Haven't had one problem in three weeks with the anti virus program that I finally chose. Enough said!

Hello.

Iam still having problems with 1 of my computers regarding the sality virus.

No matter what virus software I install , be it spybot , superantispyware , Bitdefender , avast all have been disabled by the virus and cannot run.

I tryed malwarebytes which managed to do a scan and found the problems relating to task manager being disabled and regedit disabled but upon reboot the virus strikes again.

There must be something I can use that disables/delete's the virus that does not require an internet connection.

Iam a little disapointed by the lack of help regarding my problem , and iam seriously considering another antivirus product.

Thx for any help offered.