How to remove Sality Trojan from infected devices
Written by Tomas Meskauskas on (updated)
What is Sality Trojan?
Sality is an old family of various malware. Although it originates from 2003, it is relevant today, since developers continually update these viruses and add new features.
They are proliferated in various ways, but mostly by cyber criminals employing spam email campaigns. They send thousands of deceptive emails encouraging users to open malicious attachments that stealthily infect the system.
Sality malware family overview
Deceptive emails typically contain the logos of various legitimate companies or governmental agencies, and encourage users to open attachments (in most cases, MS Office documents). Cyber criminals often use this deceit, since it is much simpler to trick unsuspecting users to open files when they are received from recognizable names.
Once infiltrated, Sality Trojan viruses hijack executable files and inject them with malicious code. The injected code varies depending on infiltrated malware, and the resultant actions also differ accordingly. For example, the viruses might connect the system to a botnet, open "backdoors" for other viruses to infiltrate the system, act as a rootkit, and so on.
Also, they use specific techniques to alter its code with each infection, making it hard for antivirus programs to detect. They create a P2P botnet for activities like data theft and DDoS attacks, disable antivirus and firewall protections, and employ rootkit methods to hide themselves.
These Trojans also modify the system's hosts file to block access to security websites and enables attackers to remotely update and control infected systems. Therefore, the Sality Trojan malware family poses a significant threat to computer safety, and to your privacy. The malware must be eliminated immediately.
If you have recently opened suspicious email attachments, downloaded/installed dubious software, detected suspicious entries in the list of running processes, and believe that your computer is infected, you should immediately scan it with a reputable anti-virus/anti-spyware suite and eliminate all detected threats .
| Name | Sality trojan malware |
| Threat Type | Trojan, password-stealing virus, banking malware, spyware. |
| Detection Names | Avast (Win32:Kukacka), BitDefender (Win32.Sality.OG), ESET-NOD32 (Win32/Sality.NAR), Kaspersky (Virus.Win32.Sality.gen), Full List (VirusTotal) |
| Symptoms | Trojans are designed to stealthily infiltrate the victim's computer and remain silent, and thus no particular symptoms are clearly visible on an infected machine. |
| Distribution methods | Infected email attachments, malicious online advertisements, social engineering, software 'cracks'. |
| Damage | Stolen passwords and banking information, identity theft, the victim's computer added to a botnet. |
| Malware Removal (Windows) | To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. |
Malware of this type in general
There are hundreds of trojan-type viruses available on the Internet. The list of examples includes (but is not limited to) TrickBot, LokiBot, Emotet, FormBook, and Pony. Although most of these viruses record sensitive data (logins/passwords, web browsing activity, etc.), their behavior can sometimes differ.
In some cases, trojans also proliferate other viruses (usually ransomware), mine cryptocurrencies, and abuse the system to run other unwanted processes. Therefore, no matter which trojan has infiltrated your computer, it must be uninstalled immediately, since the presence of this rogue software can lead to serious privacy issues and high-risk computer infections.
How did Sality Trojan infect my computer?
Trojans are proliferated in various ways. One method uses malicious email attachments. By opening these attachments, users inadvertently execute scripts that stealthily download and install malware.
Cyber criminals also proliferate malware using fake software updaters and third party software download sources (peer-to-peer [P2P] networks, freeware download websites, free file hosting websites). Fake updaters infect the system by exploiting outdated software bugs/flaws or simply downloading malware rather than updates.
Unofficial download sources present malware as legitimate software, thereby tricking users into downloading and installing viruses. Ultimately, the main reasons for computer infections are poor knowledge and careless behavior.
How to avoid installation of malware?
The key to computer safety is caution. Therefore, pay close attention when browsing the Internet and downloading/installing software. Carefully analyze each email attachment received. Never open files that seem irrelevant or have been received from dubious email addresses.
In addition, keep installed applications up-to-date, however, to achieve this, use implemented functions or tools provided by the official developer only. Software should be downloaded from official sources, using direct download links. Third party downloaders/installers proliferate rogue apps, and thus should never be used.
We also strongly recommend that you have a reputable anti-virus/anti-spyware installed and running all the time. If you believe that your computer is infected with Sality Trojan, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.
Malicious attachment distributing Sality Trojans:
Sality trojan's process ("Internet Connection Wizard...") in Windows Task Manager:
Instant automatic malware removal:
Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.
Quick menu:
How to remove malware manually?
Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows.
If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:
If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:
Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:
Restart your computer into Safe Mode:
Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.
Video showing how to start Windows 7 in "Safe Mode with Networking":
Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup.
Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings".
Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.
Video showing how to start Windows 8 in "Safe Mode with Networking":
Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".
In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.
Video showing how to start Windows 10 in "Safe Mode with Networking":
Extract the downloaded archive and run the Autoruns.exe file.
In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.
Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.
You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".
After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.
Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.
These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software. To be sure your computer is free of malware infections, we recommend scanning it with Combo Cleaner Antivirus for Windows.
Frequently Asked Questions (FAQ)
My computer is infected with Sality malware, should I format my storage device to get rid of it?
Formatting your storage device is a drastic but effective measure and should be used only as a last resort. We recommend first trying to remove malware with trusted security software before resorting to formatting.
What are the biggest issues that malware can cause?
Malware attacks can lead to issues such as losing access to personal accounts, identity theft, financial loss, further infections, and more.
What is the purpose of Sality malware?
The purpose of Sality Trojan malware is to hijack executable files and inject them with malicious code, enabling it to connect systems to botnets, open backdoors for additional malware, and hide its presence using rootkit techniques. It also creates a P2P botnet for data theft and DDoS attacks while disabling security protections and blocking access to security websites.
How did Sality Trojan malware infiltrate my computer?
It is very likely that Sality Trojan malware has entered your computer via a file or a link sent by cybercriminals via email.
Will Combo Cleaner protect me from malware?
Yes, Combo Cleaner can detect and remove nearly all known malware infections. However, sophisticated malware often hides deeply within the system, so performing a full system scan is required to eliminate such malware.
Outstanding!
▼ Show Discussion