6 Replies Latest reply on Jan 2, 2011 4:13 PM by sophos


      Good morning, every1!
      My real name is Bayan. This's my 1st post!
      I've 2 computers infected with 'Sality'!!
      The problem is No Antivirus could detect it except 2: [Ikarus- Immunet protect free]
      I installed MCAFEE, full scan, nothing found!!!
      I'd earlier managed to upload a file detected by Ikarus to virus total & threat expert:
      http://www.virustotal.com/file-scan/report.html?id=7c9fc40df401c7fb9523babb31550 a7256eaed46c5b74f730ddd9f8e979bdd8a-1285595292
      http://virusscan.jotti.org/en/scanresult/b51afefb2dfe0540e9212ae34b17b88a167a72e 2
      I'm definitely sure it's Not FALSE POSITIVE!

      How do i know? Good Question!

      1- In Threat Expert report,the same window (titled 'nsis' error) appears to me everytime i want to uninstall ANY software.
      2- What makes me believe that it's not false positive is actually 2 things:
      A) i'd a long time ago- scanned using kasper- it found 'sality.aa' & removed it, but after that, i couldn't browse any web page. i was able , however, to connect to the internet , but couldn't browse any webpage!!
      B) both ikarus & Immunet found over 100 files infected with sality, a lot of files common between the 2, so i don't think it's false positive.
      C) i once scanned with spyware Doctor, & it found worm.sality files in the registry, & all of these files contained the word 'legacy'!what does that mean?
      It's not only 1 file, ikarus & Immunet both detected more than 100 file!
      the problem is: whenever i upload a detected file to virustotal, it comes out clean, even clean by ikarus on virustotal!!!

      I hope some1 can explain how to remove it without formatting WINDOWS!!