Virus.Win32.Sality.AA
Virus.Win32.Sality.AA is actually not a typical virus – it is a Trojan Horse, which means that it doesn’t replicate its files, so finding its data, and processes, and removing them should ensure that the infection is gone, as there wouldn’t be any copies of its files made in other system locations. Finding the related Virus.Win32.Sality.AA files, processes, and Registry keys, however, isn’t an easy task.
Multiple antivirus programs in VirusTotal detect the Virus.Win32.Sality.AA trojan
If you think that your computer may have been infiltrated by a virus named Virus.Win32.Sality.AA, you should definitely keep on reading in order to learn exactly what you are dealing with, as well as what you can do in order to get it away from your system.
Since we are talking about a Trojan Horse here, you need to understand that these threats are very good at keeping their elements in the system disguised. A Trojan may, for instance, give its process or its files the same names that actual system processes and files have. This could not only make it more difficult to find the Trojan Horse-related component, but it also increases the risk of deleting something in your system, or ending a process that are important to the normal functionality of the computer. This is why you should only try to remove the Trojan if you know what you are doing. The purpose of the guide which follows this article is exactly that, to teach you where the potential locations of the malware processes, files, and Registry keys are, and to show you how you may be able to recognize them. However, it is always possible that you may make a mistake, or that you may be unsure about a certain element. This is why we also advise you to use the removal tool from the guide, and also to contact us via the comments section in case you have any difficulties with the elimination process of the Trojan.
What are the potential types of harm?
A Trojan is usually a malicious program that can be used for more than one purpose. It may be utilized as an espionage tool, as a remote-control tool, as a backdoor, or as something else. This means that such an infection may be able to gather sensitive info from your machine, spy on what you are doing online and offline, insert other infections like Ransomware in your computer, or even give the hackers behind it remote control over your system. Virus.Win32.Sality.AA is a very new infection, and the security researchers are still unsure about what it’s actual end goal might be. Nevertheless, you surely do not want to find out what this infection may be trying to achieve while in your computer, and that is why we urge you to go to our guide, and follow the steps presented in it. Also, remember to keep your computer safe in the future by not allowing any sketchy files to get downloaded on it – do not open spam letters, do not click on ads that look questionable, and do not download stuff from websites that aren’t reliable.
SUMMARY:
| Name | Virus.Win32.Sality.AA |
| Type | Trojan |
| Danger Level | High (Trojans are often used as a backdoor for Ransomware) |
| Detection Tool |
Remove Virus.Win32.Sality.AA Trojan
If you have a Windows virus, continue with the guide below.
If you have a Mac virus, please use our How to remove Ads on Mac guide.
If you have an Android virus, please use our Android Malware Removal guide.
If you have an iPhone virus, please use our iPhone Virus Removal guide
Some of the steps will likely require you to exit the page. Bookmark it for later reference.
Reboot in Safe Mode (use this guide if you don’t know how to do it).
WARNING! READ CAREFULLY BEFORE PROCEEDING!
Press CTRL + SHIFT + ESC at the same time and go to the Processes Tab. Try to determine which processes are dangerous.
Right click on each of them and select Open File Location. Then scan the files with our free online virus scanner:
After you open their folder, end the processes that are infected, then delete their folders.
Note: If you are sure something is part of the infection – delete it, even if the scanner doesn’t flag it. No anti-virus program can detect all infections.
Hold together the Start Key and R. Type appwiz.cpl –> OK.
You are now in the Control Panel. Look for suspicious entries. Uninstall it/them. If you see a screen like this when you click Uninstall, choose NO:
Type msconfig in the search field and hit enter. A window will pop-up:
Startup —> Uncheck entries that have “Unknown” as Manufacturer or otherwise look suspicious.
- Remember this step – if you have reason to believe a bigger threat (like ransomware) is on your PC, check everything here.
Hold the Start Key and R – copy + paste the following and click OK:
notepad %windir%/system32/Drivers/etc/hosts
A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:
If there are suspicious IPs below “Localhost” – write to us in the comments.
Type Regedit in the windows search field and press Enter.
Once inside, press CTRL and F together and type the virus’s Name. Right click and delete any entries you find with a similar name. If they don’t show up this way, go manually to these directories and delete/uninstall them:
- HKEY_CURRENT_USER—-Software—–Random Directory. It could be any one of them – ask us if you can’t discern which ones are malicious.
HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run– Random
HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random
If the guide doesn’t help, download the anti-virus program we recommended or try our free online virus scanner. Also, you can always ask us in the comments for help!
Leave a Comment