Win32/Sality Trojan Virus

Has anyone been able to detect Win32 Sality Trojan usning their Norton Anti-Virus product?  My Norton 360 did not detect it.  However, my SpyZooka software detected it.  SpyZooka attempted to remove the virus, but on the next scan it was there again.  Therefore, SpyZooka does not adequately remove the virus, but Norton does not even detect it.  Help please.

Here is what Spyzooka sent to me on this issue:

 

Bryce   ·   June 4 2012, 01:09 PM
Tried using the Silaty virus removal tool from Kapersky but it couldn't find any infection. the only program that seems to think i have the virus is Spyzooka.
Bryce   ·   June 3 2012, 08:00 PM
Also did full scan with SuperAntispyware and found nothing
Bryce   ·   June 3 2012, 03:43 PM

 

 

The errors that you are seeing are keys that are protected by windows. These keys cannot be removed. With our most recent update there is a bug that allows RegZooka to see these keys. We are currently working on allowing our software the ability recognize the keys. The issue should be fixed in the next update. The error win32.virus.silaty. is something we need to loo kfurther into to get resolved for you. please give us a call at your earliest time at 800-290-9809.


Thanks,

Bryce


Bryce   ·   June 3 2012, 02:13 PM
used Windows Malicious Software Removal tool, quick scan and it found no malicious software, now doing a full scan

Bryce   ·   June 3 2012, 01:51 PM
Spyzooka finds but cannot remove a trojan virus, win32.virus.silaty. I copied report and attached. Please help if possible. Have Norton, did not find this virus when scanned. I followed instructions if couldn't submit report from program and went to www.spyzooka.com/report, ended up at this page.

Bryce,

 

Thank you for your reply.  I have contacted SpyZooka as well and they say they are trying to get a solution.  It is end of June now and latest update didn't help.  SpyZooka's scan has now turned up another Trojan virus called win32.Packed.Krap possibly allowed in through the gate opened by the Sality Virus.  See attached section of report showing the registration files corrupted. 

 

Have you been able to clean your system yet? 

 

I have purchased Acronis True Image since having these problems and when I get it cleaned, I will do a full sector by sector backup.  If I ever have the problem again, I will wipe the hard disk and reloade. 

 

I am contacting SpyZooka again tonight. 

 

Good luck.  Reed

I don't like the fact, if it's the case SpyZooka is in realtime with Norton

 

Do you have Safe Mode??

 

Quads

Yes I tried in safe mode and not in safe mode.  Turns out that the Sality virus was real, changed permissions on some of my Windows registry items and thus was not letting SpyZooka repair the system.  Got ahold of SpyZooka Tech Help (JOE) and he was able to slve the problem by logging into my computer and using their applications fix the problem.  My system is clean as a whistle now.  I attached a copy of the SpyZooka session where Joe solved the problem. 

 

It does concern me that Norton 360 and several other virus, spyware programs could not even see the problem.  When I contracted the virus, I had been religiously monitoring the system using Norton 360 and periodically running scans with both Norton and SpyZooka.  I had just run a full scan with Norton 360 and it did not see the virus.  Then I ran a full scan with SpyZooka and it found it immediately.

 

My problems is now fully solved!


methusa wrote:

It does concern me that Norton 360 and several other virus, spyware programs could not even see the problem. 


Major security programs do not all miss something as prominent as Sality.  This really still has all the trappings of a Spyzooka false positive:

 

1. No other security product found the threat.

2. Earlier posted comments from Spyzooka refer to the registry findings as "errors" rather than detections.

3. Spyzooka admitted that the "Krap" detection is a false positive that will be fixed in an upcoming update.

 

Did you actually have any symptoms of a Sality infection?  I think this raises more questions about the accuracy of Spyzooka than it does about the other top-tier products that were all in agreement with each other that your system was clean.

Has anyone been able to detect Win32 Sality Trojan usning their Norton Anti-Virus product?  My Norton 360 did not detect it.  However, my SpyZooka software detected it.  SpyZooka attempted to remove the virus, but on the next scan it was there again.  Therefore, SpyZooka does not adequately remove the virus, but Norton does not even detect it.  Help please.