I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:
Free Download Fully Functional 30-day Trial. No credit card is required.
Reviews. EULA. Privacy Policy. Uninstall.
Virus Sality
Also known as: Trojan Eldorado
SHA256: e1f1fc116cd8d2416fdd23e0f78ee1aaea3ba4d10806e397a0aa6396e8bb5b47
SHA1: 8a23e229f11230a26ab58f3f374cdd0d9b95e832
MD5: b75b0770505f4fb71eb73d29775b5973
File size: 183808 bytes
Created files:
C:\windows\system32\msga32.dll – Virus Sality
C:\windows\system32\msrw.exe – Virus Sality
Virus Sality created autostart registry keys:
HKLM\Software\Classes\CLSID\{E4883584-CA94-AF0B-01CD-88F1005ADC02}\InprocServer32 : c:\windows\System32\msga32.dll
HKLM\Software\Classes\CLSID\{E4883584-CA94-AF0B-01CD-88F1005ADC02}\InprocServer32\ThreadingModel: Both
HKLM\Software\Microsoft\Active Setup\Installed Components\{E4883584-CA94-AF0B-01CD-88F1005ADC02}\StubPath: c:\windows\System32\msrw.exe
HKLM\System\CurrentControlSet\Services\wscsvc\Start: 04000000