Combofix has been infected with Sality! Do Not use!

By +Warwagon
in Smart Home, Network & Security

 Share

Recommended Posts

Grand Master

+Warwagon MVC

Posted
  • MVC
Posted

Combofix has been infected with Sality! Do Not use!!!!

Unfortunately it has come to light that the program ComboFix had a file in it that is infected with the Sality virus. The minute we heard about this, we pulled the executable so that it is no longer available from BleepingComputer.com. Unfortunately we have no control over other sites that may have mirrored ComboFix without permission, so please do not attempt to download it elsewhere.

The developer, sUBs, is currently looking into what happened and when I have a full update, I will be sure to let you know. From the limited information that I have, it appears that the affected version has been available since approximately 2am EST on January 29th, but it may have been earlier. If this timeframe changes, I will update this topic to let you know. If you have used a new copy of ComboFix in the last day or so, then you should examine your system for possible infection. If you have used a copy of ComboFix prior to this version, then you should be ok.

SHA256 Hashes of known affected versions are:

4524611a78ddd40afa7e13238da230302786c546d1f824e6e7dea480a5d55333

e5341c3c32a9726a2d3dd1ac0b90f13d896581ab8707dd0a17431df061a2a71d

4524611a78ddd40afa7e13238da230302786c546d1f824e6e7dea480a5d55333

e95f77fd437b16312fbd66a02fed8b179968a7615c1bd3cd3b2fd86879b4bbc8

In the meantime, it is important for those who may have used ComboFix recently and are concerned they are infected to get the help they need. As the Sality infection has been around for a while, almost all antivirus vendors will have detected it and blocked it when you ran ComboFix. Unfortunately, not everyone has up-to-date virus definitions or uses an AV program, so it is important to examine your system if you have downloaded a new copy and used it since 2am EST.

The steps we suggest you take to make sure your computer is not infected are:<p>

http://www.bleepingcomputer.com/forums/topic483431.html

Grand Master

farmeunit

Posted
Posted

Just downloaded and used combo fix yesterday. Also scanned with MSE, Malwarebytes, and Spybot afterwards. None of the scans picked up anything but i'm scanning with ESET's Online Scanner now just in case.

Thanks for the heads up warwagon.

Luckily, you got it before the infection if you downloaded yesterday.

Grand Master

+Warwagon MVC

Posted
  • Author
  • MVC
Posted

Yeah but it seems I'm infected anyhow.

Yr2GFFj.png

How all these scanners I've used and they all missed all at...smh I guess its been a few years since I formatted anyway.

Those might not be infections per say, just the exploit files left over in your java cache folder. What are the locations of those files?

Grand Master

soldier1st

Posted
Posted

Those might not be infections per say, just the exploit files left over in your java cache folder. What are the locations of those files?

He should turn off java's temp file option. I used to see those exploit names on users pc's, but since i turn off the temp file option, i haven't seen those appear.

Grand Master

Marshall Veteran

Posted
  • Veteran
Posted

Unfortunately it has come to light that the program ComboFix had a file in it that is infected with the Sality virus. The minute we heard about this, we pulled the executable so that it is no longer available from BleepingComputer.com. Unfortunately we have no control over other sites that may have mirrored ComboFix without permission, so please do not attempt to download it elsewhere.

The developer, sUBs, is currently looking into what happened and when I have a full update, I will be sure to let you know. From the limited information that I have, it appears that the affected version has been available since approximately 2am EST on January 29th, but it may have been earlier. If this timeframe changes, I will update this topic to let you know. If you have used ComboFix in the last day or so, then you should examine your system for possible infection. If you have used a copy of ComboFix prior to this version, then you should be ok.

Quote from BleepingComputer Admin:

ComboFix is now live, clean, and available to download from its normal links.

They have it sorted apparently, the executable is now live again at BleepingComputer.

Read More Here

Grand Master

goretsky Supervisor

Posted
  • Supervisor
Posted

Hello,

I am unsure of how that might have helped in this particular situation. From what I understand of the issue, it was the build machine that was infected.

Regards,

Aryeh Goretsky

Grand Master

HawkMan

Posted
Posted

Yeah but it seems I'm infected anyhow.

Yr2GFFj.png

How all these scanners I've used and they all missed all at...smh I guess its been a few years since I formatted anyway.

That's not sality, trust me :)I cleaned a few computers from it, and it's specifically say w32 something sality. it'll also start writing stuff to any USB stick you put in it.

The only tool that managed to get rid of it was the Kaspersky sality killer, followed by the Sality remover which I believe is form AVG based on the logo.

I'm guessing this was an unsigned executable? Time to get a code signing certificate.

Thing is, if you had an infected combofix, it didn't actually run, it'd just give an error that it was invalid, but sality would still infect since it had taken over the exe, but combofix itself wouldn't run with the infected file.

Good thing they got it fixed anyway, since it's the absolute best tool to clean computers.

the computer I cleaned g in with sality got it from somewhere else though, since that person wouldn't know a virus cleaner if it slapped her in the face. over 600 infected files, a lot of them sality, but also a whole bunch of other stuff.

be warned that sality does appear to somehow get through even with autplay off. if you're cleaning. Her computer will need a full recovery though, hopefully it doesn't infect the recovery partition.

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • Elgato Stream Deck+ is now available at the lowest price

      By TarasBuria · Posted

      Elgato Stream Deck+ is now available at the lowest price by Taras Buria During Amazon Prime Day 2026, Elgato is offering a big discount on its Stream Deck+ accessory. This streaming and productivity accessory is now available for $141.99, thanks to a 21% discount. For those unfamiliar, the Stream Deck+ is a console-like device that features eight buttons with built-in displays. You can map these buttons to various actions and specify what each display shows. Unlike "classic" Stream Decks, the Plus model features four additional knobs for adjusting zoom, brightness, volume, microphone, and more. Above the knobs, there is a wide display that shows various values and sliders. Elgato's Stream Deck devices are highly customizable devices, and you can expand their capabilities using hundreds of plugins from the official Elgato Marketplace. You can create your own presets or use pre-made profiles to save time when configuring the device for specific apps. In the box, you get the Stream Deck+ itself, a USB Type-C to Type-C cable, and a user manual. The Stream Deck+ is a single-cable device, and all you need to set it up is to connect it to your computer and install the official Elgato app. Elgato Stream Deck+ - $141.99 | 21% off for Prime Members Good to know This Amazon deal is U.S. specific, and not available in other regions unless specified. We only use first-party seller links (at the time of article publishing); ensure that you purchase from a first-party seller link only. Check out Today's Deals on Amazon or our recent tech deals. Become a Prime member (for Students or SNAP) via Neowin Get Prime Access - Prime for half price (for qualifying Medicaid, EBT, SNAP) Subscribe to Prime Video, Audible Plus, Music Unlimited or Kindle Unlimited via Neowin As an Amazon Associate, we earn from qualifying purchases.
    • Rufus alternative Ventoy now supports Windows 11's mandatory update, fixes major boot bug

      By Zeromus2003 · Posted

      Can you give an example of when you would want to use Rufus over the other or vice versa? Just wondering which is the "best".
    • Steam Summer Sale 2026 kicks off offering weeks of PC game discounts

      By Zeromus2003 · Posted

      Oh no...the wallet is already screaming. So many games and so little time. Being old and responsible is awful!
    • LibreWolf 152.0.2-1

      By Copernic · Posted

      LibreWolf 152.0.2-1 by Razvan Serea LibreWolf is an independent “fork” of Firefox, with the primary goals of privacy security and user freedom. It is the community run successor to LibreFox. LibreWolf is designed to increase protection against tracking and fingerprinting techniques, while also including a few security improvements. This is achieved through our privacy and security oriented settings and patches. LibreWolf also aims to remove all the telemetry, data collection and annoyances, as well as disabling anti-freedom features like DRM. LibreWolf features: Latest Firefox — LibreWolf is compiled directly from the latest build of Firefox Stable. You will have the the latest features, and security updates. Independent Build — LibreWolf uses a build independent of Firefox and has its own settings, profile folder and installation path. As a result, it can be installed alongside Firefox or any other browser. No phoning home — Embedded server links and other calling home functions are removed. In other words, minimal background connections by default. User settings updates Extensions firewall: limit internet access for extensions. Multi-platform (Windows/Linux/Mac/and soon Android) Community-Driven Dark theme (classic and advanced) LibreWolf privacy features: Delete cookies and website data on close. Include only privacy respecting search engines like DuckDuckGo and Searx. Include uBlockOrigin with custom default filter lists, and Tracking Protection in strict mode, to block trackers and ads. Strip tracking elements from URLs, both natively and through uBO. Enable dFPI, also known as Total Cookie Protection. Enable RFP which is part of the Tor Uplift project. RFP is considered the best in class anti-fingerprinting solution, and its goal is to make users look the same and cover as many metrics as possible, in an effort to block fingerprinting techniques. Always display user language as en-US to websites, in order to protect the language used in the browser and in the OS. Disable WebGL, as it is a strong fingerprinting vector. Prevent access to the location services of the OS, and use Mozilla's location API instead of Google's API. Limit ICE candidates generation to a single interface when sharing video or audio during a videoconference. Force DNS and WebRTC inside the proxy, when one is being used. Trim cross-origin referrers, so that they don't include the full URI. Disable link prefetching and speculative connections. Disable disk cache and clear temporary files on close. Disable form autofill. Disable search and form history...and more. Download: LibreWolf 64-bit | Portable 64-bit | ~100.0 MB (Open Source) Download: ARM64 | Portable ARM64 Links: LibreWolf Home Page | Addons | Screenshot | Reddit Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Hands on with iFlyTek AINote 2 E-Ink tablet: insanely thin and smart

      By TarasBuria · Posted

      Hands on with iFlyTek AINote 2 E-Ink tablet: insanely thin and smart by Taras Buria During Amazon Prime Day 2026, iFlyTek is offering its E-Ink tablets with big discounts. The AINOTE 2 is now available at 20% off, allowing you to save quite a lot on one of the thinnest E-Ink tablets out there. I was offered a chance to look at the device, so here are my impressions. The AINOTE 2 is a large 10.65-inch E-Ink tablet that strikes you the moment you take it out of the box. It is extremely thin. At just 4.2 mm, this tablet is at the edge of what is possible for a device with a USB Type-C port. It is also very light, which makes it comfortable and enjoyable during long reading sessions. The tablet has a gold metal chassis with the front and back made of plastic. The back also features four rubber feet that prevent it from sliding around your desk when writing. Besides a USB Type-C port and an LED indicator, there are two buttons mounted on the top edge: a power button with a built-in fingerprint scanner and a dedicated AI button. I would say the fingerprint scanner is quite mid. Given that iFlyTek positions the device as a digital notebook, it makes sense to have a biometric scanner to protect sensitive information. However, it is not the fastest fingerprint reader, and sometimes it fails to recognize my finger. I assume that is due to the tablet's insane thinness. A dedicated AI button is an interesting choice, especially in the middle of the top edge. I can see this button being useful for those who heavily rely on AI and use it frequently, but I cannot help but think its placement is impractical. Having it on one of the longer sides would make so much more sense. The AINOTE 2 is a very pretty device. Gold finish with thin chassis and nearly symmetrical front bezels create a fantastic combination, and iFlyTek cleverly hides the front chin with a section that looks like an extension of the screen, housing two touch-capacitive buttons: one for AI and one for quick notes. This section can also scroll pages when you swipe from the middle to the left or right. It is a cool idea, and very handy when you need to scroll tens of pages at once. AINOTE 2's elegant look extends from its exterior to its software. The user interface is very clean and not cluttered with an abundance of buttons. The tablet prioritizes the note-taking experience, and when you unlock it, it defaults to the list of all notes and folders. Additionally, there is a separate "Schedule" section with your calendar, tasks, memos, and other productivity features. You can connect your Outlook or Google account or use a local calendar. The tablet has quite a lot of AI features powered by OpenAI's GPT-5 and Google's Gemini 3. Besides a standard app with all your chats, you can invoke AI by pressing its dedicated button and dictating your request. It is not limited to just chats. It works with the built-in calendar, and you can tell it to create events, tasks, notes, and more. Additionally, AI features are integrated into the built-in notepad, allowing you to summarize notes, ask questions about your notes, and more. The tablet can OCR handwritten text in different languages (about 120 languages, which is very impressive), and it surprised me with very good accuracy. Voice note transcription is also available, including a "multiplayer" mode where the tablet detects each speaker. Unfortunately, the AINOTE 2 has no built-in speakers (even though it somehow makes a tapping noise when you flip pages using the Quick Bar), so the only way to listen to something is to connect a Bluetooth speaker or headphones. However, there are four front-facing mics for dictation, voice notes, AI chats, and more. Unfortunately, certain features require a Pro subscription that costs $5.99/mo or $59.99/year. Those include offline voice transcription, access to better AI models, the ability to edit notes on a PC or mobile app, and extended service coverage similar to Apple Care. It is a bummer to see yet another app, especially in a device that costs $649, but at least they give a free 90-day trial so that you can see if the benefits justify the price. As for the reader, it supports PDF, EPUB, TXT, MOBI, AZW3, DOC(X), XLS(X), PPT(X), JPEG, JPG, and PNG. The app is quite customizable, with features like text contrast/boldness/size adjustments, margins and spacing customization, and the ability to load custom fonts. Plus, you can annotate books with the stylus, add text notes, and use AI to work with them. Just keep in mind that most AI features require an active internet connection. Like with other E-Ink tablets with Android inside, you can load any other reader you want from the Google Play Store or a third-party source. Despite its hefty price tag of $629 or $519 by the time of publishing this article during Prime Day 2026, the AINOTE 2 has quite modest hardware inside. There is only 4 GB of RAM and about 42GB of storage. It is powered by the RockChip RK3576 processor with 8 cores at 2.2 GHz. Given that the tablet runs Android 14 and has Google Play, you can install Android apps, but do not expect much from this thing performance-wise. As for the battery, there is a 4,000 Li-Ion battery, which, on full charge, lasted me for about one week of active daily use of reading and note-taking. The screen has a resolution of 1920x2560 pixels, which equals 300 PPI, a perfect spot for a sharp, nice-to-read display. It supports EMR styluses that do not require charging, and I have to say that the note-taking experience on this tablet is fantastic. Stylus lag is nearly imperceivable, creating a very natural, paper-like feel. The stylus comes in the box (including two extra nibs), and it features an extra button for various actions and an eraser on top. It magnetically attaches to the tablet and stays safely secured. The stylus has a very nice coarse texture, and thanks to using Wacom tech, you can swap it for any other EMR pen if you wish. The AINOTE 2 has no front light, and because of that, the display sits very close to the screen surface, reducing the distance between the stylus tip/your finger and the display to a minimum. No front light is certainly an inconvenience in certain scenarios, but the screen makes up for that with a seriously impressive paper-like feel and writing experience. In dark conditions, you will have to find a lamp, but the good thing is that the screen has a solid anti-glare surface that diffuses light. The display has two modes: Crisp and Fast. Crisp ensures the image stays, well, crisp and sharp, while Fast speeds up refresh rate and response by toning down display resolution and making everything a bit more jagged. In my testing, I only used Fast mode when browsing the web for a much faster render time. The iFlyTek AINOTE is an impressive device, but it's not flawless. A few things disappointed me during a week of using it. Software localization has a bunch of not necessarily broken, but certainly awkward, machine-translated English. System navigation is not good, as there is no universal "Home" gesture. To go to the main page, you have to swipe up and then press the Home button from the multi-tasking window. There are many gestures for various actions, such as display cleanup, screenshot, undo/redo, but no back/forward or Home gestures. I really hate that the tablet won't let me update its software without creating an iFlyTek account first. Finally, privacy could be a concern for some, as most tablets' features require an active internet connection, an iFlyTek account, and sharing data when using AI. If you can overlook its quirks, some of which could be addressed with software updates (I received two with massive changelogs over a single week), and accept a $519 price tag (with a discount), you will be happy with the AINOTE 2. However, if you do not need that many AI features in an E-Ink reader or you want something a bit more affordable, you'd better look at cheaper competitors from BOOX or Amazon, such as the BOOX Go 10.3 Gen 2 or the Kindle Scribe, which is currently 24% off during Prime Day sales. Buy iFlyTek AINOTE 2 on Amazon - $519 | 20% off with Prime What I liked What I disliked Very impressive hardware Beautiful design Fantastic display with an EMR stylus Supports offline voice transcription Easy-to-use software Clever, useful, and well-made AI features A fingerprint scanner Very expensive Some features require a subscription Poor system navigation Mandates a user account No speakers Privacy could be a concern Note: iFlyTek provided the review unit without any editorial input or review guidance. As an Amazon Associate, we earn from qualifying purchases.

  • Recent Achievements

    • First Post
      kinowa earned a badge
      First Post
    • Rookie
      krychek57 went up a rank
      Rookie
    • Grand Master
      Jaybonaut went up a rank
      Grand Master
    • One Year In
      Philsl earned a badge
      One Year In
    • Dedicated
      Scoobystu earned a badge
      Dedicated

  • Popular Contributors

    1. 1
      +primortal
      416
    2. 2
      +Edouard
      168
    3. 3
      PsYcHoKiLLa
      132
    4. 4
      Xenon
      73
    5. 5
      Michael Scrip
      73
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!