Help me out getting rid of sality.NAQ

Although malware may use random file names most do not bother to spoof the creation dates.
If you scan for files around the time of the infection then you would have a better idea which files need renaming / removing.

Richard S.

Hello, Spynet.

Win32.Sality uses random filenames. So it will not be possible to tell you the name of the driver file (%variable%.sys) or the executable names (%temp%\win%variable%.exe and %temp%\%variable%.exe)

Yet, the Eset writeup on Win32.sality.naq combined with the Sysmantec writeup on w32.sality.ae should be good starting points for hunting the beast down and getting rid of it.

The bigger trouble is that it is a file infector. This means even if you remove the original malware files completely, the changes which it will have applied to other executable files will not be undone. So any executable file may cause a re-infection when it is launched.

Kind regards,
SvenBomwollen