Smokey's Security Weblog

veritas odium parit

[UPDATED / SOLVED] Be aware: malware removal program ComboFix probably infected with Sality virus

According to Marcos, employee of security solutions vendor ESET, the well-known malware cleaning/removal program ComboFix created by sUBs is infected with the Sality virus. It seems that the current installer ComboFix contains an infected file, namely iexplore.exe

I haven’t checked the issue, however have to assume that ComboFix is indeed infected with the Sality virus, especially because other security vendors have confirmed the infection.

Please don’t download and use ComboFix until the author, sUBs, remedies the issue.

UPDATE 1: Infection is confirmed by a reliable source.

UPDATE 2: To be 100% sure I checked the issue by myself, ComboFix is indeed infected by Sality.

UPDATE 3: Added a temporary Google Drive downloadlink to obtain most recent CLEAN ComboFix.exe

Data of this clean version:

Combofix.exe
Version 13.1.28.1
Copyright sUBs
5.028.179 bytes

MD5 CHECKSUM: 0F6D28A70471051C4C7785335ACBA626

SHA256 CHECKSUM:

hex: 361548f74415a41f00d5345b3e3c489b3282b302c0c51266880eda586db01a12
HEX: 361548F74415A41F00D5345B3E3C489B3282B302C0C51266880EDA586DB01A12
h:e:x: 36:15:48:f7:44:15:a4:1f:00:d5:34:5b:3e:3c:48:9b:32:82:b3:02:c0:c5:12:66:88:0e:da:58:6d:b0:1a:12
base64: NhVI90QVpB8A1TRbPjxImzKCswLAxRJmiA7aWG2wGhI=

Download: removed

UPDATE  4 / FINAL UPDATE / 2013-01-30 22:00: problem infected ComboFix solved, clean ComboFix.exe is now live again, and available to download from its normal Bleeping Computer downloadlink here.

Because the problem is now solved I have removed the temporary downloadlink clean ComboFix.exe

January 29, 2013 Posted by | Advisories, Alerts, Anti-Virus, Malware, Vulnerabilities | , , , , , , | 4 Comments