McAfee Labs - Combating Threats - W32/Sality Virus

Segundo o paper da McAfee chamado Combating Threats - W32/Sality Virus segue abaixo a lista dos domínios que o Sality acessa:


hxxp://89.119.67.154
hxxp://kukutrustnet777.info
hxxp://kukutrustnet888.info
hxxp://kukutrustnet987.info
hxxp://www.kjwre9fqwieluoi.info
hxxp://bpowqbvcfds677.info
hxxp://bmakemegood24.com
hxxp://bperfectchoice1.com
hxxp://bcash-ddt.net
hxxp://bddr-cash.net
hxxp://btrn-cash.net
hxxp://bmoney-frn.net
hxxp://bclr-cash.net
hxxp://bxxxl-cash.net
hxxp://balsfhkewo7i487fksd.info
hxxp://buynvf96.info
1.yimg.com
Us.i1.yimg.com
http:.//ad.yieldmanager.com
mattfoll.eu.interia.pl
bjerm.mass.hc.ru
www.f5ds1jkkk4d.info
www.g1ikdcvns3sdsal.info
www.h7smcnrwlsdn34fgv.info
www.inform1ongung.info
www.kukutrustnet.org
www.lukki6nd2kdnc.info

Com essa informação você pode detectar possíveis máquinas infectadas com o Sality usando o tcpdump ou colocar esses domínios no seu Firewall de borda.

fonte: https://community.mcafee.com/docs/DOC-1095