Jump to content

Salta.exe/Nine/ctf loader and other odd things

Recommended Posts


This is my sec time writing this, I wrote a 3 page things but when I clicked to submit the site timed out and I lost it all....(logged me out as well)


So basically, something Called Nine keeps showing up along with CTF Loader in the task manager in windows 10, I check on the location of NINE and a file called Salta.exe and a .dll file are there, I have deleted/shredded both but they keep coming back, my research on CTFLoader is that is normally part of MS office, which I don't have, I ran a uninstall prg for ctfloader and though it is listed as gone, it still shows up. what theses two items seem to be doing is going to the net and playing audio, sometimes ads and or music...this happens with or without a browser open. I have run avg, spyware spybot, and malwarebytes and though Avg sometimes catches NINE/salta.exe when its in memory and it claims to be removing it, it still comes back after a while.


There are sometimes other files one called Wrapper(something I forget the whole name) that also might be part of it...but as there are so many things in memory in Windows 10 its hard to know (or why there needed, I miss Windows 98 or xp where all you needed was windows.exe and explore.exe)

I've tried Hyjack this, but it gives me an error saying it is blocked from writing changes because of the Host file in system32 director, I checked this but the item in it that it asked me to check for was not in the file....

When CTFLoader is in memory, I open its location, and though I can remove it from memory, when I then try to delete it, it says my clearance lvl is not high enough to do so...


Link to post
Share on other sites

(I tried to edit my post but It said I could not for some reason.)


I have tried making rules for salta.exe and ctfloader in windows firewall but this seems to do nothing....

This all seems like a nuisance thing, but how do I know that while the ads/music are being played that other things are not being transmitted to who ever made this things...(I am not too worried, but anything is possible)

Link to post
Share on other sites

Hello and welcome, @CommodoreBlitz:

Yes, the forum software does misbehave sometimes.  Perhaps there was a glitch while you were posting.

It sounds as if you are probably infected.

Malware removal work is conducted in a special forum area reserved for that purpose, or at the help desk.
So, for expert assistance, I suggest that you please follow the advice in this pinned topic: Available Assistance For Possibly Infected Computers.
It explains the options for free, expert help >>AND<< the suggested, preliminary steps to expedite the process.
A malware analyst will assist you with looking into your issue - the helper will guide you through scanning, cleanup and repair.

Thank you,

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.