Unpack the file Sality_off.zip
Run the file Sality_off.exe with the key -m To do this select run from the start menu.
Select browse and locate sality_off.exe click once.
The file will now appear in the run box.
Using the mouse double left click in the box and the cursor will then appear after the .exe part. now press the spacebar and type in -m then select OK
Step 2. Signs of a disinfected/ clean computer
when restarted, the utility sality_off.exe –m does not detect any signs of infection (the line "infected thread terminated" is missing)
Your Anti-Virus is running and works in normal mode
full computer scan does not detect infected objects on the computer
Step 3. Cleaning the registry of infected computers in the domain network:
download the file Sality_RegKeys.zip ( link on the same page)
unpack the file Sality_RegKeys.zip
run the file Disable_autorun.reg from the archive Sality_RegKeys.zip
Click Yes to confirm adding the information to the registry
THEN
Doubleclick the drweb-cureit.exe file and Allow to run the express scan
This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, mark the drives that you want to scan.
Select all drives. A red dot shows which drives have been chosen.
Click the green arrow at the right, and the scan will start.
Click 'Yes to all' if it asks if you want to cure/move the file.
When the scan has finished, in the menu, click file and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv
Close Dr.Web Cureit.
To upload the file you will need to rename the file to DrWeb.txt
Yes it is scanning both memory and files for the virus. If it detects nothing after 5 minutes or so then AVG is wrong and we will try another tool
Download ComboFix from one of these locations:
Link 1 Link 2 Link 3
* IMPORTANT !!! Save ComboFix.exe to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
[external image: Posted Image]
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
[external image: Posted Image]
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
combofix has detected the following realtime scanner to be active…
AVG Antivirus Scanner
and we have closed all of these items…
when we are in the task manager… we find that there are system processes saying "avgrsx.exe"(2 of those) and "avgwdsvc.exe" and a "3.tmp" process running on system
when we try to end the process the processes keep coming back…
