Task Manager, Regedit, Safe Mode disabled.. Computer a mess. Sality.aa detected by Kaspersky.

[Winter_Wish]

I'm trying to follow all the instructions in the same serial as posted in the rules..


1. My PC cannot start in safe mode. So I can't scan it with the Virus Removal Tool in that mode. I did it in the Normal mode and it does detect "Sality.aa" in a lot of .exe files but they get infected 2 minutes after I "Disinfect" them.

2. AVZ Antiviral Toolkit shuts down as soon as I start it. Probably coz of whatever is infecting my PC.

3. Hijack this log is attached.

4. I have also attached Kaspersky Virus Removal Tool Report if it helps.


Thanks a lot for any help in advance guys.

Also, now AVZ doesn't even start on my PC. IT did start when I downloaded it earlier but now it doesn't even do that.

[Никита Соловьев]

1. How to disinfect my computer from Virus.Win32.Sality?

2. Execute following script:

begin
 ClearQuarantine;
 SearchRootkit(true, true);
 SetAVZGuardStatus(true);
 TerminateProcessByName('c:\docume~1\admini~1\locals~1\temp\oxtf.exe');
 QuarantineFile('C:\IP Messenger\ipmsg.exe','');
 QuarantineFile('C:\WINDOWS\system32\03.tmp','');
 QuarantineFile('C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\oxtf.exe','');
 DeleteService('euisso');
 DeleteFile('C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\oxtf.exe');
 DeleteFile('C:\WINDOWS\system32\03.tmp');
 QuarantineFile('C:\WINDOWS\system32\drivers\tnhnpn.sys','');
 DeleteService('asc3360pr');
 DeleteFile('C:\WINDOWS\system32\drivers\tnhnpn.sys');
 DeleteFileMask('C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp','*.*',true);
 BC_ImportALL;
 ExecuteSysClean;
 ExecuteRepair(11);
 ExecuteRepair(17);
 BC_Activate;
 RebootWindows(true);
end.

After reboot

Execute following script:

begin
CreateQurantineArchive('C:\quarantine.zip');
end.

Upload the C:\quarantine.zip over the link Upload quarantined files

Make a new log files

[Winter_Wish]

I have uploaded the quanrantined files as asked.

Here are the new set of logs:

[Никита Соловьев]

Scan your computer with Kaspersky Live CD

After checking make a new log files

[Winter_Wish]

I didn't mention this earlier but I live in a college dorm and the internet only allows 30 MB of download every day. So this Kaspersky Live CD, being 200 mb, is not in my reach. Can you suggest some other method maybe?

In case there is none, I'll try my best to download it somehow..

EDIT : Also, the link you gave doesn't open in my browser. All other pages open just fine. I suspect this might have something to do with the virus too..

[Никита Соловьев]

http://support.kaspersky.com/viruses...?qid=208279889 - Tried?

[Winter_Wish]

Yeah, it says "Internet Explorer cannot display the webpage".

[Никита Соловьев]

Yeah, it says "Internet Explorer cannot display the webpage".

OK,

Download and unpack the file SalityKiller.zip
Run the file SalityKiller.exe

With an installed Kaspersky Lab product you might be prompted to allow any activity to the process Sality_killer.exe

[Winter_Wish]

Thanks a lot man! It worked. I can access my task manager now after 5 months

Добавлено через 3 минуты

Just one more thing, how do I get those files back that you made me quarantine?

[Никита Соловьев]

Just one more thing, how do I get those files back that you made me quarantine?

What for? Files were not deleted

Make a new AVPTool log file

[CyberHelper]

Статистика проведенного лечения:

• Получено карантинов: 1
• Обработано файлов: 9
• В ходе лечения обнаружены вредоносные программы:
  
  1. c:\ip messenger\ipmsg.exe - Virus.Win32.Sality.aa ( DrWEB: Win32.Sector.9, BitDefender: Win32.Sality.OG, NOD32: Win32/Sality.NAR virus, AVAST4: Win32:Sality )