ARTIGOS de Vista ALTO 50 Vírus de Spyware Vista MACIO AJUDA de Vista

Remoção manual de W32.Sality.aa Trojan

Remoção manual de W32.Sality.aa Trojan

W32/Sality-AA é um vírus que aja também como um keylogger.
O vírus registra keystrokes a determinadas janelas, as well as a informação sobre o computador infected. Estes dados registrados são submetidos periòdicamente a um Web site remoto.
W32/Sality-AA foi visto espalhar-se através do email andando às cavalitas em W32/Netsky-T. W32/Sality-AA é um vírus que aja também como um keylogger.
O vírus registra keystrokes a determinadas janelas, as well as a informação sobre o computador infected. Estes dados registrados são submetidos periòdicamente a um Web site remoto.
W32/Sality-AA foi visto espalhar-se através do email andando às cavalitas em W32/Netsky-T.
Pseudônimos: Virus.Win32.Sality.aa (Kaspersky), vírus: Win32/Sality.AM (Microsoft), W32/Sality.ah (McAfee)
Tipo de infiltration: Vírus
Tamanho: Variável
Plataformas afetadas: Windows
Versão da base de dados da assinatura: 3267 (20080714)
Descrição curta: Win32/Sality.NAR é um infector polymorphic da lima.

Os danos em nível: Altamente perigoso
Distribuição em nível: Elevado/Meio
Não há NENHUMA auto ferramenta da remoção para W32.Sality.aa Trojan

Instruções manuais da remoção de Trojan
Recomende a remoção da modalidade segura:
Como começar na modalidade segura:
Reinicie seu computador, pressione F8 repetidamente, quando sua tela gira sobre, modalidade segura seleta, imprensa entram.

As limas Infected podem ser vistas nestes dobradores e nomes que funcionam também nas tarefas
Termine o seguinte processo ativo antes da remoção

%System% \ amvo.exe
%System% \ blastclnnn.exe
%System% \ scvhsot.exe
%Temp% \ 00055a0e_rar \ scvhsot.exe
%Temp% \ 000592b2_rar \ scvhsot.exe
%Temp% \ 0005934e_rar \ hinhem.scr
%Temp% \ 0005938d_rar \ blastclnnn.exe
%Windir% \ hinhem.scr
%Windir% \ scvhsot.exe
c:\rdsfk.com
%System% \ excitadores \.sys
%temp% \ win%name%.exe
%temp% \ %name%.exe

Mate os seguintes processos e suprima as limas apropriadas:
antzom.exe, ax.exe, bomryuc.dll, drlbqse.dll, egjjen.sys, fmgonn.sys, hehmu.sys, hsgfrn.sys, idlrrh.sys, impnn.sys, jnjpvn.sys, loader174.exe, mAO3q2B7r6.exe, mm2emt.exe, ogmkmn.sys, omdftn.sys, vwservice.exe, vwsrv.exe, vwsrv [1] .exe, win13652.dll, win21309.dll, win25709.dll, win27388.dll, win28610.dll, win29788.dll, win3096.dll, win31324.dll, win33848.dll, win35482.dll, win36587.dll, win37763.dll, win40320.dll, win40346.dll, win44025.dll, win46721.dll, win48684.dll, win63279.dll, win7320.dll, windjnvr.exe, winibqs.exe, winjepm.exe, winkrqpx.exe, winkxggjh.exe, winnmswkj.exe, winrlwmt.exe, winxotbiy.exe, wmdrtc32.dll, wmdrtc32.dl_, x1001 [1] .exe, x2000 [1] .exe, x2007.exe, x2011.exe, x2011 [1] .exe, x3000 [1] .exe, ywsnkhb.dll

Espalhar em meios removíveis
O vírus copía-se nos dobradores da raiz de movimentações removíveis usando um nome de arquivo aleatório. O nome de arquivo tem uma das seguintes extensões:
.exe
.pif
.cm d
A seguinte lima é deixada cair no mesmo dobrador:
autorun.inf
Assim, o vírus assegura-o é começado infected cada vez meios é introduzido no computador.

Se você tiver qualqueras um limas em processo running do manger da tarefa, termine o processo antes da remoção.
Nota: se o gerente da tarefa for disabled, Download a seguinte lima, Clique a download - permita Registry.reg

Remova manualmente do registro
Estale o começo, funcionamento, tipo regedit, estale-o ESTÁ BEM.
Nota: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Download and run this UnHookExec.inf, and then continue with the removal.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
?GlobalUserOffline? = 0
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\system
?EnableLUA? = 0
The following Registry entries are deleted:
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aouei
Key: CLSID\{1CE21416-0B8D-8CF6-1FCB-099B30C628BB}\InprocServer32
Value: ThreadingModel
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\Legacy_VWSERVICE
Value: NextInstance
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\Legacy_VWSERVICE\0000
Value: Class
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\Legacy_VWSERVICE\0000\Control
Value: ActiveService
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vwservice
Value: DisplayName
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vwservice\Enum
Value: Count
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vwservice\Security
Value: Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisFileServices32
Value: Type
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisFileServices32
Value: Start
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisFileServices32
Value: ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisFileServices32
Value: ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisFileServices32
Value: DisplayName
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisFileServices32\Security
Value: Security
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_NDISFILESERVICES32
Value: NextInstance
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_NDISFILESERVICES32\0000\Control
Value: *NewlyCreated*
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_NDISFILESERVICES32\0000
Value: Service
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_NDISFILESERVICES32\0000
Value: Legacy
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_NDISFILESERVICES32\0000
Value: ConfigFlags
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_NDISFILESERVICES32\0000
Value: Class
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_NDISFILESERVICES32\0000
Value: ClassGUID
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_NDISFILESERVICES32\0000
Value: DeviceDesc
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\NdisFileServices32\Enum
Value: 0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\NdisFileServices32\Enum
Value: Count
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\NdisFileServices32\Enum
Value: NextInstance
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\Root\LEGACY_NDISFILESERVICES32\0000\Control
Value: ActiveService

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
Value: d
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
Value: {06DB7430-7430-6DB1-306D-430DB4306DB1}
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\NdisFileServices32
Value: ImagePath
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\NdisFileServices32
Value: DeleteFlag
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\NdisFileServices32
Value: ImagePath
HKEY_CURRENT_USER\Software\CurrentControlSet\Enum\Root\Legacy_VWSERVICE\0000
Value: ClassGUID
HKEY_CURRENT_USER\Software\CurrentControlSet\Enum\Root\Legacy_VWSERVICE\0000
Value: DeviceDesc
HKEY_CURRENT_USER\Software\CurrentControlSet\Enum\Root\Legacy_VWSERVICE\0000
Value: Service
HKEY_CURRENT_USER\Software\CurrentControlSet\Enum\Root\Legacy_VWSERVICE\0000
Value: ConfigFlag
HKEY_CURRENT_USER\Software\CurrentControlSet\Enum\Root\Legacy_VWSERVICE\0000
Value: Legacy
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\vwservice
Value: ImagePath
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\vwservice
Value: ObjectName
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\vwservice
Value: ErrorControl
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\vwservice
Value: Start
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\vwservice
Value: Type
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\vwservice
Value: FailureActions
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\vwservice\Enum
Value: NextInstance
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\vwservice\Enum
Value: 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
Value: s
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
Value: f
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
Value: d
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
Value: f
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
Value: d
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
Value: s
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Value: Start Page

_+ Any of the Above Listed Files +_
Search Registry For Virus File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.
Exit the Registry Editor,
Restart your Computer.
Recommended Removal Tools:
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)
Killbox (Freeware)

Popularity: 1%

Written by FireFly. Read more great feeds at is source WEBSITE
6 comments.
Read more articles on trojan removal and W32.Sality.aa and amvo.exe and manual removal and Removal and otherSoftware and removal of trojan and Windows.

[+] Digg: Feature this article
[+] Del.icio.us: Bookmark this article
[+] Furl: Bookmark this article

Manual Removal of W32/Agent.AURK Trojan (December 24th, 2008)
Manual Removal of W32/Tibs.KXN Trojan (December 24th, 2008)
Manual Removal of W32/Hackarmy.W Trojan (December 22nd, 2008)
Manual Removal of W32/AutoRun-HR Trojan Worm (December 21st, 2008)
Manual Removal of W32/Agent.AANG Trojan (December 17th, 2008)

6 comments

Read the comments left by other users below, or:

SHARMA
#1. December 20th, 2008, at 12:24 AM.

Sir,

We are facing the problem with Sality.aa. We tried to remove the entries, which have given you. But some entries are found and some entries or not found. After that we scan the system with Kaspersky but the safe mode, Registy & Task Manager also disabled. In this situation we downloaded some repairing tools also. With that only 2 minutes it works and after 2 minutes agiain condition is same.

Please help us in this regard

SHARMA

munish
#2. January 12th, 2009, at 4:57 AM.

hey… sharma, download the following tool and do scan all your drives with this tool, after this u need to format your computer, i mean c drive not all drives, as the virus copies itself into all the drives but the removal tool is not able to repair one file “winlogon.exe” for which u need to format your computer because this process starts as soon as u log on your computer.
therefore after cleaning the other drives, make sure u format your computer. I have done this successfully on my friend’s computer!
Gud Luck!!

munish
#3. January 12th, 2009, at 4:58 AM.

hey.. sorry. lol i forget the name of the tool

Its “stinger” from mcafee!

Admin
#4. January 15th, 2009, at 7:22 AM.

hey guys, i found the original source of this article and it has been updated, so visit here http://www.rahulmg.blogspot.com/2008/12/manual-removal-of-w32salityaa-trojan.html
New Removal tools released…

achdias
#5. January 18th, 2009, at 8:40 AM.