How To Remove Virus.Win32.Sality.aa Win32/Sality.AM W32/Sality.ah
June 6, 2009 by admin
Filed under Removal Tips,Tools and Videos
10,108 views 28 Comments
We saw a lot of people visiting us to find about ( Virus.Win32.Sality.aa Win32/Sality.AM W32/Sality.ah ) so we now put a way for how to remove and clean the infected PC from ( Virus.Win32.Sality.aa Win32/Sality.AM W32/Sality.ah ) just follow these steps :
1- If you have an anti virus that detected the infected files don’t delete any of infected file because if you did the system will be broken.
2- Go to any clean PC and download Kaspersky Removal tools from ( Here )
3- When you finish the download put the exe file of Kaspersky Removal tools in a compressed file zip file recommended (we put it in compressed file to protect the exe file from getting infected ).
4- Now go back to the infected PC and reboot with the safe mode some viruses disable the safe mode you can download a registry file from ( Here ) to fix the safe mode problem.
5- If you done to get into the safe mode run Kaspersky Removal tools that you compressed then it will start and you will see the interface like this picture :
kaspersky removal tools
6- Now click on setting then you will see like this picture and do the same setting in it :
Kaspersky removal tools settings
7- When you finish the setting click OK then click on Scan button it will start scan and disinfect the infected files and remove the virus files .
** Some times the virus could disable regedit and task manager and folder options you can download these files to repair the problems
[ Enable Registry ] [ Enable Taskmanagr ] [ Enable Folder Options ] [ Restore Hidden Files ]
For any suggestion just comment it or contact us .
Related posts:
- How To Remove Win32/Mabezat, Win32/Mabezat.A, Win32/Mabezat.B, Worm.Win32.Mabezat.b
- New Sality Virus In Sight ( Virus.Win32.Sality.aa Win32/Sality.AM W32/Sality.ah )
- Fix .exe extension for ( Virus.Win32.Sality.aa Win32/Sality.AM W32/Sality.ah ) infected PC
- Removal of Advanced Virus Remover (Manual)
- How to Remove olhrwef.exe (Magania Trojan / Worm) Manually
good note
sounds good but: Sality does not only prevent safe boot, it also prevents regedit.
any idea what to do?
Hi Arturo,
First thank you for your comment and yes there is a tool called RRT Restriction removal tools I’ll put it here soon.
Regards
Anwar Anabtawi
Hi Anwar,
I found Malwarebytes Anti-Malware
On the first run, this Programm eliminated 2 restrictions on my registry so I could edit my registry again and boot in safe mode.
It all worked out as shown on this webside here, great, sality bye bye.
On the end, I deleted all system-restore points, to make it shure.
Free Download at
http://www.malwarebytes.org
Good luck, suerte,
Arturo from Guatemala
Hello again Arturo,
Yes MB can repair the registry problems but I put the RRT to repair without install any software.
Regards
Anwar Anabtawi
Hello Anwar.Thanks for help but RRT archive is damaged and cant be opened:(
Please bro update it.I need your help.
Thanks
Thank you Infected for your notice and I updated the RRT link
For win32.Sality eradication go to:
http://setrst.blogspot.com/2009/09/win32sality-cleaningremovingdisinfectin.html
Hello,
I had this virus many times, I have scanned all my drivers, and every thing went back to normal, when I scan my pc it tells me that every thing is OKAY!
But … I have those old .SWF files (were disinfected by Kaspersky “as said”), when I excute them “sality.aa” infects every thing again …
Any Idea on how to solve this ?
Thanks
Polaris have u tried this — > http://support.kaspersky.com/faq/?qid=208279889
Thank you Luis, but your solution is for :
o Virus.Win32.Sality.y
o Virus.Win32.Sality.z
o Virus.Win32.Sality.aa
but not for Am and Ah and this way is for any type of sality worms.
Polaris,
About your old swf files is it with swf extension or exe extension and are they in your pc drive or external like in a CD or USB flash desk cuz I think swf files cannot be infected with this worm maybe the flash player program is infected.
Thanks for your replay ..
I have both .swf & .exe (Flash Files) files ..
They are on my HDD ..
I scanned them after disinfecting my System .. I scanned every thing .. and every thing is OKAY as Kasper Sky AV 2009 (UP-TO-Date) …
when I run them they infects my system .. so I scan them again and executed them on Virtual System .. and they infected the system as well ..
Thanks again
Dear Luis,
I have tried every thing .. but it didn’t work ..
I’m telling you that my system is clean, I don’t need to fix it, I just wanna disinfect my files …
Any way thanks for your replay
Polaris
Dear Admin,
I have them in .exe extension, I just meant that all application and .exe files were disinfected succsefully, but those files are Flash files in .exe extension.
anyway, as I tried KasperSky AV & IS and both told that files are clean, I didn’t tried Kaspersky removal tool ..
I downloaded it yesterday, scanned my HDD, every thing is clean but flash files are infected as Kaspersky removal tool said, so I told the removal tool to disinfect them, and it did, I just didn’t have the courage to run the files, and so I have installed a Virtual WinXP, and ran the files on it … and they worked fine, tried them on the orginal system, every thing is okay …
Problem SOLVED !
Note : I have Kaspersky AV 2009, UP-TO-Date, running .. It didn’t said that files are infected .. why ?? I mean the removal tool is also Kaspersky’s isn’t it ?
Thanks
Dear Polaris,
I’m so happy because your problem is solved and about your flash maybe you are using in with other infected PC’s so it will infected again so be careful.
Regards
Anwar
Dear Anwar,
Thankyou for your help ..
I’m always careful, my friend is the one who got me this virus, anyway …
I’m just woundring why didn’t kaspersky AV reported the files as infected ??
I wanna ask some questions about something other than viruses, can you help me ?
where can I ask you or maybe we can use MSN for the best …
here’s my MSN adelhakim[at]hotmail[dot]com
thx again ..
I tried above all, but i am unable to get rid out of enabling regedit, and boot in safe mode, moreover the virus doesn’t allow to install any anti virus programs
Dear anuj,
If you want your system to get back working normal, backup your files, and then format/recover your system, once your system is installed just download Kaspersky removal tool, and scan your entire HDD and any potable storage you have ..
after this is all done, download any AV program you like, update it and rescan your system, HDD & any potable storage you have, for better …
the most important thing of all is not to run any .exe files you already have on your HDD, or else your system will be infected again …
I hope this was helpfull …
Don’t know what to say to you Polaris, Thank you so much
for your response.
Hi all
I have a virus in my 2000 server, when i login to my server it shows blue screeen so i map the drives with a pc and scan it with kaspersky its shows me some disinfected virses like win32.sality.aa so can anyone help me how to remove this virus and how to login to the server becuse its showing just a blue screeen nothng else.
Can you login using safemode ?
If not, reinstall the same version of windows, without formatting your system drive, so all system files will be replaced, then download Kaspersky removal tool and scan your PC ..
gd luck
hello
please anwar
i cant find RRT link
can u send it to me .
thanks
mj
where can i download the RRT bcuz i can’t go on safe mode. thanks…
where can i find the RRT…. ?
where is the link of RRT??
sorry for late and here is RRT download link : http://www.softpedia.com/get/Security/Security-Related/RRT-Remove-Ristrictions-Tool.shtml
Hey Guys !
i guess kaspersky is the good antivirus that can stop those kinds that infect ur pc but at the end the virus can win since he infect all ur exe files and it will be hard to disanfect even with malwarebytes hard to delet and if u install antivirus will delet ur exe file coz are infected already so ……
i can only format my pc and start over again :s
Regards .