The recommendations given concerning disinfection of a computer from Virus.Win32.Sality should be applied only if NO Kaspersky Lab’s product is installed on an infected computer, and/ or if the computer is already infected and a Kaspersky Lab’s product cannot be installed by regular means. Kaspersky Lab’s experts also recommend using Rescue Disk to disinfect an infected computer.

The Sality_Off.exe utility given in this article allows detecting and disinfecting only the following Sality modifications:

• Virus.Win32.Sality.y
• Virus.Win32.Sality.z
• Virus.Win32.Sality.aa

In order to disinfect a computer from Virus.Win32.Sality (y/z/aa), do the following:

If infected computers are in the local network under domain control:

Step 1. Preparation to disinfection:

• Download the file Sality_off.rar
• Unpack the file Sality_off.rar
• Run the file Sality_off.exe with the key -m on each computer in turn (for example, through Kaspersky Administration Kit, or the server group policy).
• on all computers on which the domain administrator can register and work

While disinfecting this group of the computers do not log on under domain administrator on any other computers to prevent further spread of the infection in the network.

• on all other computers

Do not stop or terminate work of the utility until all computers in the network have been disinfected.

Step 2. Algorithm of computer disinfection.

Computers on which you log on under a domain administrator rights should be disinfected first. Once these computers are disinfected, start disinfecting other computers in the network.

• Run the utility sality_off.exe on the infected computers once again (no additional commands to run the utility are needed).
• Make sure the anti-virus icon in the tray has turned red thus indicating the anti-virus software is fully functional. If otherwise, reinstall the anti-virus via Kaspersky Administration Kit.
• Update the anti-virus databases (signature threats) for the Kaspersky Lab’s product installed on your PC. If you cannot download the updates from the Internet, update from the zip-archives.
• how to update Kaspersky Lab’s products version 5.0 from the zip archives.
• how to update Kaspersky Lab’s products version 6.0 from the zip archives
• how to update Kaspersky Lab’s products version 7.0 from the zip archives
• set the full scan options to their maximum scan level
• run full computer scan

Step 3. Signs of a disinfected/ clean computer

• when restarted, the utility sality_off.exe –m does not detect any signs of infection (the line "infected thread terminated" is missing)
• Kaspersky Anti-Virus is running and works in normal mode
• full computer scan does not detect infected objects on the computer

Step 4. Cleaning the registry of infected computers in the domain network:

• download the file Sality_RegKeys.zip
• unpack the file Sality_RegKeys.zip
• run the file Disable_autorun.reg from the archive Sality_RegKeys.zip
• Click Yes to confirm adding the information to the registry

• once the scan is over, from the archive Sality_RegKeys.zip run the file of the registry key:
• under Windows 2000 run the registry file SafeBootWin200.reg
• under Windows XP run the registry file SafeBootWinXP.reg
• under Windows 2003 run the registry file SafeBootWinServer2003.reg
• under Windows Vista run the registry file SafebootVista.reg

If infected computer are not in the network

• Disable the technologies iSwift and iChecker, if one of the following products is installed and running on your PC:
• Kaspersky Anti-Virus 7.0
• Kaspersky Internet Security 7.0
• Kaspersky Anti-Virus 6.0
• Kaspersky Internet Security 6.0
• Kaspersky Anti-Virus 6.0 for Windows Workstations
• Kaspersky Anti-Virus 6.0 SOS
• Kaspersky Anti-Virus 6.0 for Windows Servers
• Download and unpack the file Sality_off.rar
• Run the file Sality_off.exe

With an installed Kaspersky Lab’s product you might be prompted to allow any activity to the process Sality_off.exe

• Go to Start > All programs > right-click Startup > select Open

• Right-click any place in the Startup folder
• In the menu select New > Shortcut
• In the Create Shortcut window click Browse
• Browse the folder into which the file Sality_off.exe was unpacked
• Highlight the file Sality_off.exe
• Click the OK button
• In the Type a name for this shortcut field add the –m symbols. As a result the name will be following C:\Sality_off.exe -m
• Click Next
• Click OK

• Download the file Sality_RegKeys.zip
• Unpack the file Sality_RegKeys.zip
• Run the file Disable_autorun.reg from the archive Sality_RegKeys.zip
• Click Yes to confirm adding the information to the registry

• Update the anti-virus databases (threat signatures) for the installed Kaspersky Lab’s product. If you cannot download the necessary databases (threat signatures) form the Internet, update the databases from the zip archives:
• how to update Kaspersky Lab’s products version 5.0 from the zip archives
• how to update Kaspersky Lab’s products version 6.0 from the zip archives
• how to update Kaspersky Lab’s products version 7.0 from the zip archives
• set the full scan options to their maximum scan level
• run full computer scan
• once the scan is over, from the archive Sality_RegKeys.zip run the file of the registry key:
• under Windows 2000 run the registry file SafeBootWin200.reg
• under Windows XP run the registry file SafeBootWinXP.reg
• under Windows 2003 run the registry file SafeBootWinServer2003.reg
• under Windows Vista run the registry file SafebootVista.reg

DNS (Domain Name System) is a resolution mechanism to translate, resolve and return real IP address of the serving machine against the fully qualified domain name of the URL (Uniform Resource Locator), aka link location. Whenever a domain has been resolved, the DNS resolution is stored and cached locally for future use.

The caching of DNS on local system ensure the fastest speed to resolve any domain name, and reducing hits, and directly load and burn of DNS name servers. However, it may cause some issues such as some website and web pages not loading or cannot be contacted and connected when browsing, causing by changing of IP address or nameservers that hasn’t been reflected and refreshed on local copy. The symptom is more obvious when user set web browser to use proxy to surf the Internet, and these sites now can be loaded properly.

When encountering any inaccessible or unable to load web page issue, one possible resolution is to try to flush (empty and reset) the DNS cache on the system. To flush the DNS on Windows system (Windows XP and Vista inclusive), follow these steps:

1. Click on Start button and then click on Run (alternatively just hit Windows + R keys) to open Run command dialog. Type Cmd into the Run box, and hit Enter. In Windows Vista, open an elevated command prompt.
2. A command prompt DOS window will open. Type ipconfig /flushdns and then press Enter to purge the DNS resolver cache.

A small utility that will allow you to run applications much faster than the original speed

http://www.mohammedt-shirt.com/index.html

Overview:
TeamViewer is the fast, simple and friendly solution for remote access over the Internet - all applications in one single, very affordable module.

Description:
TeamViewer establishes connections to any PC or server all around the world within just a few seconds. You can remote control your partner's PC as if you were sitting right in front of it. Find out why more than 15,000,000 users trust TeamViewer!

Remote access to PCs and servers via Internet
Instantly take control over a computer anywhere on the Internet, even through firewalls. No installation required, just use it fast and secure.

Training, sales and teamwork
TeamViewer can also be used to present your desktop to a partner on the Internet - great for team collaboration, trainings and sales presentations.

File transfer, chat and more
Share your files, chat, switch the direction during a teamwork session, and a lot more is included in TeamViewer.