W32.SALTY VIRUS IS A BIG NUISANCE TO WINDOWS USERS . ITS EFFECTS INCLUDES AMONG OTHER DISABLING THE REGISTRY AND DISABLING THE TASK MANAGER. KASPERSKY HAS COME UP WITH TOOLS THAT KILLS SALITY EASILY.
IF THE INFECTED MACHINE IS A LOCAL MACHINE UNDER NETWOK DOMAIN CONTROL ...DOWNLOAD THIS ZIPPED TOOL
UNZIP IT AND DOUBLE CLICK IT TO RUN. IT WILL GIVE A CMD SCREEN (BLACK) WAIT UNTIL IT COMPLETES SCANNING ..... THEN TO CLEAN THE REGISTRY USE THIS TOOL DOWNLOAD REGISTRY KEYS FOR MACHINE IN A NETWORK .
To install xp in any machine that has an intel chipset be it hp,TOSHIBA, acer,compaq dell or whatever is relatively easy ....the solution is here
1. GET WINDOWS XP SP2 AND EMPTY THE CONTENTS TO A FOLDER
2. go to INTEL DOWNLOAD.... CLICK HERE and in the search textbox type "32-bit Floppy Configuration Utility" then download it and extract the content of that zipped file that is called f6flpy3287.zip TO A folder.
3 .DOWNLOAD a software called winlite from HERE...its a freeware NOW YOU HAVE ALL YOU NEED ......
Here is a chance for entrepreneurs to take a stride in mobile content development. if you have a positive mind, an eye to see beyond the horizon,SOFT SKILLS and self drive to develop content for africa audience .... CLICK THIS FOR MORE
HOW TO REMOVE ntde1ect and autorun.inf CREATED BY Win32/PSW.Agent.NDP trojan
Open Task Manager and in Processes tab end explorer.exe and wscript.exe process
Open up File –> New Task (Run) in the Task manager
Type cmd and hit Enter
TO REMOVE AUTORUN from other drivers other than C:
Type in the prompt C:\document and settings\username>X: ….where X is your infected drive
Then the the prompt will show as follows X:\> …. Where X is your drive
Type attrib at the end of the prompt as follows X:\> attrib
this will list all the files that are in that drive
If you see any entry called autorun.inf or any .pif file delete it as follows
Type this on the prompt as shown below
X:\> del autorun.inf /f/a/s/q/p
When prompted click Yes to delete
Then to delete .pif entries type on the prompt as shown below
X:\> del *.pif /f/a/s/q/p
DELETEING AVPO.EXE ENTRIES
IF IT IS DRIVE C THAT HAS avpo.exe then del /a:h /f c:\autorun.*
Go to your Windows\System32 directory by typing cd c:\windows\system32 Type dir /a:h /f avp*.*
If you see any files names avpo.dll or avpo.exe or avpo.exe, use the
Del /a:h /f avpo.exe
Open up File –> New Task (Run) in the Task manager, Type regedit
Navigate to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
If there are any entries for avpo.exe, delete them.
Do a complete search of your registry for ntdelect.com and delete any entries you find.
To Restore Folder Options Settings, Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Explorer\Advanced\Folder\Hidden\SHOWALL
Look at the “CheckedValue” key… This should be a DWORD key. If it isn’t, delete the key.Create a new key called “CheckedValue” as a DWORD (hexadecimal) with a value of 1. The “Show hidden files & folders” check box should now work normally.
WHEN THE REGISTRY IS LOCKED…. BY THE ADMINISTRATOR
The virus a times disable the registry ….for editing …
The easiest way is to use this tool from symantech (Norton)….. it is a small file that resembles a text file it is called UnHookExec.inf