Hello,
first of all you should temporarily turn off System Restore.
Instructions for Windows XP:
http://support.microsoft.com/kb/310405Instructions for Windows Vista:
http://windowshelp.microsoft.com/Windows/en-US/help/f0688925-5abe-4caf-b49a-018f8cfcaf4d1033.mspx1.
Delete the following files: oledsp32.dll, sysdll.dll, syslib32.dll, wmimgr32.dll.
Sality files can be found in one of the following folders:
C:\Windows\System
C:\Windows\System32
C:\Winnt\System32
C:\Windows\Temp
C:\Winnt\Temp.
2.
Delete values from the registry Click Start > Run.
Type regedit
Click OK.
Navigate to and delete the following registry entry:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"[INFECTED FILE]" = "[INFECTED FILE]:*:Enabled:ipsec"
HKEY_CURRENT_USER\Software\[USER NAME]914
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WMI_MFC_TPSHOKER_80
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IPFILTERDRIVER
If the manual removal fails, then I strongly recommend you to download an automatice Sality virus remover form here:
http://www.2-spyware.com/remove-sality.htmlThis tool will rempove the virus and any related malware.
Good luck!