To clean PE_Sality:

1. Download the PE_Sality fixtool.
2. Download the latest Controlled Pattern Release (CPR). 
3. Download the latest Spyware Detection and Cleanup (Trend Micro Anti-Spyware) - Ssapiptn.Da6. 
4. Extract the PE_Sality fixtool to a temporary directory (i.e. C:\Test).
5. Extract the CPR (lpt$vpn.xxx) to C:\Test\System\Sysclean.
6. Extract the spyware pattern (ssapiptn.DA5) to C:\Test\System\Sysclean.
7. Using GPO or any 3rd party deployment tool (i.e. SMS, BigFix, Altiris), copy the extracted files (mentioned in step #4-6) into the C:\Temp folder of the infected computer(s).
8. Using GPO or any 3rd party deployment tool (i.e. SMS, BigFix, Altiris), run C:\Temp\Fix.bat. This script file will execute tsc.com and sysclean.com that will remove PE_SALITY infection.
9. Restart the computer. System reboot is required to completely restore and remove the malware entries and modifications. This new and improved fixtool does NOT require a boot in safe mode to clean PE_Sality. 
10. Make sure that your Trend Micro product is updated and running to prevent reinfection.

The following technologies implemented by the latest Trend Micro products are the most effective methods of preventing re-infection and future infection of PE_SALITY:

Prevention

• Malware Behavior Blocking via Behavior Monitoring Settings

  This prevents termination of the Trend Micro products' processes as well as further infection.

  • In OfficeScan, PE_SALITY is prevented with the use of Malware Behavior Blocking.

    

  • In the Worry-Free Security Client/Server Security Agent, PE_SALITY is prevented with the use of Malware Behavior Blocking.

    

• Block AutoRun function in USB devices via Device Access Control

  This prevents infections from USB drives that can be introduced into the environment from a foreign network.

• Web Reputation

  This prevents introduction of new malware from web sites hosting files associated to PE_SALITY.

• Scan Network Drive

  This prevents infections from shared drives and folders that is being used by PE_SALITY to propagate. This option will also clean all malware detected files found in the shared drive and folder