|
|
|
|
|
This tool checks your computer for infection by specific, prevalent malicious software (including Blaster, Sasser, and Mydoom) and helps to remove the infection if it is found. This tool will help to remove specific, prevalent malicious software from infected systems. Because computers can appear to function normally when infected, Microsoft advises you to run this tool even if your computer seems to be fine. In addition to using this tool, you should use an up-to-date antivirus product to help protect your computer from other malicious software. For more information, see Protect Your PC. A new version of this tool is released on the second Tuesday of every month. These new versions will be available from the Microsoft Download Center—this page—as well as from Windows Update / Automatic Updates. An online version of the tool is also available. It is recommended that Windows XP users use Windows Update / Automatic Updates to download the tool. If you are using any other version of Windows for which this tool is supported, please download the tool from this page or run the online version of the tool at least once a month to ensure that you are using the latest version of this software.
| Developer | Download | Screenshot | 2000/XP | Rating: Very Good |
|
|
|
|
W32.Pexmor@mm is a mass-mailing worm that sends a copy of itself as an email attachment using its own SMTP engine. This worm creates a mass-mailing of itself, which may clog mail servers or degrade system and network performance. When W32.Pexmor@mm is executed, it performs the following actions: Copies itself as the following files: %Temp%\MSMSGS.exe; %Temp%\SVCHOST.exe; %Temp%\Winword.exe; %Temp%\LSASS.exe; C:\WINDOWS\Drivers\SEXO.pif. Symantec Security Response has developed a removal tool to clean the infections of W32.Pexmor@mm. Use this removal tool first, as it is the easiest way to remove this threat.
| Developer | Download | Screenshot | 98/ME/NT/2000/XP | Rating: Very Good |
|
|
|
|
AVIRA offers frequent virus definitions updates in order to keep its users safe from new malware outbreaks. However, there are computer users who do not perform such updates as often as required, while many others do not use antivirus protection at all. For all those experiencing the damaging effects of a virus infection, AVIRA's researchers have prepared a free removal tool, which can be used to eliminate major distinct threats. AVIRA Removal Tool for Windows v 2.0 is a free, easy-to-use disinfection tool, specifically designed to remove a series of three threats from your system, such as Worm/Sober.J, Worm/Sober.P, Worm/Stanit.A Repair affected files, whenever possible (sometimes files may be irremediably damaged by the malware’s actions). Report features: this tool is able to create log files and reports after completing its task, providing information on scan results.
| Developer | Download | Screenshot | 98/ME/NT/2000/XP | Rating: Good |
|
|
|
|
This tool is designed to remove the infections of the following threats: W32.Bobax.AH@mm; W32.Bobax.Z@mm. The removal tool must be run in safe mode. If you are on a network or have a full-time connection to the Internet, such as a DSL or cable modem, disconnect the computer from the network and Internet. Disable or password-protect file sharing, or set the shared files to Read Only, before reconnecting the computers to the network or to the Internet. Because this worm spreads by using shared folders on networked computers, to ensure that the worm does not reinfect the computer after it has been removed, Symantec suggests sharing with Read Only access or by using password protection. The Removal Tool does the following: Terminates the associated processes; Deletes the associated files; Deletes the registry values added by the threat; Restores the Shared Access service to the Microsoft Windows default.
| Developer | Download | 98/ME/NT/2000/XP | Rating: Excellent |
|
|
|
|
Mytob.IQ is a 22528 byte worm that is runtime packed by UPack. Upon execution, the worm copies itself into the System32 folder as “botzor.exe”. The worm creates a mutex “B-O-T-Z-O-R” to avoid multiple running instances of the worm on one machine. The worm generates random IP addresses and attempts to connect on port 445 of the generated IP's to exploit the Plug and Play buffer overflow vulnerability [see MS05-039 at http://www.microsoft.com/technet/se...n/MS05-039.mspx]. If the vulnerability exploit is successful, it executes code (shellcode) on the target machine, which instructs it to connect back to the source in order to retrieve a copy of the worm. (This copy is uploaded to the target machine by the created FTP Server-Connection using 2pac.txt FTP-Commands file).
| Developer | Download | 98/ME/NT/2000/XP | Rating: Excellent |
|
|
|
|
W32.Esbot.A is a worm that spreads by exploiting the Microsoft Windows Plug and Play Buffer Overflow Vulnerability (described in Microsoft Security Bulletin MS05-039). W32.Esbot. opens a back door that allows a remote attacker to have unauthorized access to the compromised computer. Symantec Security Response has developed a removal tool to clean the infections of W32.Esbot.A. Use this removal tool first, as it is the easiest way to remove this threat.
| Developer | Download | 98/ME/NT/2000/XP | Rating: Very Good |
|
|
|
|
W32.Zotob.A is a worm that spreads by exploiting the Microsoft Windows Plug and Play Service Vulnerability, as described in Microsoft Security Bulletin MS05-039. W32.Zotob.A can run on, but not infect, computers running Windows 95/98/Me/NT4. Although computers running these operating systems cannot be infected, they can still be used to infect vulnerable computers that they can connect to. Symantec Security Response has developed a removal tool to clean the infections of W32.Zotob. This tool is designed to remove the infections of the following threats: W32.Zotob.A; W32.Zotob.B; W32.Zotob.C@mm; W32.Zotob.D; W32.Zotob.E; W32.Zotob.F; W32.Zotob.G; W32.Zotob.I Use this removal tool first, as it is the easiest way to remove this threat.
| Developer | Download | 98/ME/NT/2000/XP | Rating: Very Good |
|
|
|
|
This tool is designed to remove the infections of W32.Reatle.C@mm. W32.Reatle.C@mm is a variant of W32.Reatle@mm, and is a mass-mailing worm that opens a back door and attempts to spread by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (Microsoft Security Bulletin MS04-011) on TCP port 445. It also downloads a copy W32.Rants.B@mm and a variant of W32.Spybot.Worm. Symantec Security Response has developed a removal tool to clean the infections of W32.Reatle.C@mm. Use this removal tool first, as it is the easiest way to remove this threat.
| Developer | Download | 98/ME/NT/2000/XP | Rating: Very Good |
|
|
|
|
This trojan is a typical Downloader Trojan. The size is 36864 bytes and is runtime compressed / protected by an executable file compressor. Upon execution, the trojan drops components into the Windows System folder as "wiwshost.exe" (9216 bytes) and "winshost.exe" (36864 bytes selfcopy of the dropper). Also Win32.Bagle.BI identify itself as the following worms : Bagle.BI, Email-Worm.Win32.Bagle.bq, Email-Worm.Win32.Bagle.BQ, Troj/BagleDl-R, TROJ_BAGLE.BB, W32/_newstuff.2, W32/Bagle.BI, W32/Bagle.BQ-mm, W32/Bagle.gen, Win32.Bagle.BQ@mm, Win32/Bagle.BI, Worm.Bagle.3, Worm.Bagle.BB-gen, Worm.Beagle.AV, Worm/Bagle.Gen. Note: When the trojan is run for the very first time, it creates a status key and executes MSPaint : HKCU\Software\FirstRun ; "FirstRunRR" = (DWORD) 1 . This free program detects and cleans a computer infected by Win32.Bagle.BI . Restart of your system may be necessary after the cleaning process has been completed.
| Developer | Download | Screenshot | 98/ME/NT/2000/XP | Rating : Very Good |
|
|
|
|
LiveUpdate is the Symantec technology that permits an installed Symantec product to connect to a Symantec server over the Internet to check for program and other updates such as virus definitions and URL lists. When updates are available, LiveUpdate downloads them to your computer and installs them, keeping your Symantec software up to date. All updates that are downloaded with this version of LiveUpdate are checked for a valid digital signature. Certain types of content may require a subscription. LiveUpdate will only download subscription content if a valid subscription is found on your machine. LiveUpdate occasionally needs to be updated. LiveUpdate will automatically check to see if there are any available updates to itself each time it is run. It should update itself transparently (without any extra input), but in certain rare cases, it may require that you run LiveUpdate one additional time to complete your session after it has finished its update. If this is required, LiveUpdate will prompt you.
| Developer | Download | Screenshot | 98/ME/2000/XP | Rating: Very Good |
|
|
|
|
Norton Antivirus uses weekly update system which might not be enough for many users. It was also not enough for me. So, i created this little program that automatically contacts Symantec server, downloads Rapid Update and applies it.Norton Rapid Updater can be used by simply executing it or using it with Scheduled Tasks for regular checking and downloading of Rapid Updates. From date 3.10.04, Norton Rapid Updater uses update checking to reduce load on Symantec servers.Norton Rapid Updater is a stand-alone application (extract&use) which requires installed Norton Antivirus 200x.
| Developer | Download | Screenshot | 98/ME/2000/XP | Rating: Very Good |
|
|
|
|
This tool is designed to remove infections of the following threats: W32.Mytob.B@mm, W32.Mytob.B@mm, W32.Mytob.L@mm, W32.Mytob.M@mm, W32.Mytob.R@mm, W32.Mytob.U@mm, W32.Mytob.V@mm, W32.Mytob.AG@mm, W32.Mytob.AH@mm, W32.Mytob.AS@mm , W32.Mytob.BE@mm, W32.Mytob.BV@mm, W32.Mytob.CF@mm, W32.Mytob.CH@mm, W32.Mytob.CU@mm, W32.Mytob.CY@mm, W32.Mytob.DA@mm, W32.Mytob.DB@mm, W32.Mytob.DF@mm, W32.Mytob.DJ@mm, W32.Mytob.DL@mm, W32.Mytob.DP@mm, W32.Mytob.DV@mm; W32.Mytob.EB@mm; W32.Mytob.EC@mm; W32.Mytob.ED@mm; W32.Mytob.EE@mm; W32.Mytob.EG@mm; W32.Mytob.IE@mm; W32.Mytob.KE@mm. The Removal Tool does the following: Terminates the associated processes; Deletes the associated files; Deletes the registry values added by the threat. What's new : October 20, 2005: Published Version 1.29.0, which supports removal of W32Mytob.LE@mm.
| Developer | Download | 98/ME/NT/2000/XP | Rating: Very Good |
|
|
|
|
The F-Mydoom utility disinfects computers infected with the following Mydoom worm variants:W32/Mydoom.A@mm ;W32/Mydoom.B@mm; W32/Mydoom.K@mm; W32/Mydoom.L@mm; W32/Mydoom.M@mm; W32/Mydoom.N@mm ; W32/Mydoom.P@mm; W32/Mydoom.Q@mm; W32/Mydoom.T@mm; W32/Mydoom.U@mm; W32/Mydoom.V@mm; W32/Mydoom.W@mm; W32/Mydoom.X@mm; W32/Mydoom.AB@mm; W32/Mydoom.AC@mm; W32/Mydoom.AL@mm; W32/Mydoom.AM@mm; W32/Mydoom.AN@mm .You can run the utility by either doubleclicking on it from Windows Explorer or you can start it from a command interpreter (COMMAND.COM or CMD.EXE) by typing 'F-MYDOOM' without quotes at command prompt and pressing 'Enter' (for advanced users). First the F-Mydoom utility will kill all Mydoom worm's processes and services in memory. Then the utility will remove Registry entries created by the worm. Finally the utility will scan all hard drives for infected files and delete them.
| Developer | Download | 95/98/ME/NT/2000/XP | Rating: Very Good |
|
|
|
|
The McAfee Bugbear Removal Tool helps you detect and remove any variation of the Bugbear virus from your computer. Based on the award-winning McAfee VirusScan engine, the Bugbear Removal Tool searches for and deletes variants of the Bugbear virus, including any file infected by the virus payload.You must have administrative rights on Windows NT 4.0, Windows 2000, or Windows XP to run this tool. You must disable any active anti-virus software on your computer. The tool does not scan drive A; any viruses detected on drive A will not be removed. No Install Required.
| Developer | Download | Screenshot | 98/ME/NT/2000/XP | Rating : Very Good |
|
|
|
|
The McAfee Klez Removal Tool helps you detect and remove any variation of the Klez virus from your computer. Based on the award-winning McAfee VirusScan engine, the Klez Removal Tool searches for and deletes variants of the Klez virus, including any file infected by the virus payload. You must have administrative rights on Windows NT 4.0, Windows 2000, or Windows XP to run this tool. You must disable any active anti-virus software on your computer. The tool does not scan drive A; any viruses detected on drive A will not be removed. No Install Required.
| Developer | Download | Screenshot | 98/ME/NT/2000/XP | Rating : Very Good |
|
|
|
|
This program creates dummy files in a specified folder.It could be useful to '' immunize '' a system against particular worms . The configuration file (DFC.INI - a standard INI file) is already set to contain the right list of the files. Anyway, this program is easily customizable to handle whatever list of file names like instit.bat, klt.bat, scrsvr.bat, etc. DFC supports a switch on command line: /s . If DFC has launched with that parameter on command line, it will work in "silent mode", i.e. it will create the files and then will quit without showing any window to the end user. No Install Required .
| Developer | Download | Mirror | Screenshot | 98/ME/NT/2000/XP | Rating : Very Good |
|
|
|
|
Resolve is the name for a set of small, downloadable Sophos utilities designed to remove and undo the changes made by certain viruses, Trojans and worms. They terminate any virus processes and reset any registry keys that the virus changed. Existing infections can be cleaned up quickly and easily, both on individual workstations and over networks with large numbers of computers.W32/MyDoom-A, W32/MyDoom-B, W32/MyDoom-F, W32/MyDoom-N, W32/MyDoom-O, W32/MyDoom-S and Troj/Bdoor-CHR can be removed from Windows 95/98/Me and Windows NT/2000/XP/2003 computers automatically with this cleaner .
| Developer | Download | Screenshot | 98/ME/NT/2000/XP | Rating : Very Good |
|
|
|
|
This tool is designed to remove the infections of Trojan.Jasbom. Trojan.Jasbom is a Trojan horse that attempts to exploit the Microsoft Internet Explorer ITS Protocol Zone Bypass Vulnerability (as described in the Microsoft Security Bulletin MS04-013). The Trojan logs keystrokes, mouse clicks, and application memory, when using the application Lineage. The Trojan sends this logged information to a Web site on the j4sb.com domain.
The Removal Tool does the following:
1. Terminates the associated processes
2. Deletes the associated files
3. Deletes the registry values added by the threat
| Developer | Download | 98/ME/NT/2000/XP | Rating : Very Good |
|
|
|
|
Sober.O is a typical mass mailing e-mail worm, the size is 53554 bytes and the worm is runtime compressed by UPX, an executable runtime packer and patched to avoid unpacking. This free program detects and cleans a computer infected by Win32/Sober.O Worm .
| Developer | Download | Screenshot | 98/ME/NT/2000/XP | Rating : Very Good |
|
|
|
|
Quick Heal Emergency Response Team has developed tools to remove infection of some special viruses during the virus outbreaks.This utility will help you detect and remove following worms/variants from an infected system: W32.MyDoom.A, W32.MyDoom.B, W32.NetSky.C , W32.NetSky.D , W32.Netsky.E, W32.Bagle.C ,W32.Bagle.E , W32.Bagle.F ,W32.Bagle.G , W32.Bagle.H .
| Developer | Download | Screenshot | 98/ME/NT/2000/XP | Rating: Very Good |
|
|
|
|
The F-Agobot utility disinfects computers infected with all known variants of W32/Agobot backdoor-worm. The variants of Agobot that can be disinfected by this tool are from Agobot.A to Agobot.RR and also include many Agobot variants that are detected generically.Run the F-Agobot.exe file from a hard disk to eliminate W32/Agobot backdoor-worm infection. You can run the utility by either double clicking on it from Windows Explorer or you can start it from a command interpreter (COMMAND.COM or CMD.EXE) by typing its name at command prompt and pressing 'Enter' (for advanced users). First the F-Agobot utility will kill W32/Agobot backdoor-worm's process in memory. Then the utility will remove all Registry values created by Agobot and will delete all Agobot's files from a hard disk.Reboot the system. After restart your system should be clean.
| Developer | Download | 98/ME/NT/2000/XP | Rating: Very Good |
|
|
|
|
Utility for cleaning infection by: I-Worm.Zafi.b, I-Worm.Bagle.at,au, Virus.Win32.Implinker.a, Not-a-virus.AdWare.Visiter.If program finds any processes in memory, infected by these viruses, it will try to unhook virus hooks and patch needed processes to stop reinfection or stop them and delete/cure their files on hard drive and delete links to their files from system registry and other startup places.If program finds any infected processes in memory it will start scanning of your hard drives. It will check only infection by these viruses. If you specify /s key in command line, the program will scan your hard drives (and all mapped network drives if you specify /sn) in all cases. In case program can not delete or rename any files (it may be used at the moment) it adds these files to the queue to delete or rename during next bootup process and offer user to reboot system.
| Developer | Download | 98/ME/NT/2000/XP | Rating: Very Good |
|
|
|
|
Win32/Sober.L is an internet worm spreading via e-mail. It's about 44 kB in size, the file is run-time packed by UPX.The worm terminates various security programs, such as HijackThis, MCAfee's Stinger or Microsoft's Malicious Software Removal Tool. This free program detects and cleans a computer infected by Win32.Sober Worm . Restart of your system may be necessary after the cleaning process has been completed .
| Developer | Download | Screenshot | 98/ME/NT/2000/XP | Rating : Very Good |
|
|
|
|
This program performs a number of actions in order to unkook the Agent.AC trojan from an infected computer . After the tool has finished to work , you should run your antivirus scanner to remove completely the trojan .
| Developer | Download | Screenshot | 98/ME/NT/2000/XP | Rating : Very Good |
|
|
|
|
A stand-alone virus scanner and remover .Detects and removes many worms, trojans and backdoors: Mydoom, Beagle, Netsky, Sasser, Blaster Zafi, Mabutu, Net-Worm.Win32.Mytob.r, I-Worm.Bagle, TrojanProxy.Win32.Mitglieder, I-Worm.Mydoom.A-AB, Worm.Win32.Vesser.A-C, I-Worm.Zafi.A-D and 463 others ....Use with caution !
| Developer | Download | Screenshot | 98/ME/2000/XP | Rating: Very Good |
|
|
|
|
This program was designed to allow users to help out fellow users that are infected with the MSBlast (and variants) worm by sending them a message (via the Windows' Messenger service) telling them that they appear to be infected with MSBlast as their machine attempted to connect to port 135. The message also contains a link for disinfection instructions. To use this program, you will need a router connected to your machine. You can still use this application without a router for other purposes, for example you could set BlastBack to listen on a common trojan port and have it send back an insulting message to anyone trying to connect to that port. Since v1.10, BlastBack now supports the detection (on the HD and currently running in memory) and removal of the MSBlast worm and its variants.
| Developer | Download | 98/ME/2000/XP | Rating: Very Good |
|
|
|
|
H+BEDV Datentechnik GmbH provides your the repair tool for downloading free of charge. The worms Sober, Lovsan, Bagle, Mimail.q and the MyDoom.A or rather MyDoom.B can be fully removed herewith.
| Developer | Download | 98/ME/2000/XP | Rating : Very Good |
|
|
|
|
This tool will help to remove the adware T.V. Media from affected computers. This adware interferes with successful installation of Windows XP Service Pack 2. T.V. Media is bundled with certain advertisement-supported applications such as Speed Blaster and Memory Meter. Users should uninstall these applications before running this tool and before installing Windows XP SP2.Once the tool has run--after the End-User License Agreement (EULA) is accepted--it will let you know whether the adware is installed on your computer. If the adware is installed on your computer, the tool will remove the adware T.V. Media files on your computer.
| Developer | Download | Windows XP | Rating : Good |
|
|
|
|
This tool will help to remove the Sasser (A-F) worm from infected systems. Once the tool has run—after the End-User License Agreement (EULA) is accepted—it automatically checks for infection and removes any of the targeted worms that are found.After running, the tool displays a message describing the outcome of the detection and removal process. The tool can be safely deleted after it has run. Also, the tool creates a log file named sasscln.log in the %WINDIR%\debug folder.
| Developer | Download | 2000/XP | Rating : Very Good |
|
|
|
|
This tool helps to remove the Mydoom.A, Mydoom.B, Mydoom.E, Mydoom.F, Mydoom.G, Mydoom.J, Mydoom.L, Mydoom.O, Zindos.A, Doomjuice.A, and Doomjuice.B worms from infected systems. Once the tool has run—after the End-User License Agreement (EULA) is accepted—it automatically checks for infection and removes any of the targeted worms that are found. If a machine is infected with the Mydoom.B worm, the tool also provides the user with the default version of the hosts file and set the "read-only" attribute for that file. This action enables the user to visit previously-blocked Microsoft and antivirus Web sites.After running, the tool displays a message describing the outcome of the detection and removal process. The tool can be safely deleted after it has run. Also, the tool creates a log file named doomcln.log in the %WINDIR%\debug folder.
| Developer | Download | 98/ME/2000/XP | Rating : Very Good |
|
|
|
|
A situation has been identified where the Blaster worm could have infected some systems before the application of MS03-026 [KB823980] or MS03-039 [KB824146]. This tool will help remove the Blaster worm from these systems. For systems with MS03-026 [KB823980] or MS03-039 [KB824146] already installed, no further action is needed once this tool is installed. Install this tool to help remove this worm from your PC.
| Developer | Download | 2000/XP | Rating : Very Good |
|
|
|
|
Microsoft Download.Ject Payload Detection and Removal Tool will help to remove the malicious software delivered by the Download.Ject Trojan. Once the tool has run--after the End-User License Agreement (EULA) is accepted--it will let you know if your computer has been infected. If your computer is infected, the tool will remove the malicious software that Download.Ject put on your computer.
| Developer | Download | 2000/XP | Rating : Good |
|
|
Recent 
Main Menu
Theme
