Antivirus Tools

Jump to File Area:

This menu is obsolete!

Go here for the new downloads area: CLICKY! Essentials:

SYSTEM REQUIREMENTS:
Processor Pentium 3, 128 MB RAM, 100 MB of free hard disk space
Microsoft Windows 2000, Microsoft Windows XP/Vista/7 (32/64 bit)
---------------------------------
Core and detection
Antivirus and anti-spyware engine

State of the art scanning engine provides reliable protection against viruses, spyware and other forms of malicious software.
Real time anti-rootkit protection

Unique "on access" technology checks all kernel-mode drivers that the operating system is loading for signs of rootkit behavior. This enables even unknown rootkits to be detected and stopped before they can do any damage.

avast! Community IQ
Most samples we process come from sensors deployed throughout the avast! community in the Behavior shield and anti-rootkit modules. This is a unique source of data made possible only thanks to our huge user base. Most of the collected samples are analysed by a number of automated processes and only a small fraction of the samples need to be processed manually by our virus analysts.
 Code emulator

When a suspicious executable is encountered (during both on-demand and on-access scanning), avast! is able to emulate the program’s code in an isolated environment. The code emulator is used for two purposes. First, it is used for generic unpacking. Secondly, it is used in the heuristics engine. Technically, this is done using dynamic translation, a method much faster than traditional emulation techniques.

Heuristics engine
Starting with version 5.0, avast! features a new heuristics engine designed to proactively detect malware undetectable with normal definitions. The heuristics engine is able to cover both binary (executable) and script malware.
Potentially unwanted programs detection

New in version 5.0, avast! now detects potentially unwanted programs, such as remote admin tools and commercial key loggers. Custom rules can be set for dealing with these types of programs.
Scanning

Boot-time scanner
Allows you to scan your computer for infections before the operating system has started and before a virus can be activated (32-bit operating systems only).

Command-line scanner
Enables you to run a scan directly from the command line.

Wake-up for scan
Microsoft Windows is woken from sleep or hibernation mode, performs a scheduled scan, then returns back to sleep mode.

Scheduled scanning
Allows users to define the scan time and files to be scanned.

avast! Intelligent Scanner
Can reduce the number of required file scans by up to 80% through a white list of proven safe applications. Files identified as safe are not rescanned unless they change.

SHIELDS
Behavior Shield
Monitors activity on your computer using a number of sensors (file system, registry and network based) and reports/blocks any suspicious behavior.

Behavioral Honeypots
avast! sensors identify and monitor suspicious file activity on selected computers, automatically submitting files to the Virus Lab for additional analysis.

File System Shield
Real-time scanning of opened/executed files.

Mail Shield
Scans all incoming/outgoing e-mails for malware. For MS Outlook, a special plug-in is used. Other email clients are protected by a generic POP3/IMAP4/SMTP proxy. New in version 5, the proxy also supports scanning of SSL communication (gmail.com, sympatico.ca, ….)

Web Shield
Scans all visited web pages and checks all files, pages and java scripts downloaded from the internet. Thanks to the Intelligent Stream Scan feature, the Web shield doesn't slow down your web browsing.

P2P Shield
Checks files downloaded using P2P programs. - ABC, Ares, Azureus, BearShare, Bit Torrent, BitComet, BitLord, BitPump, CZDC++, Direct Connect, eDonkey, eMule, iDC++, iMesh, Kazaa, Kceasy, LimeWire, Morpheus, Opera's DC++, Overnet, Qtrax, Shareaza, SoulSeek, StrongDC++, uTorrent, Vuze, WinMX, Winny2, Zultrax.

IM Shield
Checks files downloaded while using instant messaging or “chat” programs. - AIM (AOL Instant Messenger), Gadu-Gadu, gaim/Pidgin, Google Talk, ICQ, IM2 Messenger, Infium, Miranda, mIRC, MSN/Windows Messenger, Odigo, PalTalk Messenger, Psi Jabber Client, QIP, QQ, SIM, Skype, Tlen, Trillian, WengoPhone, XFire, Yahoo! Messenger.

Network Shield
Provides protection against network-based viruses. The module has two main components: a URL blocker, designed to block malicious URLs (as defined by the Virus Lab), and a lightweight intrusion-detection system.

Updates
Smart virus definition updates
Incremental updating system minimizes the size of regular update files.

Fast application of updates
New format for the virus definition file speeds up application of updates into avast! 5.0 and reduces demand on CPU/memory, resulting in uninterrupted computer use.
New format for the virus definition file means faster updates and reduces demand on CPU/memory, resulting in uninterrupted computer use.

Gaming
Silent/Gaming Mode
New Silent/Gaming Mode automatically detects full-screen applications and disables pop-ups and other on-screen notifications without degrading security.

Optimized for latest Intel Core i7 CPUs
Critical sections of the avast! scanning engine code have been optimized to deliver unrivaled performance on the latest Intel chips.

CPU optimization
Multi-threaded scanning optimization
avast! runs faster on new multi-core CPUs. A new avast! feature allows the splitting of large individual files between cores, accelerating the scanning process.

Green computing
Reduced demands on the disk drive result in lower energy consumption.
Miscellaneous

avast! iTrack
Real-time graphic scanning reports.

Graphical user interface
Easy to navigate graphical interface.

Automatic processing
Infected files are processed automatically without requiring user instructions.

Avast! 4.8 Freeware

HostsXpert

Features:
Append File - Allows selection of a file to be appended to your current hosts file.
Replace File - Allows selection of a file to replace your hosts file.
Merge File - Allows selection of a file to be merged with your current hosts file.
Create Backup - Creates a Backup of you current hosts file. Backup file will be placed where ever HostsXpert.exe resides on your Hard drive.
Restore Backup - Restores the backup hosts file.
Restore MS Hosts - Restores the hosts file to Microsoft's original hosts file.
Add to Hosts Files - Adds the line item into your hosts file.
Delete Line - Deletes highlighted line from hosts file.
Toggle Comment - Toggles whether or not a line is a comment ('#').
Sort File - Sorts the current hosts file in alphanumeric order, removes all comment lines and duplicates.
Swap Localhost - Swaps the current hosts file between 127.0.0.1 and 0.0.0.0
Remove Block Items - Removes all blocking lines in the current hosts file.
Copy to Clipboard - Copies the current hosts file to the clipboard.
Make Hosts read-only/writable toggle
Search - Enter text to be searched for, click Previous or Next.
Open in Memopad - Opens the Memopad built-in to HostsXpert.  
Save Hosts - Saves the Hosts file from Memopad.
Save As - Allows you to save the hosts file as a file other than Hosts.
Save Hosts Exit Memopad - Saves the Hosts file from Memopad, and returns you to normal view.
Exit Memopad - Does not save changes.
Whitelist
Remove Whitelist Items -Removes whitelisted Domains from your hosts file.
Add Whitelist Items - Add the whitelisted domains back into your hosts file.
ViewWhitelist - Opens up your whitelist for direct editing.
Save and Exit Whitelist - Saves changes, and closes the editor.
Exit Whitelist - Exits the editor and Discards changes/does not save the whitelist
Download
Merge with or Replace your existing hosts file with either MVPs Hosts file or HpHosts file.
New in v4.1 - You can check for updates via the download menu.
Both websites offer an email subscription service for notification of updates-
MVPsHosts can be found here: http://www.mvps.org/winhelp2002/hosts.htm

MalwareBytes' AntiMalware

SpyBot Search and Destroy 1.62

HiJack This!

Random's System Info Tool

LSP Fix

Repairs Winsock 2 settings, caused by buggy or improperly-removed Internet software, that result in loss of Internet access

LSP-Fix is a free Windows utility to repair a loss of Internet access associated with certain types of software. This type of software, known as a Layered Service Provider or LSP, typically handles low-level Internet-related tasks, and data is passed through a chain of these programs on its way to and from the Internet. However, due to bugs in the LSP software or deletion of the software, this chain can get broken, causing the Internet connection to become inaccessible.

Unfortunately, problematic LSP software, including malware/spyware, is sometimes quietly installed by unrelated products such as file-sharing programs, sneaking onto a system unannounced. In fact, in many cases, the user does not know of its existence until something goes wrong, and he/she can no longer access Web sites. Historically, New.net* (NEWDOTNET) and WebHancer* (often bundled with file-sharing utilities, DVD player software, and other free downloads) have been the worst offenders, but the problem can be caused by any improperly-written Layered Service Provider software, or the deletion of any LSP program's files. LSP-Fix repairs the LSP chain by removing the entries left behind when LSP software is removed by hand (or when errors in the software itself break the LSP chain), and removing any gaps in the chain.

Eset Smart Security 4.0.437 (64-bit)

ESET 64 Bit System Inspector

Root Repeal

RootRepeal is a new rootkit detector currently in public beta.  It is designed with the following goals in mind:
Easy to use - a user with little to no computer experience should be able to use it.
Powerful - it should be able to detect all publicly available rootkits.
Stable - it should work on as many different system configurations as possible, and, in the event of an incompatibility, not crash the host computer.
Safe - it will not use any rootkit-like techniques (hooking, etc.) to protect itself.

Currently, RootRepeal includes the following features:
Driver Scan - scans the system for kernel-mode drivers.  Displays all drivers currently loaded, and shows if a driver has been hidden, and whether the driver's file is visible on-disk.
Files Scan - scans any fixed drive on the system for hidden, locked or falsified* files.
Processes Scan - scans the system for processes.  Displays all processes currently running, and shows if a processes is hidden or locked.
SSDT Scan - shows whether any of the functions in the System Service Descriptor Table (SSDT) are hooked. 
Stealth Objects Scan - attempts to determine if any rootkits are active by looking for typical symptoms.
Hidden Services Scan - scans for hidden system services.
Shadow SSDT Scan - counterpart to the SSDT Scan, but deals mostly with graphics and window-related functions.

* - falsified files are files which have their size mis-reported to the Windows API.  Some rootkits use this to hide data.

RootRepeal is currently in public beta.  Whereas every effort has been made to ensure compatibility with every system configuration on Windows 2000, XP, 2003 and Vista, it cannot be guaranteed.  There is always some risk when scanning for rootkits.  Before running RootRepeal, please make sure you have backups of all important data and have saved all open documents.

HiJackFree 32/64 bit

Optional Tools:
- - - - - - - - - -
FreeFixer 0.55
Runscanner startup/hijack analyzer

Runscanner : Freeware startup and hijack analyzer
16 September 2009 : version 1.9 released  	
	RunScanner is a freeware windows system utility which scans your system for all running programs, autostart locations, drivers, services and hijack points.
You can use Runscanner to detect changes and misconfigurations in your system caused by spyware, virusses or human errors.

Why should you use Runscanner?
	100+ start/hijack locations 
	Online malware analysis
	Import and export of .run files
	Powerful process killer
	Save to text log file
	Powerful file filtering
	Host file editor
	History backup / restore 
	Explorer jump
	Analysis of file certificates 
	Beginner, Expert mode
	Bit9 FileAdvisor MD5 lookup 
	Systemlookup.com lookup 
	Upload file to VirusTotal 
	Analyze loaded modules 
	Google lookup
	Runscanner database lookup
	Regedit jump

Beginner mode
This is for novice users that want to do a scan and upload their results to a malware specialist forum.

Expert mode
This is for advanced users, all startup tweaks, scanning, reporting, filtering and delete features are available.

Warning: Runscanner requires advanced knowledge about Windows. If you delete an item, without knowing what it is, it can lead to major Windows problems. If you are not sure what to delete, post your Run file to a helper forum

rkill.exe
rkill.com
rkill.pif
rkill.scr

The malware world is changing. It’s getting smarter.
In fact, some infections will detect that you have launched an anti-malware tool such as MalwareBytes and close it down as soon as you open it, which makes your job much harder. This is the exact situation Rkill is designed for.

Rkill is a small, freeware and portable tool designed to terminate active malware processes allowing you to use other removal tools. Rkill is made by a Microsoft MVP “Lawrence Abrams” and is available in 4 different extensions. An .EXE, .COM, .SCR and a .PIF file.
The reason why Rkill comes in 4 different versions is because some malware will block .EXE files in an attempt to prevent you from running other malware removal tools, so this gets around that problem.

I tested this tool on a virtual machine which I had infected with a fake antivirus and Rkill killed the malicious processes without any problems. Of course, I then had to delete the malicious files manually as this is not a malware removal tool, but a malware process killing tool. It just stops the malware from running right now, allowing you work your computer technician magic.

Stinger1010815.exe

Stinger Fake Alert Remover
Conficker clean-up tool

Sophos Conficker clean-up tool (standalone version)

The Sophos Conficker clean-up tool (standalone version) allows you to detect, isolate, and remove the Conficker virus from a single computer.

If you need to clean up Conficker infections across a network, use the Sophos Conficker Clean-up tool (network version)

Conficker is a virus that spreads through infected Windows shared folders and USB storage devices. A more detailed description can be found in the knowledgebase article Sophos Anti-Virus for Windows 2000+: removing W32/Confick and Mal/Conficker.

Operating systems affected
Windows 2000
Windows XP and Vista
Windows Server 2003 and 2008
 
Important  
If you are running Sophos Anti-Virus you do not need to disable HIPs while you're using the Sophos Conficker Cleanup Tool. Whilst this tool should not conflict with other anti-virus products, the nature of the tool means it may be blocked by behaviour-based (HIPS) functionality within non-Sophos anti-virus solutions. 
What to do

Ideally the tool should be downloaded to a computer that is not infected by Conficker. You can then make a copy onto a CD or a DVD and use that on your infected computers. If all your computers are infected this may not be possible.

In order to run the tool you must be logged on to the computer that you want to clean as a user with full administrative rights.

RADIX PACKAGE

RADIX is the fastest and easiest way to protect your computer from Rootkit Attacks! (for experienced users ONLY)
Similar tool to Root-Repeal thats VERY useful in malware removal.

Rootkits are dangerous programs that are downloaded from the Internet, or present in malicious purchased software, that once installed take over your computer without your knowledge. Rootkits can do anything from logging every one of your keystrokes, including user names and passwords, email messages or even your word processing documents and sending that data off to hackers, to executing programs in the background without your knowledge or permission.

Here's what Radix does... 
Detects and removes Rootkits using sophisticated methodologies.
Detects and repairs drivers that have been modified by Rootkits.
Detects and repairs computer processes modified by Rootkits.
Detects and reveals hidden processes and files, including Alternate Data Streams (ADS).
Allows the removal of "locked" or "unremovable" processes and files.
Provides to dump memory areas from processes.
Shows the Global Descriptor Table (GDT) for advanced Rootkit Detection capabilities.
Shows the Import Address Table (IAT) for advanced Rootkit Detection capabilities.
Shows the Interrupt Descriptor Table (IDT) for advanced Rootkit Detection capabilities.
Shows hidden Registry Keys.
Operates in both command line mode for power users, or as a graphical tool for regular users.

Start Dreck 2.1.7
McAffees Removal Tool
Gopher Smoker
XPY
Flash Disinfector

This is a partial fix for the "Recycler and Autorun Virus/Worm"
This virus has been widely spread these days and it has become very common that every pen drive we use will be infected by this virus. This Recycler virus / BV:AutoRun-G[Wrm] is very annoying one and even formatting the pen drive will not remove the virus. Though antivirus software is able to identify, it cannot remove the virus completely. If you delete this manually, it will again create itself and none of the virus removal tricks could work to resolve the problem.
Download Flash Disinfector and save on some non windows drive.
Double click on it and it will ask you to insert USB flash drive and click ok. Do so.

Clicking on ok will make your desktop go blank, don’t worry, its normal.
It will fix the autorun.inf virus and you are done partially. Yes, its a partial solution, it will lock the autorun file and you will see some file created by flash disinfector. If you remove the file, the virus get re activated. May be some future update of antivirus softwares will have complete fix for this.

Comodo Internet Security

Gromozon Killer

What is Gromozon & how did it bypass my security tools?

Unfortunately Gromozon is not a single infection, but a blended attack designed to bypass traditional anti-malware tools. The end result meaning that the machine is not only infected by several well known Trojans but also a highly dangerous Rootkit. Traditional AV vendors are at the moment dealing with the known infections but overlooking the rootkit.
The path of infection is thus:
On visiting an infected website an obfuscated JavaScript is run. 
The user is forwarded to another site which contains a further obfuscated JavaScript. This connects to a network of websites which are used to launch the infection routine. These websites are constantly changing and since May 2006 have become considerably more numerous 
A server side script is run to analyse the user agent (web browser) under which the user is visiting. Different attack methods are then launched depending on whether the user is running Opera, Firefox or Internet Explorer. 
For Internet Explorer, the victim is presented with the option to install an ActiveX control called FreeAccess.ocx This is actually copied into the Windows system32 folder as a randomly named DLL. 
Firefox and Opera undergo a very clever piece of social engineering. What appears to be a link to www.google.com is presented to the victim. This unfortunately is not a hyperlink but in fact a cleverly hidden .com file. Once accepted and run, a randomly named DLL is again installed to the windows system32 folder. 
Once the DLL agent is installed, various pieces of Adware are downloaded and installed onto the machine. Examples are the Bravesentry and LinkOptimizer Trojans. The real payload is then downloaded to the victim's computer. Both a Rootkit and service component are installed along with a hidden windows user account. The main purpose of this is to enable the Adware which was previously installed to be hidden from any Anti-malware tools installed on the machine

GMER Rootkit Detector

Avast! 4 Pro (Trial)
AVG 8.0
Silent Runners

The purpose of “Silent Runners” is to identify the programs that start up with Windows.

It was first made available to members of the NTBugTraq mailing list in a post on 12 May 2004. The first version posted was actually revision 10. An updated version is available for download here. The revision history is found in comments at the bottom of the script file. Old versions are archived here.

“Silent Runners” is not an anti-virus, an anti-trojan, or a spyware scanner. It only pinpoints how programs start up — it does not scan the system to identify every trace of malware. The text file it creates can be removed for study or stored as a benchmark.

It runs under Windows 95, Windows 98 (Standard Edition and Second Edition), Windows Me (Millennium Edition), Windows NT 4.0, Windows 2000 Professional, Windows XP Home/Professional and Windows Vista. (It will also run under Windows Server 2003, but script operation for this system is not officially supported.) It is written in VBScript (version 5.1 or greater) and relies on WMI to query the registry. WMI is installed by default on Windows Me, Windows 2000, Windows XP, and Windows Vista. It is available via download for Windows 95/98 and Windows NT 4.0. If a compatible version of VBScript isn't installed on your system or if WMI is missing, the script will direct your browser to the appropriate Microsoft download site.

The script changes absolutely nothing on your system (other than adding its report file). It has no option to change anything and no such option will ever be added. However, it is offered without any warranty of any kind, either express or implied. You use it, then, at your own risk.

VIPRE Antivirus Trial
AntiHook Pro

AntiHook 2.6	       ** Still FREE for Home Users **
AntiHook™ - The ultimate Host Intrusion Prevention System (HIPS) for protection against Malicious Software
Exhaustive Realtime Protection - AntiHook detects and prevents attacks in real-time, following the rule -prevention is better than cure-
Complementary to existing firewalls and virus protection - AntiHook is complementary with all other computer protection systems including anti-virus, firewall and anti-spyware systems
No Updates Required - AntiHook works as a standalone module, relying on its local database only and not requiring an update of data definitions	 
	
AntiHook is a unique desktop-based Host Intrusion Prevention (HIP) product. AntiHook dynamically protects your privacy, operating system and applications from malicious software, such as Spyware, Rootkits, Keyloggers, Code Injection, and Trojans.

AntiHook provides kernel mode protection. 
The AntiHook solution does not rely on lists of known Malware, so no updates are required! 
No connection to a server or the internet is required - the protection is virtually built into the operating system! 
You are protected immediately from all new threats - no lag-time for updates to be published! 
AntiHook is complementary with all other computer protection systems including anti-virus, firewall, and anti-spyware systems. AntiHook even protects these systems from malicious attack! 
AntiHook blocks first, and then asks second. Prevention is better than cure! 
The AntiHook solution is optimised for the Microsoft Windows environment and has no noticeable impact on system performance.

Avira AntiVirus
Vista Security Guide
SpyWare Interrogator
AATools Security Suite

AATools investigates and gathers information about your computer, network status, and service availability. That is a layman's way of saying it performs an inspection on everything vital to network security as it pertains to the protection of your computer, including the utilization of tools to check open ports, proxies, email lists, Internet applications, and general system information.

Today there is no program, either anti virus nor anti trojan, that can detect unknown trojan horses. To secure your network, you may need to lock down applications that aren't required by any function you currently use. To do this effectively, you have to know what ports are available and what application is utilizing them. AATools Network Monitor displays the services that are active on all ports. Further, AATools Network Monitor maps the ports in use to their respective applications (this feature is available under Windows NT/2000/XP) providing a simple and easy solution to tracking application to port maps. This mapping is extremely useful while monitoring unwanted connections, investigating suspected trojans, viruses, and possible backdoors intrusions.

AATools includes 12 different state-of-the-art tools for assessing optimizing, managing, and safeguarding your network and computers, all in one easy to use program. The information AATools conveys is simple to understand, easy to assimilate, and conducting a network integrity test for intruders is likewise, very simple. A worthwhile download for anyone wanting to gather info on their network and PC.

Infernal Search

Custom Search