|
Malicious Software Removal Tools Worms/Viruses: Microsoft ~ Malicious Software Removal Tool
The free Microsoft Malicious Software Removal Tool scans your hard disk for and tries to remove certain variants of known worms and viruses.
Malicious Software Removal Tool
Published: January 11, 2005 | Updated: May 9, 2006
Skip the details and run the tool:
DOWNLOAD AND RUN AT WEBSITE:
http://www.microsoft.com/downloads/details.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en
The Microsoft Windows Malicious Software Removal Tool checks computers running Windows XP, Windows 2000, and Windows Server 2003 for infections by specific, prevalent malicious software—including Blaster, Sasser, and Mydoom—and helps remove any infection found. When the detection and removal process is complete, the tool displays a report describing the outcome, including which, if any, malicious software was detected and removed.
Microsoft releases an updated version of this tool on the second Tuesday of each month, and as needed to respond to security incidents. You can run the tool from this Web page anytime or download it to your computer.
Windows Update delivers versions for Windows XP and Windows Server 2003 SP1.
Microsoft Update delivers versions for Windows XP, Windows 2000, and Windows Server 2003.
Microsoft Download Center has versions for all supported Windows versions.
Note The version of the tool delivered by Microsoft Update and Windows Update runs in the background and then reports if an infection is found. If you would like to run this tool more than once a month, use the version on this Web page or install the version that is available in the Download Center.
Because computers can appear to function normally when infected, Microsoft advises you to run this tool even if your computer seems to be fine. You should also use up-to-date antivirus software to help protect your computer from other malicious software.
Note You must be logged on to your computer with an account that is part of the Administrators group to run this tool.
Scan and Clean Your PC
1.
Verify Your Windows Version
This tool works only on Microsoft Windows XP, Windows 2000, and Windows Server 2003. If you are not sure which version of Windows you are running, review instructions for how to check.
2.
Run the Removal Tool
This tool scans your hard disk for viruses and tries to remove them. To proceed, click Check My PC for Infection.
Note To use this tool, you must agree to the terms of the end user license agreement. Your computer may also display a warning that the tool is attempting to run; click Yes to proceed.
Note If you have difficulty running the tool from this page, it may be due to your browser's security settings. If you have any problems, try downloading the tool directly from the Microsoft.com Download Center and then running it manually.
For support within the United States and Canada, call toll-free (866) PCSAFETY (727-2338).
For support outside the United States and Canada, visit the Product Support Services Web page.
McAfee AVERT Stinger ~ (worm / virus removal):
McAfee AntiVirus and Firewall Protection offers "Stinger" - malicious tool removal utility. Download and run. This will automatically remove worms and viruses.
http://us.mcafee.com/virusInfo/default.asp?path=/virusInfo/virusRemoval/Stinger.asp
Download Stinger.exe : (please download at their website)
(http://download.nai.com/products/mcafee-avert/stinger) (dot execute)
How do I use Stinger?
This version of Stinger includes detection for all known variants, as of August 14, 2003:
BackDoor-AQJ Bat/Mumu.worm Exploit-DcomRpc
IPCScan IRC/Flood.ap IRC/Flood.bi
IRC/Flood.cd NTServiceLoader PWS-Sincom
W32/Bugbear@MM W32/Deborm.worm.gen W32/Elkern.cav
W32/Fizzer.gen@MM W32/FunLove W32/Klez
W32/Lirva W32/Lovgate W32/Lovsan.worm
W32/Mimail@MM W32/MoFei.worm W32/Mumu.b.worm
W32/Nimda W32/Sdbot.worm.gen W32/SirCam@MM
W32/Sobig W32/SQLSlammer.worm W32/Yaha@MM
INSTRUCTIONS FOR WORM / VIRUS REMOVAL TOOL:
MCAFEE STINGER
1.) Download Stinger.exe
This version of Stinger includes detection for all known variants, as of August 14, 2003:
2.) When prompted, choose to save the file to a convenient location on your hard disk (such as your Desktop folder).
3.) When the download is complete, navigate to the folder that contains the downloaded Stinger.exe file, and run it. WindowsME/XP users read this first:
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
4.) The Stinger interface will be displayed.
5.) If necessary, click the Add or Browse button to add additional drives/directories to scan. By default the C: drive will be scanned.
6.) Click the Scan Now button to begin scanning the specified drives/directories.
7.) By default Stinger will repair all infected files found.
McAfee AVERT Stinger
Using next generation scan engine technology, Stinger is a stand-alone utility used to detect and remove specific viruses and worms, including Lovsan. Note: It is not a substitute for full anti-virus protection, but rather a tool to assist administrators and users when dealing with an infected system. To learn more, read our FAQ :
http://us.mcafee.com/virusInfo/default.asp?path=/virusInfo/virusRemoval/Stinger.asp#faq
Frequently Asked Questions 
What is the List Viruses button used for?
A list of the viruses that stinger is configured to detect is displayed when pressing the List Viruses button. This virus list does not contain the results from running a scan.
How do I save the scan results to a log file?
Click the File menu and select Save report to file
I know I have a virus, but Stinger did not detect one. Why is this?
Stinger is not a substitute for a full anti-virus scanner. It is only designed to detect and remove specific threats.
How can I get support for Stinger?
Stinger is not a supported application. AVERT makes no guarantees about this product.
Stinger found a virus that it couldn't repair. Why is this?
This is most likely due to Windows System Restore functionallity having a lock on the infected file. WindowsME/XP users should disable system restore prior to scanning.
Are there any command-line parameters available when running Stinger?
Yes, the parameters are displayed when passing STINGER.EXE the /? switch:
/ADL - Scan all local drives. /GO - Start scanning immediately. /LOG - Save the log file after scans. /SILENT - Do not display graphical interface.
Where can I send feedback to regarding Stinger?
Send your feedback to Stinger@avertlabs.com
Update History
8/14/2003
Corrected issue, which prevented W32/Lovsan.worm.a from being repaired properly
8/13/2003
Added detection for Exploit-DcomRpc, W32/Lovsan.worm.a & .b, and generic W32/Lovsan.worm to version 1.8.1, posted ePO version 1.8.0
8/11/2003
Added W32/Lovsan.worm
8/01/2003
Added W32/Mimail@MM, posted ePO version 1.7.9
7/30/2003
Added detection for IRC/Flood.ap, IRC/Flood.bi, IRC/Flood.cd, W32/Sdbot.worm.gen, and W32/MoFei.worm
7/21/2003
Added detection for W32/Deborm.worm.gen
7/03/2003
ePO verson 1.7.6 posted
7/02/2003
Added detection for W32/Mumu.worm.b and PWS-Sincom
6/25/2003
Added detection for W32/Sobig@MM variants
6/20/2003
Minor detection name correction
6/19/2003
Added detection for Bat/Mumu.worm, IPCScan trojan, NTServiceLoader trojan, PCGhost application, RemoteProcesslLaunch application, W32/Lovgate.n@M, and W32/Yaha.t@MM - .u@MM
6/5/2003
Added detection for W32/Bugbear.b@MM
5/16/2003
Added detection for W32/Lovgate.j@M through .m@M Resolved an issue where Stinger was not preserving the last access date on files. Posted ePO Deployable version of Stinger 1.6
5/12/2003
Added detection for W32/Fizzer@MM and W32/Yaha.s@MM
4/14/2003
Added detection for W32/Lovgate.e@M - W32/Lovgate.g@M, updated BackDoor-AQJ detection, W32/Yaha.m@MM - W32/Yaha.r@MM Includes self-validation integrity check
2/26/2003
Added detection for W32/Lovgate.a@M - W32/Lovgate.d@M, BackDoor-AQJ, W32/Sircam@MM, W32/Funlove@MM, and W32/Nimda.a@MM - W32/Nimda.q@MM
2/14/2003
Posted EPO deployable version of Stinger.exe
1/25/2003
Added detection for W32/SQLSlammer.worm and name detection for W32/Lirva.c@MM
1/08/2003
Added detection for W32/Lirva.a@MM and W32/Yaha.m@MM
12/30/2002
Added detection for W32/Yaha.a@MM - W32/Yaha.l@MM DAT files are now stored in the executable
10/09/2002
Removed Rwabs.dll dependency as it caused problems for users who had very old versions of the scan engine installed Allows users to enter a drive letter or driver letter: when configuring Stinger to scan for additional drives Clarified the purpose of the List Viruses button
10/04/2002
Reposted package as self-extracting arcive instead of .zip archive, updated DAT files to include detection for corrupted W32/Bugbear.dam files.
| 
