Useful Malware Removal and Diagnostics Tools

Since I blew my entire weekend exuding hate towards car salesmen (weekends are when I queue my posts), here is another quick and easy post. This time it is a list. Lists are cool, right?

If you recall, not so long ago, I release the Definitive Guide for Removing Malware. Today I wanted to expand upon that post and list more tools and websites you may find useful on your journeys.

It is dangerous to go alone, take these!

Diagnostic Tools

Sometimes, before you even start removing things, it is a good idea to diagnose the problem. This is especially important when you are doing remote support for a clueless user. Here is a list of nifty tools that don’t necessarily remove stuff, but instead dump out log files that can help you identify potential problems.

• Hijack This – by far, the most popular diagnostic tool out there. It is easy to use, has a neat GUI and it is backed by Trend Micro. Sometimes it is a good idea to use it with one of the multiple online analysis tools.

• X-Ray PC -s imilar to Hijack This but with built in analysis tools that flag legitimate software and potential threats.

• D.D.S. – a nifty diagnostic tool created by one of the regulars at the Bleeping Computer forums. It is good alternative when dealing with users who can’t be bothered to click on GUI buttons. You can have them just run this, and then make them attach the resulting log files to an email.

• Random’s System Information Tool (RSIT) – this one is actually quite comprehensive. It incorporates a silent Hijack This run, but lists much more information.

• Screen317’s Security Check – very useful tool that allows you to quickly check whether or not the machine in question has some gaping security holes. It makes a few WMI calls to see if an AntiVirus software is installed, if a firewall is running, if Java, Flash and Adobe Reader are up to date, if you are running an updated browser and etc. Dumps everything into a text file, with BBCode formatted headings.

• GMER – a very comprehensive rootkit detector.

• Rootkit Unhooker – another rootkit detector, this one focused on finding weird API hooks.

• Rootkit Repeal – and another one, in case the other ones were being blocked.

Removal Tools

These are good removal tools that go above and beyond of what your usual A/V suite does. Some of these are fairly big apps that need to be installed. Others are tiny self-contained executables.

• Malwarebytes – hands down, one of the most popular and most respected removal tools out there now. You can use it for free, but it does have a paid version which comes with a resident scanner. It is a typical A/V like tool that needs to be installed to work.

  Since this tends to be the tool to end all tools, here are some very useful links:

  • mbam-rules.exe – direct link to the offline updates. If the infected machine can’t connect to the internet and download updates after the installation is complete, you can use this to install the latest definitions.

  • mbam-clean.exe – if your Malwarebytes is broken after a botched patch, you can use this tool to remove it.

• Super AntiSpyware – another tool I mentioned in my definitive guide. It gets good results. It also requires installation.

• Dr. Web CureIt – small, self contained executable with a nice GUI. I found cases in which it was able to remove threats that Malwarebytes and SuperAntispyware couldn’t.

• ComboFix – very ugly, but very, very effective. It is tiny, self contained but it packs quite a punch. If ComboFix can’t remove something I usually start prepping for re-imaging, because chances are nothing else will work either.

• TDSSKiller – a nice, self contained, GUI removal tool specializing in ripping out the notorious TDSS familly rootkits and bootkits. Made by Kaspersky.

• GooredFix – tool for fixing the Google redirects often left over by malware.

• VundoFix and VirtuoMundo Begone – stand-alone tools for fixing the notorious Vundo family trojans.

• CWShreader – tool for removing the CoolWebSearch malware (which I haven’t seen in a while).

• McAfee Removal Tool (MCPR) – removes the notorious bloatware that is McAfee. Works with most of their products. Useful if your A/V suite gotten itself into a weird state and can’t be uninstalled normally (which seems to happen after every patch for some reason).

Misc. Tools

Here is a collection of tools that do not detect or remove any Mallware, but help during cleanup or preparation stages.

• CCleaner – automated temp file deletion tool. Helps to recover disk space, and also flushes out all the common places where malware likes to hide their executables. Warning: the installer likes to ship with like 7 million toolbars, so be vigilant during the installation process.

• ATF Cleaner – similar to the above, but self contained, and small. Slightly less thorough, but it doesn’t ship with toolbars.

• RKill – neat little script that will kill unnecessary processes. Very useful when trying to clean up an infected machine. Often it is able to kill very persistent malware, and keep it out of memory while you scan.

• DeFogger – another Bleeping Computer tool. This one lets you temporarily disable all CD emulation tools which could interfere with rootkit detection.

• Unhide Tool – another one from Bleeping Computer forums. A lot of recent infections hide all the files and folders on your system. This tool scans through the filesystem and removes the hide flag from everything that is not supposed to have one.

• Secunia PSI – scans your system, and checks if all the installed software is up to date. Complains all the time if it is not. Can be a memory hog if you run it at all times, but very useful if you need to make sure a machine is all up to date.

Checking Files for Viruses

Sometimes you download a weird file, and want to make sure it contains no viruses. Your A/V may clear it, but if you want to be absolutely sure, you may want to try one of these:

• Kaspersky Online Scan – scans a single uploaded file using the latest and greatest version of Kaspersky A/V.

• Jotti Malware Scan – scans a single uploaded file with a dozen antivirus suites.

• Virus Total – you can either submit a single file, or a URL to a file. It will be scanned with a very comprehensive list of virus scanners. Possibly the best site of this kind.

Online Scanners

Finally, I leave you with a list of “scan from your browser” type services. They may or may not be useful to you.

• Norton Security Scan
• ESET Online Scanner
• F-Secure Online Scanner
• Panda ActiveScan 2.0
• CA Threat Scanner
• Bit Defender Quick Scan

And there you go. This list is by no means complete, so feel free to leave links to interesting and useful tools in the comments.

Oh, I almost forgot to do a little bit of shameless self promotion. If you want all the tools above as functional buttons on a single tab, then Luke’s Setup Assistant is a perfect tool for you. This list is essentially everything that is located on the security tab.