BleepingComputer.com Newest Downloads

RKill

BleepingComputer.com — Mon, 13 May 2013 12:28:33 EDT

RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies that stop us from using certain tools. When finished it will display a log file that shows the processes that were terminated while the program was running.

As RKill only terminates a program's running process, and does not delete any files, after running it you should not reboot your computer as any malware processes that are configured to start automatically will just be started again. Instead, after running RKill you should immediately scan your computer using some sort of anti-malware or anti-virus program so that the infections can be properly removed.

Below are a list of RKill download links using different filenames. We offer RKill under different filenames because some malware will not allow processes to run unless they have a certain filename. Therefore when attempting to run RKill, if a malware terminates it please try a different filename offered below.

RKill download links:

RKill.com Download Link
RKill.exe Download Link
RKill.scr Download Link
eXplorer.exe Download Link - This renamed copy may trigger an alert from MBAM. It can be ignored and is safe.
iExplore.exe Download Link
uSeRiNiT.exe Download Link
WiNlOgOn.exe Download Link

For more information about RKill and to ask questions regarding how it should be used, please visit the support topic here:

RKill - What it does and What it Doesn't - A brief introduction to the program

VT Hash Check

BleepingComputer.com — Thu, 09 May 2013 19:17:08 EDT

VT Hash check adds a context menu item for all files allowing you to quickly search VirusTotal.com for matching files and their corresponding malware reports.

Windows Repair (All-in-One) Portable

BleepingComputer.com — Tue, 07 May 2013 18:30:52 EDT

Windows Repair (All-in-One) Portable is the portable version of Windows Repair. This version allows you to use the program from a portable device such as a USB flash drive. This tool will allow you to repair common issues with your computer such as firewall, file permission, and Windows Update problems. When using this tool you can select the particular fixes you would like to launch and start the repair process.

Windows Repair can perform the following tasks:

Reset Registry Permissions
Reset File Permissions
Register System Files
Repair WMI
Repair Windows Firewall
Repair Internet Explorer
Repair MDAC & MS Jet
Repair Hosts File
Remove Policies Set By Infections
Repair Icons
Repair Winsock & DNS Cache
Remove Temp Files
Repair Proxy Settings
Unhide Non System Files
Repair Windows Updates
Repair CD/DVD Missing/Not Working

Tweaking.com - Windows Repair 1.9.14 Change Log.

The awesome guys over at Malwarebytes gave me permission to allow Tweaking.com - Windows Repair to download and install Malwarebytes Anti-Malware and start a scan right from the program. This will now help make things a little easier for novice users and is a few less steps that my fellow techs need to do. When you start the program the scan option is on "Step 1" and is totally optional :-)

Windows Repair (All In One)

BleepingComputer.com — Tue, 07 May 2013 18:30:46 EDT

Windows Repair is a utility that contains numerous mini-fixes for Windows. This tool will allow you to repair common issues with your computer such as firewall, file permission, and Windows Update problems. When using this tool you can select the particular fixes you would like to launch and start the repair process.

Windows Repair can perform the following tasks:

Reset Registry Permissions
Reset File Permissions
Register System Files
Repair WMI
Repair Windows Firewall
Repair Internet Explorer
Repair MDAC & MS Jet
Repair Hosts File
Remove Policies Set By Infections
Repair Icons
Repair Winsock & DNS Cache
Remove Temp Files
Repair Proxy Settings
Unhide Non System Files
Repair Windows Updates
Repair CD/DVD Missing/Not Working

Tweaking.com - Windows Repair 1.9.14 Change Log.

The awesome guys over at Malwarebytes gave me permission to allow Tweaking.com - Windows Repair to download and install Malwarebytes Anti-Malware and start a scan right from the program. This will now help make things a little easier for novice users and is a few less steps that my fellow techs need to do. When you start the program the scan option is on "Step 1" and is totally optional :-)

Farbar Recovery Scan Tool

BleepingComputer.com — Mon, 22 Apr 2013 18:09:29 EDT

Farbar Recovery Scan Tool, or FRST, is a portable application designed to run on Windows XP, Windows Vista, Windows 7 and Windows 8 in normal or safe mode to diagnose malware issues. It is also possible to run FRST in the Windows Recovery Environment in order to diagnose and fix boot issues.

If you are using Windows XP and have boot issue, the system should boot to the Recovery Environment using a PE Boot CD and then you can run FRST

This program will display detailed information about the Windows Registry loading points, services, driver services, Netsvcs entries, known DLLs, drives, and partition specifications. It will also list some important system files that could be patched by malware.

Note: There are both 32-bit and 64-bit versions of Farbar Recovery Scan Tool available. Please pick the version that matches your operating system's bit type. If you don't know which version matches your system, you may try both of them. Only one of them will run on your system.

GMER

BleepingComputer.com — Fri, 19 Apr 2013 17:09:44 EDT

GMER is a anti-rootkit scanner that searchs your computer for Rootkits on your computer and then allows you to attempt to remove them.

A rootkit is a malware program that is designed to hide itself or other computer infections on your computer. These types of programs are typically harder to remove than generic malware, which is the reason that stand-alone utilities such as TDSSKiller have been developed.

GMER is available as a random named .EXE files or a .ZIP file. When you run GMER, if it is shutdown automatically, then it is most likely the infection detecting that GMER is running and terminating it. In this situation you should use the .EXE download link to download a random named version of GMER. If you are unable to run that, then please rename the download to iexplore.exe before you attempt to run it.

GMER scans for the following:

hiddenprocesses
hiddenthreads
hiddenmodules
hiddenservices
hiddenfiles
hiddendisk sectors (MBR)
hiddenAlternate Data Streams
hiddenregistry keys
drivers hooking SSDT
drivers hooking IDT
drivers hooking IRP calls
inline hooks

GMER 2.0 Change Log:

Added support for Windows 8
Added full support for Windows x64
Added Trace I/O function
Added disk "Quick scan" function

Malwarebytes Anti-Malware

BleepingComputer.com — Wed, 10 Apr 2013 17:02:21 EDT

Malwarebytes' is an important security program for any computer user to have installed on their computer. It is light-weight, fast, and best of all, excellent at removing the latest infections that may be in the wild. Malwarebytes' is updated numerous times throughout the day, which allows you to stay protected from threats as they come out. One of the best parts of the program is that not only will it scan your computer free, but it will also remove any malware it finds at no cost to you either.

If you want to increase your protection from new viruses, then you can pay to activate the program to enable real-time protection and other features. The real-time protection module will block infections as they are created or run from your computer. The real-time protection module will also block access to know malware distribution sites in order to protect you from web sites that may be trying to redirect you to known malware sites. Last, but not least, the paid version will also allow you to schedule when you want the program to update its definitions. This will enable you to have the latest updates available whenever you scan your computer with program.

Regardless of whether or not you pay to activate Malwarebytes, we suggest that you install this program on your computer and perform a routine scan with it at least once a week. This will assure you that your computer is being secured from some the newest infections out there.

For a more detailed tutorial on how to clean your computer using Malwarebytes' Anti-Malware, please visit this guide:

How to use Malwarebytes' Anti-Malware to scan and remove malware from your computer

HitmanPro

BleepingComputer.com — Wed, 03 Apr 2013 13:20:13 EDT

HitmanPro is an anti-virus program that describes itself as a second opinion scanner that should be used in conjunction with another anti-virus program that you may already have installed. If malware slips past your anti-virus software, HitmanPro will then step in to detect it. Though SurfRite bills themselves as a second opinion scanner that does not mean that you cannot use the program as your primary anti-virus product. This is because its scanning technology not only incorporates its own virus definitions but also has the ability to scan files on your computer with the definitions of 5 other anti-virus vendors.

A strong feature of HitmanPro is its Scan Cloud feature. This feature comes into play when HitmanPro detects a suspicious file that they are unsure of. When a suspicious file is detected, HitmanPro will upload the file to their cloud where it will then be scanned by 5 other anti-virus vendors. Using the scan results from these vendors, HitmanPro will then decide when or not that file should be classified as malware and removed. This approach is very effective as it allows a more thorough approach to detecting new malware.

HitmanPro also includes the ability to create a bootable USB drive that contains HitmanPro.Kickstart. Kickstart is a full featured version of HitmanPro that can be run directly from the bootable USB drive. This makes it very useful for removing stubborn infections, such as Ransomware, that corrupt Windows Safe Mode or disable your ability to access the Windows Desktop.

Shortcut Cleaner

BleepingComputer.com — Fri, 22 Mar 2013 11:41:34 EDT

Shortcut Cleaner is a utility that will scan your computer for Windows shortcuts that have been hijacked by unwanted or malicious software. When Shortcut Cleaner finds bad shortcuts, it will automatically clean them so that they do not open unwanted programs.

When run, Shortcut Cleaner will scan various locations on your computer for Windows shortcuts. When a shortcut is detected it will check properties for a possible hijacking. If one is detected, it will automatically clean the shortcut so that it no longer opens the offending program or web site. When the Shortcut Cleaner has finished scanning your hard drive it will create a log file on your desktop called sc-cleaner.txt and then display it. This log file will contains a list of all the shortcuts that were detected and cleaned.

As of version 1.2.2, Shortcut Cleaner will also clean hijacked Registry entries associated with known hijackers.

This tool is currently used to clean shortcuts hijacked by the following domains:

Search.certified-toolbar.com
widdit.com
searchcompletion.com
complitly.com
newhometab.com
dtinstaller.com
chipinstaller.com
homebase-apps.com
helperbar.com
22find.com

If an above listing is an link, then it leads to a removal guide for the corresponding hijacker.

Malwarebytes Anti-Rootkit

BleepingComputer.com — Thu, 21 Mar 2013 18:41:56 EDT

Malwarebytes Anti-Rootkit is a free program that can be used to search for and remove rootkits from your computer. When started, Malwarebytes Anti-Rootkit will scan your computer and allow you to remove any rootkits that it finds.

A rootkit is a malware program that is designed to hide itself or other computer infections from being seen or detected on your computer. This is why specialized applications, such as Malwarebytes Anti-Rootkit, are created whose sole purpose is to find these types of infections.

This program is currently in Beta and should only be used if you are comfortable using this type of software.

This program can target the following types of rootkits:

Kernel mode drivers hiding themselves like TDL1, TDL2/TDSS, MaxSS, Srizbi, Necurs, Cutwail, etc.
Kernel mode driver patchers/infectors, embedding malicious code into core files of an Operating System, such as TDL3, ZeroAccess, Rloader, etc.
Master Boot Record infectors such as TDL4, Mebroot/Sinowal, MoastBoot, Yurn, Pihar, etc.
Volume Boot Record/OS Bootstrap infectors like Cidox
Disk Partition table infectors like SST/Alureon
User mode patchers/infectors like ZeroAccess.

Usage Instructions

Using Malwarebytes Anti-Rootkit is very easy. Simply download the program and extract its contents to a directory. Then open the folder and double-click on the mbar.exe to start the program. Follow the prompts and be sure to update the definitions when it asks. If it detects any infections, please allow the program to remove them.

If you are having issues with your computer after removing a rootkit, you can then run the fixdamage.exe program to repair any Windows services that may have been damaged by the rootkit. This will recreate a variety of services that will allow you to access the Internet again or perform other functions that were broken.