Symptoms:
- Presence of file %SYSTEM%WINdirect.exe.
- Presence of file %SYS@mm

Symptoms:
- Presence of file %SYSTEM%WINdirect.exe.
- Presence of file %SYSTEM%windll.exe.
- Presence of registry key HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunwin_upd.exe = %SYSTEM%WINdirect.exe or
HKCUSOFTWAREMicrosoftWindowsCurrentVersionRunwin_upd.exe = %SYSTEM%WINdirect.exe.
- Presence of registry key HKCUSOFTWAREMicrosoftWindowsCurrentVersionRu1n.

Technical description:
The worm comes in the form of a small file, that drops another file ( namely WINDirect.exe) in the %SYSTEM% directory.

This file then tries to raise it’s privilege level and then starts a thread in which it keeps looking at all the processes and when it finds one within a list ( in order to prevent updating an AV product or the use of a firewall ) it tries to terminate it. Then it starts another thread that tries to download the main part of the massmailer from a list of addresses, each 10 hours.

External Mirror 1

This tool is designed to remove the infections of the fohreats: W32.Bobax.AH@mm, W32.Bobax.Z@mm

This tool is designed to remove the infections of the following threats:

- W32.Bobax.AH@mm
- W32.Bobax.Z@mm

Important: You must have administrative rights to run this tool on Windows NT 4.0, Windows 2000, or Windows XP.

Follow these steps to download and run the tool:

- Download the FixBobax.exe file. Save the file to a convenient location, such as your Windows desktop.
- Close all the running programs.
- If you are on a network or if you

have a full-time connection to the Internet, disconnect the computer from the network and the Internet. If you are running Windows Me or XP, turn off System Restore.
- Restart the computer in Safe mode.
- Locate the file that you just downloaded.
- Double-click the FixBobax.exe file to start the removal tool.
- Click Start to begin the process, and then allow the tool to run.
- Restart the computer.
- Run the removal tool again to ensure that the system is clean.
- If you are running Windows Me/XP, then reenable System Restore.
- If you are on a network or if you have a full-time connection to the Internet, reconnect the computer to the network or to the Internet connection.

The Removal Tool does the following:

- Terminates the associated processes
- Deletes the associated files
- Deletes the registry values added by the threat
- Restores the Shared Access service to the Microsoft Windows default.

External Mirror 1

ClamMail is a personal POP3 proxy for Windows which can also filter emails deleteleting malware

ClamMail is a personal POP3 proxy for Windows which can also filter emails deleting malware.

ClamMail can be used as a POP3 proxy only and (and this was the main reason to create it) to filter incoming emails and delete all unwanted malwares (viruses, trojans, phishings and more).

Here are some key features of “ClamMail”:

� POP3 proxy for single computer or small network allow sharing single Internet connection if only e-mail retrieve is needed
� Delete unwanted malware from e-mails using ClamAV antivirus engine
� Automatic background antivirus database updates
� Reporting by e-mail if malware was found
� Work as Windows NT/XP/2000 service or as Win98 application
� Under Windows NT/XP/2000 any information,warnings,errors are stored in system event log (available to admins using event log viewer from network also)
� Localized versions (currently: English,Polish,German)
� Licensed under GNU General Public License
� Can be extended (process is started) to full antivirus

Download (US)

CleanSober.EXants removal - removal tool will detect and remove W32/Sober Worm and its variants

CleanSober.EXE detects and removes the W32/Sober Worm and its variants completely from your computer.

Download CleanSober.EXE and save it on your desktop. Double click on CleanSober.EXE to execute it.

Follow the user-friendly instructions to detect and remove the W32/Sober Worm and its variants from your computer.

External Mirror 1
]]> http://antivirustools.org/w32-sober-worm-and-its-variants-removal-30-download-426.html/feed http://antivirustools.org/emailsupervisor-13-download-456.html http://antivirustools.org/emailsupervisor-13-download-456.html#comments Wed, 12 Mar 2008 00:00:00 +0000 admin http://antivirustools.org/emailsupervisor-13-download-456.html EmailSupervisor description
EmailSupervisor - Prevents resending your personal data to third persons.

EmailSupervisor will monitor all outgoing emails from your PC and preventdata to third persons.

EmailSupervisor will monitor all outgoing emails from your PC and prevents resending your personal data to third persons.

It also prevents an attempt to use your computer as a platform for spreading malicious code and infecting your colleagues and your family.

It works on system level regardless of your email client type and its settings.

External Mirror 1
]]> http://antivirustools.org/emailsupervisor-13-download-456.html/feed http://antivirustools.org/w32zotob-free-removal-tool-180-download-153.html http://antivirustools.org/w32zotob-free-removal-tool-180-download-153.html#comments Wed, 12 Mar 2008 00:00:00 +0000 admin http://antivirustools.org/w32zotob-free-removal-tool-180-download-153.html W32 Zotob Free Removal Tool description
Remove the infections of the following threats: W32.Zotob.A, W32.Zotob.B, W32.Zotob.C@mm, W32.Zotob.D, W32.Zotob.E, W32.Zotob.F

W32.threats: W32.Zotob.A, W32.Zotob.B, W32.Zotob.C@mm, W32.Zotob.D, W32.Zotob.E, W32.Zotob.F

W32.Zotob Free Removal Tool was designed to remove infections of the following threats:
W32.Zotob.A
W32.Zotob.B
W32.Zotob.C@mm
W32.Zotob.D
W32.Zotob.E
W32.Zotob.F
W32.Zotob.G
W32.Zotob.I
W32.Zotob.J@mm

Follow these steps to download and run the tool:
� Download the FixZotob.exe file
� Save the file to a convenient location, such as your Windows desktop.
� Close all the running programs.
� If you are on a network or

if you have a full-time connection to the Internet, disconnect the computer from the network and the Internet.
� If you are running Windows Me or XP, turn off System Restore.
� Locate the file that you just downloaded.
� Double-click the FixZotob.exe file to start the removal tool.
� Click Start to begin the process, and then allow the tool to run.
� Restart the computer.
� Run the removal tool again to ensure that the system is clean.
� If you are running Windows Me/XP, then reenable System Restore.
� If you are on a network or if you have a full-time connection to the Internet, reconnect the computer to the network or to the Internet connection.

The Removal Tool does the following:
� Terminates the associated processes
� Deletes the associated files
� Deletes the registry values added by the threat
� Restores the Shared Access service to the Microsoft Windows default.

External Mirror 1

Tool for remove the DSO Exploit from computer Tool for remove the DSO Exploit from computer

External Mirror 1
]]> http://antivirustools.org/anti-dso-exploit-10-download-188.html/feed http://antivirustools.org/defenceplus-210-download-244.html http://antivirustools.org/defenceplus-210-download-244.html#comments Wed, 12 Mar 2008 00:00:00 +0000 admin http://antivirustools.org/defenceplus-210-download-244.html DefencePlus description
DefencePlus is an invisible anti-hacking armor for Windows

Antivirus software and firewalls play valuable roles in protecting your system. However theyows

Antivirus software and firewalls play valuable roles in protecting your system. However they cannot protect your computer from hackers and worms that use buffer overflow security holes in Windows to infiltrate into the system. Once your computer is under hackers� control, they will turn your day into a nightmare. In a few seconds they can stealthily copy your documents, passwords, credit card numbers or run a malicious application.

DefencePlus is a software that provides you an anti-hacking protection.

DefencePlus offers what traditional antiviruses and firewalls miss - a real-time anti-hacking protection. It is specifically designed to

eliminate stack- and heap-based buffer overflow vulnerabilities, traditionally exploited by hackers. The program silently runs in the background, watching for hacker and worm assaults and blocks any intrusion-like process from the outset before it compromises the integrity of your system.

As distinct from its competitors, DefencePlus protects your entire system, including the operating system, its components and all software installed on your computer. Four security levels are available - low, medium, high and ultra. By specifying the security level for each application individually, you can achieve a full compatibility of DefencePlus with your system and minimize the number of misoperations.

With DefencePlus you will no longer fear that any unscrupulous parasite can read your emails, modify your system settings, or infect your computer with a virus. Thanks to the minimal resource utilization, the program doesn�t hinder computer performance. And by using DefencePlus with a good antivirus product and a firewall, you get the unyielding three-layer protection system against all kinds of security threats.

Limitations:
Expires in 30 days

What’s New in This Release:

UI is changed, defence algorithms are improved.

External Mirror 1
]]> http://antivirustools.org/defenceplus-210-download-244.html/feed http://antivirustools.org/wimp-13-download-349.html http://antivirustools.org/wimp-13-download-349.html#comments Wed, 12 Mar 2008 00:00:00 +0000 admin http://antivirustools.org/wimp-13-download-349.html Wimp description
Windows Malware Protection (Wimp) is a freeware utility that will help you protect your system from malicious worms and trojans

Windows Malware Protection (orill help you protect your system from malicious worms and trojans

Windows Malware Protection (or “Wimp” in short) is a freeware software tool that will help you protect your system from malicious worms and trojans.

Wimp was initially designed to remove the many common “flash drive” viruses, i.e. those that spread through USB flash drives; as of now, Wimp detects and removes 11 of these “flash drive” viruses.

Although the number of detected viruses may seem small in comparison to the huge number of viruses on the Internet, Wimp has several mechanisms that make removal of other viruses by other specialised software much easier.

Here are some key features of “Wimp”:

� Prevents changes to crucial Windows settings such as Windows logon shell and the Userinit value in the registry
� Prevents malicious programs from disabling Task Manager, Registry Editor, Command Prompt and prevents removal of Folder Options from the Explorer menu
� Notifies the user of changes to the Internet Explorer homepage and search page

Note: To make the best use of Wimp, place it in your Startup folder.

External Mirror 1

ClamWin is a Frescheduler, virus database updates, standalone scanner, context menu integration

ClamWin is a Free Antivirus for Microsoft Windows. ClamWin Free Antivirus offers a easy installer and open source code. You may download and use it absolutely free.

Please note that ClamWin Free Antivirus does not include an on-access real-time scanner. You need to manually scan a file in order to detect a virus or spyware.

Includes scheduler, virus database updates, standalone scanner, context menu integration to MS Windows Explorer and Addin to MS Outlook. Also features easy setup program.

ClamWin Free Antivirus includes Clam AntiVirus engine and uses the GNU General Public License by the Free Software Foundation

External Mirror 1