

Free Tools from F-Secure
* Virus removal and other tools available from F-Secure Corporation.
F-Secure provides a number of virus removal and system fixing tools from its ftp site. Virus removal tools are used separately from F-Secure Anti-Virus and provide cleaning of a specific infection. Fixing tools perform repair of a system damaged or modified by a specific malicious program.
Most of the tools have additional readme files that should be studied before usage.
If you are fetching a virus removal tool, please refer to F-Secure Virus Info Center
for a complete information how to use the tool.
The purpose of the tool is to help the removal of the Sircam worm. The removal process is rather complex and assumes deletion of multiple copies of the worm and modification of several registry keys. Download: ftp://ftp.f-secure.com/anti-virus/tools/antisirc.exe Readme: ftp.f-secure.com/anti-virus/tools/antisirc.txt FSAV Audit is a tool for network administrators, for generating reports of F-Secure Anti-Virus deployment in network. The tool will generate a report file, showing for each computer whether FSAV is installed, and certain properties of installed FSAV, like the product's version, whether Gatekeeper is activated, and virus signature database dates. Download: ftp://ftp.f-secure.com/anti-virus/tools/audit.zip Readme: ftp://ftp.f-secure.com/anti-virus/tools/audit.htm Boo32 is a simple boot sector read/write utility. Run it without parameters to get help on command line options. Download: ftp://ftp.f-secure.com/anti-virus/tools/boo32.zip The BT_B_Dis tool is used to unlock Badtrans.b worm file, so it could be deleted after system restart. Download: ftp://ftp.f-secure.com/anti-virus/tools/bt_b_dis.reg Download: ftp://ftp.f-secure.com/anti-virus/tools/bt_b_dis.zip CoolNote tool fixes the payload of CoolNot worm that disables Windows desktop. Download: ftp://ftp.f-secure.com/anti-virus/tools/coolnote.zip Download: ftp://ftp.f-secure.com/anti-virus/tools/coolnote.reg The F-Bugbr utility disinfects computers infected with W32/Bugbear.A (also known as Tanat or Tanatos) worm. Download: ftp://ftp.europe.f-secure.com/anti-virus/tools/f-bugbr.zip Readme: ftp://ftp.europe.f-secure.com/anti-virus/tools/f-bugbr.txt F-CIH tool is used to check if a computer is infected with CIH virus. The tool terminates CIH virus process. Then a system should be cleaned with F-Secure Anti-Virus. Download: ftp://ftp.f-secure.com/anti-virus/tools/f-cih.exe F-HARE will detect and disinfect the three known variants of the Hare virus (also known as HDEuthanasia and Krsna). Download: ftp://ftp.f-secure.com/anti-virus/tools/f-hare15.zip F-IntCe tool detects and disinfects the tricky INT_CE boot virus. Download: ftp://ftp.f-secure.com/anti-virus/tools/f-intce.zip F-MEM tool will detect the Memorial virus (also known as Clint). Download: ftp://ftp.f-secure.com/anti-virus/tools/f-mem10.zip The F-Opasrv utility disinfects computers infected with all known Opaserv (also known as Opasoft or Scrup) worm variants. Download: ftp://ftp.europe.f-secure.com/anti-virus/tools/f-opasrv.zip Readme: ftp://ftp.europe.f-secure.com/anti-virus/tools/f-opasrv.txt F-Opasrv distribution package and related instructions: F-Opasrv distribution package F-SHELL tool will detect and disinfect the Shell.10634 Windows virus (also known as Tentacle_II). Download: ftp://ftp.f-secure.com/anti-virus/tools/f-shell.zip F-SPAN tool will detect and disinfect the Spanska.4250 virus also known as Elvira). Download: ftp://ftp.f-secure.com/anti-virus/tools/f-span13.zip F-TENT tool will detect and disinfect the Tentacle.1958 Windows virus. Download: ftp://ftp.f-secure.com/anti-virus/tools/f-tent10.zip F-TRICKL tool will detect and disinfect the Tentatrickle virus. Download: ftp://ftp.f-secure.com/anti-virus/tools/f-trickl.zip F-Vice tool will detect and disinfect the polymorphic Vice virus. Download: ftp://ftp.f-secure.com/anti-virus/tools/f-vice14.zip Fix-Aula is a tool to repair a system configuration damaged by Aula trojan. Download: ftp://ftp.f-secure.com/anti-virus/tools/fix_aula.reg Download: ftp://ftp.f-secure.com/anti-virus/tools/fix_aula.zip FixBoot is a small utility that overwrites a boot sector of a diskette with a standard boot code thus elimitating any diskette boot sector infection. Download: ftp://ftp.f-secure.com/anti-virus/tools/fixboot.zip FixPe and FixPe2 utilities allow to fix false alarms of F-Prot engine on certain files that have inaccurate section information resulted from virus infection or inaccurate compression. Download: ftp://ftp.f-secure.com/anti-virus/tools/fixpe.zip Download: ftp://ftp.f-secure.com/anti-virus/tools/fixpe2.zip F-Klez is a utility that disinfects a computer infected with Klez worm and Elkern virus that the worm drops. To remove Klez.E, Klez.F and Klez.H worms please use the KlezTool utility below. Download: ftp://ftp.f-secure.com/anti-virus/tools/fsklez.exe Readme: ftp://ftp.f-secure.com/anti-virus/tools/fsklez.txt F-Nimda is a utility that disinfects a computer infected with Nimda virus-worm and eliminates security holes that Nimda creates in a system. Download: ftp://ftp.f-secure.com/anti-virus/tools/fsnimda3.exe Download: ftp://ftp.f-secure.com/anti-virus/tools/fsnimda3.jar Readme: ftp://ftp.f-secure.com/anti-virus/tools/fsnimda3.txt Description: Nimda-virus worm Note: If you have problems running the above mentioned FsNimda tool, you can download a different version from here: Download: ftp://ftp.f-secure.com/anti-virus/tools/fsnimda.exe Download: ftp://ftp.f-secure.com/anti-virus/tools/fsnimda.txt GetMac tool is used to separately update FSMacro.def definition file. Note that FsMacro.def definition file is now included into all update packages available from F-Secure. Download: ftp://ftp.f-secure.com/anti-virus/tools/getmac11.zip Download: ftp://ftp.f-secure.com/anti-virus/tools/getmac12.zip Download: ftp://ftp.f-secure.com/anti-virus/tools/getmac13.zip Getboot is a number of utilities to copy the contents of boot sectors to a file. The getboot.bat is a batch file to save a floppy boot sector to a file, the gethboot.bat is a batch file to save a hard drive boot sector to a file and the getmbr.bat is batch file to save a hard drive MBR to a file. Download: ftp://ftp.f-secure.com/anti-virus/tools/bat/getboot.bat Download: ftp://ftp.f-secure.com/anti-virus/tools/bat/gethboot.bat Download: ftp://ftp.f-secure.com/anti-virus/tools/bat/getmbr.bat Readme: ftp://ftp.f-secure.com/anti-virus/tools/bat/readme.txt GetMBR and PutMBR are small utilities to take a sample of an infected machines main boot record. Get_mbr copies the mbr to a file mbr.dat and put_mbr copies the file to the mbr area. Download: ftp://ftp.f-secure.com/anti-virus/tools/getmbr.zip The GokarDis tool disables Gokar worm autostart key. Download and run this REG file, restart your system and delete KAREN.EXE file in your Windows directory either manually or with F-Secure Anti-Virus. Download: ftp://ftp.f-secure.com/anti-virus/tools/gokardis.reg Download: ftp://ftp.f-secure.com/anti-virus/tools/gokardis.zip KirayDis is a tool to disinfect Kiray worm and to undo changes it does to system configuration. Download: ftp://ftp.f-secure.com/anti-virus/tools/kiraydis.reg Download: ftp://ftp.f-secure.com/anti-virus/tools/kiraydis.zip The KlezTool is a utility created by Kaspersky Labs to eliminate Klez.E, .F and .H standalone worm component and to disinfect files infected by Klez.E, .F and .H virus component. The utility should be used together with F-Secure Anti-Virus as this tool doesn't disinfect Elkern virus, that Klez.E, .F and .H worm variants drop. Please check the Readme file for step-by-step instructions. Download: ftp://ftp.f-secure.com/anti-virus/tools/kleztool.txt Download: ftp://ftp.f-secure.com/anti-virus/tools/kleztool.zip Magb_Dis tool is used to 'help' APV engine in F-Secure Anti-Virus to disinfect large files encrypted by Magistr.b virus-worm. The Disinf.exe utility creates DISINF.INI file that contains computer name and it is used by AVP engine to disinfect files encrypted by Magistr.b. Download: ftp://ftp.f-secure.com/anti-virus/tools/magb_dis.zip Readme: ftp://ftp.f-secure.com/anti-virus/tools/magb_dis.txt Matrix_D is a tool that fixes a payload of Matrix virus that doesn's allow to restart a system after infection. Download: ftp://ftp.f-secure.com/anti-virus/tools/matrix_d.reg Download: ftp://ftp.f-secure.com/anti-virus/tools/matrix_d.zip MTXDisin tool removes autostarting key of MTX virus-worm dropper and after system restart the worm's dropper file will not be locked and could be deleted. Download: ftp://ftp.f-secure.com/anti-virus/tools/mtxdisin.reg Download: ftp://ftp.f-secure.com/anti-virus/tools/mtxdisin.zip MultiComm is a utility for enabling multiple communication directories to be used with F-PROT for Windows (FPW). Download: ftp://ftp.f-secure.com/anti-virus/tools/multicom.zip NavidDis is a tool to remove autostarting key of Navidad worm and to fix EXE file startup key in the Registry. Download: ftp://ftp.f-secure.com/anti-virus/tools/naviddis.reg Download: ftp://ftp.f-secure.com/anti-virus/tools/naviddis.zip PPDisinf is a tool to disinfect PrettyPark worm and to fix EXE file startup key in the Registry. Download: ftp://ftp.f-secure.com/anti-virus/tools/ppdisinf.reg Download: ftp://ftp.f-secure.com/anti-virus/tools/ppdisinf.zip QazDisin is a tool to remove QAZ work autostarting key from the Registry. This way the worm will be disinfected. Download: ftp://ftp.f-secure.com/anti-virus/tools/qazdisin.reg Download: ftp://ftp.f-secure.com/anti-virus/tools/qazdisin.zip S7Disinf is a tool to remove Sub7 backdoor's autolauncher from EXE file startup key. The autolauncher is used to run SubSeven backdoor every time an EXE file starts. The backdoor itself is to be removed with F-Secure Anti-Virus. Download: ftp://ftp.f-secure.com/anti-virus/tools/s7disinf.reg Download: ftp://ftp.f-secure.com/anti-virus/tools/s7disinf.zip The ShellFix tool is used to fix Explorer startup problems resulted from unconditional termination of F-Nimda tool during its operation. If F-Nimda tool is terminated by a user or operating system while it is scanning a hard disk, there will be no icons and no taskbar on Windows desktop. To fix the problem you will have to run the SHELLFIX.REG file. Download: ftp://ftp.f-secure.com/anti-virus/tools/shellfix.reg Download: ftp://ftp.f-secure.com/anti-virus/tools/shellfix.zip Readme: ftp://ftp.f-secure.com/anti-virus/tools/shellfix.txt Sirc_Dis utility is used to remove autostarting key of Sircam worm and to fix EXE file startup key in the Registry. Download: ftp://ftp.f-secure.com/anti-virus/tools/sirc_dis.reg Download: ftp://ftp.f-secure.com/anti-virus/tools/sirc_dis.zip StagesW9x is a tool is used to remove Stages worm autostartup key from the Registry and to undo other Registry changes done by the worm. Download: ftp://ftp.f-secure.com/anti-virus/tools/stagesw9x.reg Download: ftp://ftp.f-secure.com/anti-virus/tools/stagesw9x.zip |