[KB2372] Stand-alone malware removal tools

Solution

ESET products automatically identify and clean the majority of infected files.

I think my computer is infected with a virus or malware—what should I do?

ESET provides standalone tools to remove particularly resilient threats, including rogue antivirus programs, antispyware programs, and malware.

You can download standalone removal tools from the alphabetical list below:

Threat Name (A – Z) &
Virus Database entry
Threat Cleaner
Download Link
Related Knowledgebase Content

ACAD/Medre

Acad/Medre.A

DOWNLOAD
Version: 1.1.0.4
Last updated: 2013-04-12

---

Adware.SuperFish

Win32/Adware.SuperFish

DOWNLOAD
Version: 1.0.0.0
Last updated: 2016-09-06

---

AES-NI

Win32/Filecoder.AESNI.A

DOWNLOAD
Version: 1.0.1.0
Last updated: 2017-06-14
Clean an AES-NI or XData infection using the ESET AES-NI decryptor

MEL/Vacphage.A

DOWNLOAD
Version: 1.0.0
Last updated: 2021-04-06
 

Bedep

Win32/Bedep

DOWNLOAD
Version: 1.0.0.2
Last updated: 2016-05-26
How do I remove a Bedep infection?

BlueKeep

CVE-2019-0708

DOWNLOAD
Version: 1.0.0
Last updated: 2019-12-03
It’s time to disconnect RDP from the internet

Bubnix

Win32/Bubnix.AA

DOWNLOAD
Version: 1.1.0.0
Last updated: 2013-04-12

---

Codplat.AA

Win32/Codplat.AA

DOWNLOAD
Version: 1.1.0.1
Last updated: 2013-04-12

---

Conficker

Win32/Conficker.AA

DOWNLOAD
Version: 1.1.5.1
Last updated: 2013-04-12

Conficker – How do I protect myself?

Crypt888

Win32/Filecoder.Crypt888

DOWNLOAD
Version: 1.0.0.0
Last updated: 2018-01-08
How do I clean a Crypt888 infection using the ESET Crypt888 decrypter?

Crysis

Win32/Filecoder.Crysis

DOWNLOAD
Version: 2.0.4.0
Last updated: 2017-05-19
How do I clean a Crysis infection using the ESET Crysis decryptor?

Daonol

Win32/Daonol.C

DOWNLOAD
Version: 1.2.0.0
Last updated: 2012-04-23

Fixing multiple problems caused by Win32/Daonol.C infiltration

Dorkbot

Win32/Dorkbot.B

DOWNLOAD
Version: 1.1.1.0
Last updated: 2017-01-31

[KB6304] Remove a Dorkbot infection using the ESET Dorkbot cleaner

ELEX

Win32/ELEX

DOWNLOAD
Version: 1.0.0.0
Last updated: 2016-03-15

How do I remove a Win32/ELEX infection?

Eternal Blue Checker

Win32/Filecoder.WannaCryptor

DOWNLOAD

Use our Eternal Blue Checker to patch Windows vulnerabilities

Filecoder.AA

Win32/Filecoder.AA

DOWNLOAD
Version: 1.0.0.1
Last updated: 2012-04-23

Does ESET protect me from Filecoder malware?

Filecoder.AE

Win32/Filecoder.AE

DOWNLOAD
Version: 1.1.0.0
Last updated: 2012-04-23
Clean a Filecoder.AE infection using the ESET Filecoder.AE cleaner

Filecoder.AR

Win32/Filecoder.AR

DOWNLOAD
Version: 1.0.0.1
Last updated: 2013-02-21
Clean a Filecoder.AR infection using the Filecoder.AR cleaner

Filecoder.NAC

Win32/Filecoder.NAC

DOWNLOAD
Version: 1.0.0.1
Last updated: 2012-04-23
---

Filecoder.R

Win32/Filecoder.R

DOWNLOAD
Version: 1.0.0.0
Last updated: 2012-04-23

Does ESET protect me from Filecoder malware?

GandCrab

Win32/Filecoder.GandCrab

DOWNLOAD
Version: 1.0.0.0
Last updated: 2018-10-26
Clean a GandCrab infection using the ESET GandCrab decryptor

Goblin

Win32/Goblin.C.Gen

DOWNLOAD
Version: 1.0.0.6
Last updated: 2014-01-24

How do I remove Win32/Goblin malware?

IRCBot.ANR

Win32/IRCBot.ANR

DOWNLOAD
Version: 1.1.0.0
Last updated: 2012-04-23

Requires manual command line parameter; see related ESET Knowledgebase content →

How to use the ESET Win32/IRCBot stand-alone cleaner from the Command Prompt window

JS/Bondat

JS/Bondat.A

DOWNLOAD
Version: 1.0.0.0
Last updated: 2015-04-30
---

Mabezat

Win32/Mabezat.A

DOWNLOAD
Version: 1.0.0.2
Last updated: 2012-11-09

How do I remove a Win32/Mabezat infection?

Mebroot

Win32/Mebroot

DOWNLOAD
Version: 2.1.0.0
Last updated: 2013-07-22

---

Merond.O

Win32/Merond.O

DOWNLOAD
Version: 2.0.0.1
Last updated: 2012-04-23

Requires manual command line execution
see →

How to use the ESET Merond.O stand-alone cleaner from the Command Prompt

Necurs.A

Win32/TrojanDownloader.Necurs.A

DOWNLOAD
Version: 2.1.0.5
Last updated: 2014-09-25

How do I run the Win32/Necurs cleaner?

Olmarik

OlmarikTdl4

Olmasco

Win32/Olmarik.AGF

DOWNLOAD
Version: 2.1.0.1
Last updated: 2014-10-23

How do I remove an Olmarik infection?

Warning! Risk of data loss. Make sure to create a backup of your personal data before running this tool.

Important! After successful use of the cleaning tool restart your computer and run a full computer scan as described in the following instructions:

[KB6529] Scan your computer and export scan logs in ESET Endpoint Security or ESET Endpoint Antivirus
ESET Windows home products

Poweliks

Win32/Poweliks.A

DOWNLOAD
Version: 1.0.2.0
Last updated: 2017-03-02

How do I remove a Poweliks infection?

Quervar.C

Win32/Quervar.C

DOWNLOAD
Version: 1.1.0.0
Last updated: 2014-10-06

Requires manual command line execution
see →

How do I remove a Quervar infection?

Retefe

Win32/Retefe

DOWNLOAD
Version: 1.0.0.0
Last updated: 2016-11-11
Tesco Bank not alone in being targeted by Retefe malware

Rovnix.A

Win32/Rovnix.A

DOWNLOAD
Version: 1.1.0.2
Last updated: 2014-11-25

How do I remove Rovnix (Rovnix.A) trojan?

Retacino

Win32/Trojan
Downloader.Retacino

DOWNLOAD
Version: 1.0.0.0
Last updated: 2013-05-23

How do I clean a Retacino infection using the ESET Retacino decrypter?

Simda

Win32/Simda.B

DOWNLOAD (32-bit)
Version: 1.1.0.2
Last updated: 2013-05-13

---

Simplocker

Android/Simplocker.A

DOWNLOAD
Version: 1.3.0.0
Last updated: 2014-07-22
What is Android Simplocker and does ESET protect me from it?

Sirefef / ZeroAccess

Win32/Sirefef

DOWNLOAD
Version: 1.1.0.20
Last updated: 2015-12-03

See Related Knowledgebase content for illustrated instructions →

How do I remove Sirefef (ZeroAccess) trojan?

Spy.Tuscas

Win32/Spy.Tuscas
Win64/Spy.Tuscas

DOWNLOAD
Version: 1.0.0.2
Last updated: 2015-04-30

 

Spy.Zbot.ZR

Win32/Spy.Zbot.ZR

DOWNLOAD
Version: 2.0.0.0
Last updated: 2014-04-28

How do I use the ESET ZbotZRcleaner tool to remove a Spy.zbot infection?

SpyEye

Win32/Spy.SpyEye.B

DOWNLOAD
Version: 1.1.0.0
Last updated: 2013-04-12

---

TeslaCrypt

Win32/Filecoder.TeslaCrypt.A

DOWNLOAD
Version: 1.1.0.1
Last updated: 2016-08-26

How do I clean a TeslaCrypt infection using the ESET TeslaCrypt decrypter?

Trustezeb.A

Win32/Trustezeb.A

DOWNLOAD
Version: 0.9.0.0
Last updated: 2012-05-11
Clean a Trustezeb.A or Matsnu infection using the Trustezeb.A cleaner
VB.NAX

DOWNLOAD
Version: 1.0.0.4
Last updated: 2012-11-28

---
VB.OGJ

DOWNLOAD
Version: 1.1.0.0
Last updated: 1.1.0.0

---

Virlock

Win32/Virlock.A

DOWNLOAD
Version: 1.0.0.4
Last updated: 2016-02-15

Win32/Virlock: First Self-Reproducing Ransomware is also a Shape Shifter

The Cleaner must be run in the Safe Mode.
Variants A, B, D and G are currently supported.

Zimuse

Win32/Zimuse.A
Win32/Zimuse.B

DOWNLOAD
Version: 1.1.0.0
Last updated: 2013-04-12

---

 

If you still experience abnormal system behavior or believe you are infected with malware after following the instructions above, we recommend that you contact ESET technical support.

Please use the following support tools if instructed to do so by ESET technical support:

ESET tool Download Link Related Knowledgebase Content
ESET Hidden File System Reader DOWNLOAD

Version: 1.0.3.3
Last updated: 2013-11-13
---
ESET Rogue Applications Remover DOWNLOAD (32-bit)

DOWNLOAD (64-bit)

Version: 1.0.4.1
Last updated: 2012-10-10

How do I use the ESET Rogue Application Remover (ERAR)?

Important! This tool must be run with administrator rights.