www.avira.com

User Manual

Avira AntiVir

Removal Tool for Windows

MORE THAN SECURITY

Trademarks
AntiVir is a registered trademark of the Avira GmbH. Windows is a registered trademark of the Microsoft Corporation in the United States and other countries. All other brand and product names are trademarks or registered trademarks of their respective owners. Protected trademarks are not marked as such in this manual. This does not mean, however that they may be used freely.

Publisher

Avira GmbH D-88069 Tettnang, Lindauer Str. 21 Phone: +49 (0)7542 - Fax: +49 (0)7542 - Email: info@avira.com Internet: http://www.avira.com

Production

Avira GmbH D-88069 Tettnang, Lindauer Str. 21 Copyright 2006 Avira GmbH This manual was created with great care. However, errors in design and contents cannot be excluded. All rights reserved. The reproduction of this publication or parts thereof in any form is prohibited without previous written consent from Avira GmbH. Errors and technical subject to change. Issued: Septeber 2006

Table of Contents

3 Introduction.... 4 Symbols and emphases... 5 Product information.... 6 3.1 3.4.1 4.2 4.3 Delivery scope....7 System requirements....8 Starting the program....9 Exit the program....10 Scan....10 4.3.1 Start scan....10 4.3.2 Stop scan....10 Starting via command line...11 Command line options....11 Scan results....12 Messages....13

Using the program... 9

4.4 4.5.1 5.7

Reporting.... 12

Golden rules for protection against malware.. 14 Service..... 15 7.1 7.2 7.3 Service hotline....15 Online shop....15 Contact address....15

Avira GmbH

AntiVir Removal Tool for Windows

Introduction

Avira offers frequent virus definition updates (VDF file) in order to keep its users safe from new malware outbreaks. However, there are computer users who do not perform such updates as often as required and many others who do not use antivirus protection at all. For all those experiencing the damaging effects of a virus infection, Avira's researchers have prepared a removal tool, which can be used to eliminate major distinct threats. The AntiVir Removal Tool Version 3 comes in two versions (German and English) executable files: tool_de.com tool_en.com The AntiVir Removal Tool does not replace any antivirus solution. You must install an antivirus product on your system and keep it up-to-date, in order to ensure your protection.

Symbols and emphases

The following symbols are used: Symbol Explanation Appears before a step you carry out. Appears before a result that follows the preceding action. Appears before a note with especially important information or a tip which makes it easier to understand and use the AntiVir Removal Tool.
The following emphases are used: Emphasis Italic Bold Explanation File name or path. Elements of the software interface which are clicked (e.g., menu item, tab or button).

Product information

The AntiVir Removal Tool handles a variety of viruses and malware. Please find a current overview what malware can be removed from your system with the help of the AntiVir Removal Tool on the Avira website at http://www.avira.com/removal-tool. We recommend that you check our website http://www.avira.com regularly for the latest version of AntiVir Removal Tool, as our virus researchers will add more detection routines to this tool, in order to remove even more threats. The AntiVir Removal Tool is supported by the Federal Office for Information Security (BSI), http://www.bsi.bund.de/english/index.htm.

Delivery scope

Cleaning actions Specific malware is removed from your system via the AntiVir Removal Tool. Please find a current overview what malware can be removed from your system with the help of the AntiVir Removal Tool on the Avira website at http://www.avira.com/removal-tool. Repairing function The AntiVir Removal Tool fixes concerning files, only if not severely damaged by malware actions. Killing malware The AntiVir Removal Tool is designed to end the malware's active process(es). Removing malware support files Some malware create non-malicious files inside an affected computer, which they use for fulfilling their harmful actions. The AntiVir Removal Tool can identify nonviral files and remove them from your system. Cleaning Registry Many malware create their own entries in the registry in order to carry out their malicious actions or to reload themselves when the computer starts. AntiVir Removal Tool is capable of deleting new keys from the Windows registry and, whenever possible, restoring default values, if the registry keys are modified by malware. In addition, the AntiVir Removal Tool offers the following features: Simple operation You simply have to download the program and then start it by double-click. Constant transparency It displays information while scanning files on your computer, thus allowing you to know the live status of its activity. Customizable performance It supports optional parameters for the drives to be scanned, for the log file and the help instructions. Complete reports It is able to create a log file and on-screen report after completing its task, providing information about scan results.

System requirements

The AntiVir Removal Tool supports the following operating systems: Microsoft Windows Server 2003 Microsoft Windows XP Home or Professional or Microsoft Windows 2000 or Microsoft Windows NT 4 or Microsoft Windows Millennium Edition (short: Windows ME) or Microsoft Windows 98 SE or Microsoft Windows 98 You have to log in as administrator in order to perform scanning and cleaning with the AntiVir Removal Tool. Otherwise, the program displays an error message. For users of Windows Windows 98, Windows 98 SE or Windows ME: Please download "Microsoft Layer for Unicode". The additionally needed file is available at the Microsoft Download Center.

Using the program

The AntiVir Removal Tool can start in two modes: Default By double-click, scanning all memory and drives and logging the results. Custom Via command line, with optional parameters.

Starting the program

The AntiVir Removal Tool does not require any installation. After download, you can start it with double-click and use the operating options displayed in its intuitive program interface. You have to log in as administrator in order to perform scanning and cleaning with the AntiVir Removal Tool. Otherwise, the program displays an error message. Start the program with a double-click on tool_en.com. The AntiVir Removal Tool start screen opens.

Exit the program

If you want to terminate the AntiVir Removal Tool, click on Exit. The AntiVir Removal Tool is terminated. By default, the file named tool_en.log, located in the current directory, keeps the records with the process results of the last scan.

Start scan

If you want to start the scan, press the Start scan button. The program starts scanning the memory and all drives. It also lists current status and log information. Scanning memory. done No malware found in memory Scanning drive C:.

Stop scan

If you want to stop the scan, press the Stop scan button. The log file will record the following line: Scan aborted by user You can press Start scan again, when you are ready to run the scanning. For security reasons, this process will start from the beginning.
Starting via command line
In order to perform the removal process with different settings, you can start the AntiVir Removal Tool as a command line utility. The command line syntax is: TOOL_EN [path] /options [drive letter: drive letter:.] You must type the full path to the tool_en executable, if you want to start it from another location. You may specify the drives you want to be scanned (drive letter). For example: TOOL_EN /HELP AntiVir Removal Tool starts and you can see the help information in its display panel. The same result is obtained using the parameter /? in the command line.

Command line options

Every time you start the AntiVir Removal Tool, it will run with the default settings or with given parameters. These parameters are applied only for the current process. /LOG <filename> Change the name and/or destination of the log file. By default, the AntiVir Removal Tool will log scan results into a file, named tool_en.log, located in the current directory. /NOLOG To cancel the logging of scan results. You cannot use this parameter together with the parameters /LOG or /APPEND. /APPEND To append the log to the existing one instead of overwriting it. /HELP (or /?) To display a help message explaining the parameters.

Reporting

AntiVir Removal Tool is able to keep a log file with all detailed results and messages of the scanning and cleaning process. The same information is listed in the display panel during operation.

Scan results

When the scanning process ends or when it is aborted, it issues the scan results: a summary of scanned, infected and repaired files and directories, process time span and throughput. Example: scan results: scanned directories: scanned files: scanned streams: scanned processes: scanned modules: infected files: infected processes: repaired/removed files: renamed files: terminated processes: elapsed time for memory scan: 2.05 seconds
average memory scanner throughput: 141823.16 KB/s elapsed time for file scan: average file scanner throughput: 31.59 seconds 73.78 KB/s

Messages

The report header displays version information and eventual error messages, in case of invalid parameters. For example: Error: logfile name contains invalid characters. When the AntiVir Removal Tool detects malware on the scanned drives, all removal actions are logged in the report: Malware found in file.; Removing executable. finished; Cleaning Registry keys. finished; Malware successfully removed. Advanced users may query the program script for the return codes of the removal process. Return codes: < 0 : Error during scan. = 0 : No error and no malware was found. > 0 : Malware was found.
Golden rules for protection against malware
Always keep boot floppy-disks, for your network server and for your workstations. Always remove floppy-disks from the drive after finishing the work. Even if they have no executable programs, disks may contain program code in the boot sector and these can serve to carry boot sector viruses. Regularly backup your files. Limit program exchange: particularly with other networks, mailboxes, Internet and acquaintances. Scan new programs before installation and the disk after this. If the program is archived, you can detect a virus only after unpacking and during installation.
If there are other users connected to your computer, you should set the following rules for protection against viruses: Use a test computer for controlling downloads of new software, demo versions or virus suspicious media (floppies, CD-R, CD-RW, removable drives). Disconnect the test computer from the network! Appoint a person responsible with virus infection operations and establish all steps for virus elimination. Organize an emergency plan as a precaution for avoiding damage due to destruction, robbery, failure or loss/change due to incompatibility. You can replace programs and storage devices, but not your vital business data. Set up a plan for data protection and recovery. Your network must be correctly configured and the access rights must be wisely assigned. This is a good protection against viruses.

Service

Service hotline
All relevant information concerning our comprehensive support service can be found on our website http://www.avira.de/en/support. The experts answer your questions and help you with technical problems.

Online shop

You want to purchase our products conveniently with the click of a button? In the online shop of Avira GmbH, you can purchase, extend and enhance licenses quickly and securely under http://www.avira.de/en/onlineshop. The online shop guides you through the ordering menu step-by-step. Our multilingual Customer Care Center provides information on ordering process, payment and delivery. Resellers can order on account.

Contact address

If you have any questions or requests concerning the Avira product range, we will be pleased to help you. If you require product information or other information, you can contact the address given below. General information on us and our products can also be obtained from our website http://www.avira.com. Avira GmbH Lindauer Str. 21 D-88069 Tettnang Phone: +49 (0)7542 - Fax: +49 (0)7542 - Email: info@avira.com Internet: http://www.avira.com
Lindauer Str. 21 D-88069 Tettnang Telephone: +49 (0) 7542-Fax: +49 (0) 7542-Email: info@avira.com Internet: http://www.avira.com
All rights reserved. Subject to change. Avira GmbH