Trend Micro Anti-Threat Toolkit – Malware Scanner/Remover

On-demand malware scanners/removers have become an integral part of our overall security strategy these days with most users utilizing at least one of these programs to help maintain a clean machine. Antivirus software is never 100% foolproof and these types of second opinion scanners can often help identify what the antivirus lets through.

Collect suspicious files and system information

1. Download the Anti-Threat Toolkit by clicking your operating system version below:
   • 32-bit
   • 64-bit
2. Read the Trend Micro License Agreement. Once you click I Accept, the download will start.
   
3. Choose the preferred directory where the tool will be stored then click Save
4. Log on to the computer that is possibly infected by a malware. Copy the Anti-Threat Toolkit into the infected computer.
5. After copying the Anti-Threat Toolkit, right-click the tool and then click Run as administrator.
   
6. Click Yes when the User Account Control window appears.
   A Command Prompt window will appear to show the system forensic analysis progress.
   
   A browser window will appear after the analysis finishes.
7. Click Proceedto send the information the tool collected to Trend Micro Technical Support. You will receive a temporary ID number that you can use when you contact Trend Micro Technical Support.
   
   The Trend Micro Anti-Threat Toolkit folder will appear on the same folder where you ran the tool.
8. Go to Trend Micro Anti-Threat Toolkit folder > Output.
   You will find a .ZIP file with the filename containing the timestamp and GUID.
   
9. Do either of the following:
• If you have an existing case, send a copy of the .ZIP file together with the temporary ID number to the engineer who is handling your case.
• If you do not have an existing case, send the .ZIP file to Trend Micro Consumer Support for analysis.

Clean infected computers

1. Download the Anti-Threat Toolkit:
• For computers with internet connection
• Online Scan / Clean Tool (32-bit)
• Online Scan / Clean Tool (64-bit)
• For computers without internet connection
• Offline Scan / Clean Tool (32-bit)
• Offline Scan / Clean Tool (64-bit)
2. Read the Trend Micro License Agreement, then click I Accept to agree with the EULA and download the tool.
3. Click Save when the File Download window appears.
4. Select Desktop as the download location, then click Save.
5. Log on to the computer that is possibly infected by a malware. Copy the Anti-Threat Toolkit into the infected computer.
6. After copying the Anti-Threat Toolkit, right-click the tool and then click Run as administrator.
7. Click Yes when the User Account Control window appears.
8. Click Scan Nowwhen the Trend Micro Anti-Threat Toolkit window appears.
   
   The scan may take some time. The tool will scan your computer and list the threats it finds.
   
9. The tool will show a summary of the scan. Click Fix Now to clean your computer.
10. Click Close to close the Anti-Threat Toolkit after your computer has been cleaned.
11. Click Proceed to send the information the tool collected to Trend Micro Technical Support.
    
    You will receive a temporary ID number that you can use when you contact Trend Micro Technical Support and a Trend Micro Anti-Threat Toolkit folder will appear on the same folder where you ran the tool.
12. Go to Trend Micro Anti-Threat Toolkit folder > Output.
    You will find a .ZIP file with the filename containing the timestamp and GUID.
    
13. Do either of the following if you still need help after you have cleaned your computer:
• If you have an existing case, send the .ZIP file together with the temporary ID number to the engineer who is handling your case.
• If you do not have an existing case, send the .ZIP file to Trend Micro Consumer Support for analysis.

Clean MBR and Rootkit infection using ATTK with Cleanboot

To use the Trend Micro Anti-Threat Toolkit (ATTK) with Clean Boot, follow the steps below:

1. Download the Anti-Threat Toolkit by clicking your operating system type below:
   • 32-bit
   • 64-bit
   Notes:

   • To check your system type, refer to this Knowledge Base article: Check if you are running a 32-bit or 64-bit version of Windows operating system
   • Due to the file's large size, it may take a while to download, depending on the speed of your Internet connection.
2. Read the License Agreement, then click I Agree.
3. A download will be initiated, run the downloaded tool to start using it.
4. Once the tool is open, click on Scan Now to check the computer for threats.
   
5. After the scan, detected threats should be displayed. Click on Fix Now to begin with the clean-up process.
   
   Some threats require a special tool such as Clean Boot. If you get this option just click on Clean Boot to continue.
   
6. Click OK to confirm the installation of Clean Boot.
   
7. Click OK to restart the computer.
   
8. After the computer restarts, the computer will now start with Clean Boot. On the boot manager, press enter on Trend Micro Clean Boot.
   
   On the next screen, you will get the Startup and initialization screen.
   
   Once the tool has been successfully initialized, the Quick scan will automatically trigger.
   
9. After the scan, the computer needs to be restarted. On the boot menu, select on your operating system then press enter.
   
10. After loading the operating system, ATTK will automatically run and display the results of the scan
    

Clean ZBot and Cryptolocker infection using ATTK

1. Click any of the links below to download the tool:
   • Anti-threat Toolkit for 32-bit systems
   • Anti-threat Toolkit for 64-bit systems
2. Read the Trend Micro License Agreement, then click I Accept to agree with the EULA and download the tool.
3. Click Save when the File Download window appears.
4. Select Desktop as the download location, then click Save.
5. Once the download completes, right-click the tool, then click Run as administrator.
6. Click Yes when the User Account Control window appears.
7. Click Scan Now when the Trend Micro Anti-Threat Toolkit window appears.
   
   The scan may take some time. The tool will scan your computer and list the threats it finds.
   
8. The tool will show a summary of the scan. Click Fix Now to clean your computer.
9. Click Close to close the Anti-Threat Toolkit after your computer has been cleaned.