+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: RELEASE: The Healer, Post Malware Removal recovery tool UPDATED 21APR (/showthread.php?tid=5230383)
Pages: Pages
1
2
RELEASE: The Healer, Post Malware Removal recovery tool UPDATED 21APR - Insane Developer - Apr 7, 2016
Update 21/April/2016: Added Persistent File Remover and FileAssasin Installer.
As one of my recent projects, I have released The Healer, a tool to recover from malware incidents. NOTE: THIS TOOL ONLY ATTEMPTS TO UNDO CHANGES, NOT REMOVE THE MALWARE. Might help during the infection stages by making it easier to remove malware.
There are currently 2 editions available: The Lite and the Full. Both are free.
The lite is smaller because the Kaspersky Installer was removed, since the Kaspersky Installer is 150 mb. However, it is the Antivirus that I would recommend to all of you.
Screenshots:
https://gyazo.com/16c9d4723ab2004d1ca1e800912940f0
https://gyazo.com/4c82906542a7ccbc82a6c9d6be1c699c
More details pleezzz?
It is capable of cleaning HOST file, re-activating windows features,...
It can also clean startup (Including hidden startup) and includes 3 AV installers in it.
The entire executable is coded in AutoIt(Except for the installers for AVs)
Download:
Version 1.2.0.0: http://www.zunzutech.com/blog/uncategorized/the-healer-new-release/
Version 1.1.0.1: http://www.zunzutech.com/blog/security/release-the-healer-post-malware-removal-recovery-tool/
omg virus? VT of Lite Edition (False positives), VT of Full Edition (Not available, too heavy).
Changelog:
Code
V1.1.5.0 21 April 2016
Added FileAssasin Installer
Added Persistent File Remover
Removed Kaspersky Internet Security Installer.
V1.1.0.1 Open Beta
Added obfuscation and encryption (While this is a freeware, it is not Open Source).
Added Lite Edition
Added credits
Improved AV installers (Install files to Temp Dir under random names to prevent malware detections)
Added Clear Startup
V1.1.0.0 Closed Beta
Added Revive AVs (Image File Execution)
Added AV installers
Improved restore Windows Function
V1.0.0.0 Closed Beta:
Added restore HOST
Added restore Windows FunctionBy using our software you agree that we are not responsible for any damages or unwanted results dealt by our product.
You may not attempt to reverse engineer our software.
This is copyright protected
This software is provided AS IS, with NO LIABILITY or GUARANTEED SUPPORT, as well as no guaranteed updates.
* - Cecilia - Apr 7, 2016
Its alright...
I mean, it doesn't do a lot of things, but it does the job.
* - Insane Developer - Apr 8, 2016
(Apr 7, 2016 09:38 PM)LaPanthere Wrote: Its alright...
I mean, it doesn't do a lot of things, but it does the job.
I am planning to add some features, such as malware detection (Through known samples), file killer,...
* - Cecilia - Apr 8, 2016
(Apr 8, 2016 12:04 AM)Insane Developer Wrote: I am planning to add some features, such as malware detection (Through known samples), file killer,...
The abilities of GMER (not the detection, the removal of registry keys and files) I think would be very handy.
* - Insane Developer - Apr 8, 2016
(Apr 8, 2016 12:16 AM)LaPanthere Wrote: The abilities of GMER (not the detection, the removal of registry keys and files) I think would be very handy.
I will try and implement that. Another tool I will probably use is RegRun Partizan for removing persistent malware
* - Cecilia - Apr 8, 2016
(Apr 8, 2016 01:37 AM)Insane Developer Wrote: I will try and implement that. Another tool I will probably use is RegRun Partizan for removing persistent malware
Mhm, there are not many tools that support the removal of files/keys that use permissions to hide.
* - Insane Developer - Apr 8, 2016
(Apr 8, 2016 01:59 AM)LaPanthere Wrote: Mhm, there are not many tools that support the removal of files/keys that use permissions to hide.
Well you can change the explorer so that it shows hidden files through registry (Already implemented).
The thing about Partizan is that it can be ran through command line, and is very powerful as it can even remove files protected by drivers. So regular rootkits won't stand a chance.
I am also thinking of a dynamic startup cleaner (Adapted from a malware's botkiller) that does the following things:
Find all startup entries, follow path to the file, if the file is Hidden/System then kill key, if it is cmd then kill key, If the window is not shown then kill key, if the window is shown then skip, if the file is included in the whitelist (For AVs and other whitelisted entities) then skip.
* - zharfan - Apr 8, 2016
Great Healer from the virus it is awesome
* - Insane Developer - Apr 9, 2016
Update with FileAssasin and a modified Startup Clear is about to be released!
* - Insane Developer - Apr 11, 2016
Bump, still up. You can try this tool after removing a malware/as an attempt to reduce the persistence of the malware!
* - Insane Developer - Apr 13, 2016
NOTE: Remember that the startup clearer might remove the startup of your antivirus as well, so make sure that you have backed up the key and rewrite it after you have used the startup clearer. Restoring AV's key is being developed at the moment.
* - Insane Developer - Apr 14, 2016
Still working, have successfully removed the startup of RATs and Botnets. Feel free to leave a comment!
* - own3d - Apr 14, 2016
Thanks for the share. Will be keeping an eye on your progress with this, have downloaded it, neat tool. 🤝
* - Insane Developer - Apr 17, 2016
Getting this post to the top. Update is almost done!
Added FileAssasin and persistent file remover, almost ready for the next update
* - Insane Developer - Apr 21, 2016
New version 1.2.0.0 released! Added persistent file remover and File Assasin/