25/04/2016

UsingtheTrendMicroAntiThreatToolkit

(/enus/home/ti10sitesurvey.aspx)

Home&HomeOfceSupport

UsingtheTrendMicroAntiThreatToolkitto
analyzemalwareissuesandcleaninfections
ForHomeandHomeOfceusers
LearnhowtousetheTrendMicroAntiThreatToolkit(ATTK)toperformsystemforensicscansand
cleanthefollowinginfections:
Generalmalwareinfection
MasterbootrecordInfection
CIDOX/RODNIXinfection
Rootkitinfection
Zbotinfection
Cryptolockerinfection

CollectSuspiciousFilesAndSystemInformation

1.DownloadtheAntiThreatToolkitbyclickingyouroperatingsystemversionbelow:
DownloadtheAntiThreatToolkitbyclickingyouroperatingsystemversionbelow:
32bit(https://spnsupport.trendmicro.com/attk/5238c65dd7d94e8da695
32bit
(https://spnsupport.trendmicro.com/attk/5238c65dd7d94e8da695
c82c49d162cf)
64bit(https://spnsupport.trendmicro.com/attk64/73340FDF9E0C4d969137
64bit
(https://spnsupport.trendmicro.com/attk64/73340FDF9E0C4d969137
F91EACD45392)
2.ReadtheTrendMicroLicenseAgreement.Onceyouclick
ReadtheTrendMicroLicenseAgreement.OnceyouclickIAccept
IAccept,thedownloadwill
,thedownloadwill
start.

https://esupport.trendmicro.com/enus/home/pages/technicalsupport/1059509.aspx

1/11

25/04/2016

UsingtheTrendMicroAntiThreatToolkit

3.Choosethepreferreddirectorywherethetoolwillbestoredthenclick
ChoosethepreferreddirectorywherethetoolwillbestoredthenclickSave
Save..
4.Logontothecomputerthatispossiblyinfectedbyamalware.CopytheAntiThreatToolkit
Logontothecomputerthatispossiblyinfectedbyamalware.CopytheAntiThreatToolkit
intotheinfectedcomputer.
5.AftercopyingtheAntiThreatToolkit,rightclickthetoolandthenclick
AftercopyingtheAntiThreatToolkit,rightclickthetoolandthenclickRunas
Runas
administrator..
administrator

6.Click
ClickYes
YeswhentheUserAccountControlwindowappears.
whentheUserAccountControlwindowappears.
ACommandPromptwindowwillappeartoshowthesystemforensicanalysisprogress.

https://esupport.trendmicro.com/enus/home/pages/technicalsupport/1059509.aspx

2/11

25/04/2016

UsingtheTrendMicroAntiThreatToolkit

Abrowserwindowwillappearaftertheanalysisfinishes.
7.Click
ClickProceed
ProceedtosendtheinformationthetoolcollectedtoTrendMicroTechnicalSupport.
tosendtheinformationthetoolcollectedtoTrendMicroTechnicalSupport.
YouwillreceiveatemporaryIDnumberthatyoucanusewhenyoucontactTrendMicro
TechnicalSupport.

TheTrendMicroAntiThreatToolkitfolderwillappearonthesamefolderwhereyouran
thetool.
https://esupport.trendmicro.com/enus/home/pages/technicalsupport/1059509.aspx

3/11

25/04/2016

UsingtheTrendMicroAntiThreatToolkit

8.Goto
GotoTrendMicroAntiThreatToolkitfolder>Output
TrendMicroAntiThreatToolkitfolder>Output..
Youwillfinda.ZIPfilewiththefilenamecontainingthetimestampandGUID.

9.Doeitherofthefollowing:
Doeitherofthefollowing:
Ifyouhaveanexistingcase,sendacopyofthe.ZIPfiletogetherwiththetemporaryID
numbertotheengineerwhoishandlingyourcase.
Ifyoudonothaveanexistingcase,sendthe.ZIPfiletoourTechnicalSupport
Ifyoudonothaveanexistingcase,sendthe.ZIPfiletoour
TechnicalSupport(/en
(/en
us/home/pages/technicalsupport/contact/srf.aspx)foranalysis.
us/home/pages/technicalsupport/contact/srf.aspx)
foranalysis.

CleanInfectedComputers

1.DownloadtheAntiThreatToolkit:
DownloadtheAntiThreatToolkit:
Forcomputerswithinternetconnection
OnlineScan/CleanTool(32bit)(https://spnsupport.trendmicro.com/attk/4F52A9E7
OnlineScan/CleanTool(32bit)
(https://spnsupport.trendmicro.com/attk/4F52A9E7
56834F01ADDF2D993326168F)
OnlineScan/CleanTool(64bit)(https://spnsupport.trendmicro.com/attk64/4b815388
OnlineScan/CleanTool(64bit)
(https://spnsupport.trendmicro.com/attk64/4b815388
ec340d78aa83b019227a057c)
Forcomputerswithoutinternetconnection
OfflineScan/CleanTool(32bit)(https://spnsupport.trendmicro.com/attk/6CB39656
OfflineScan/CleanTool(32bit)
(https://spnsupport.trendmicro.com/attk/6CB39656
5F384541BB237810C8F78112)
OfflineScan/CleanTool(64bit)(https://spnsupport.trendmicro.com/attk64/0c4b4ca2
OfflineScan/CleanTool(64bit)
(https://spnsupport.trendmicro.com/attk64/0c4b4ca2
f6866b3c50a6f9e28f6e4722)
2.ReadtheTrendMicroLicenseAgreement,thenclick
ReadtheTrendMicroLicenseAgreement,thenclickIAccept
IAccepttoagreewiththeEULAand
toagreewiththeEULAand
downloadthetool.
3.Click
ClickSave
SavewhentheFileDownloadwindowappears.
whentheFileDownloadwindowappears.
4.Select
SelectDesktop
Desktopasthedownloadlocation,thenclick
asthedownloadlocation,thenclickSave
Save..
5.Logontothecomputerthatispossiblyinfectedbyamalware.CopytheAntiThreatToolkit
Logontothecomputerthatispossiblyinfectedbyamalware.CopytheAntiThreatToolkit
intotheinfectedcomputer.
6.AftercopyingtheAntiThreatToolkit,rightclickthetoolandthenclick
AftercopyingtheAntiThreatToolkit,rightclickthetoolandthenclickRunas
Runas
administrator..
administrator
7.Click
ClickYes
YeswhentheUserAccountControlwindowappears.
whentheUserAccountControlwindowappears.
8.Click
ClickScanNow
ScanNowwhentheTrendMicroAntiThreatToolkitwindowappears.
whentheTrendMicroAntiThreatToolkitwindowappears.

https://esupport.trendmicro.com/enus/home/pages/technicalsupport/1059509.aspx

4/11

25/04/2016

UsingtheTrendMicroAntiThreatToolkit

Thescanmaytakesometime.Thetoolwillscanyourcomputerandlistthethreatsitfinds.

9.Thetoolwillshowasummaryofthescan.Click
Thetoolwillshowasummaryofthescan.ClickFixNow
FixNowtocleanyourcomputer.
tocleanyourcomputer.
10.Click
ClickClose
ClosetoclosetheAntiThreatToolkitafteryourcomputerhasbeencleaned.
toclosetheAntiThreatToolkitafteryourcomputerhasbeencleaned.
11.Click
ClickProceed
ProceedtosendtheinformationthetoolcollectedtoTrendMicroTechnicalSupport.
tosendtheinformationthetoolcollectedtoTrendMicroTechnicalSupport.

YouwillreceiveatemporaryIDnumberthatyoucanusewhenyoucontactTrendMicro
TechnicalSupportandaTrendMicroAntiThreatToolkitfolderwillappearonthesame
https://esupport.trendmicro.com/enus/home/pages/technicalsupport/1059509.aspx

5/11

25/04/2016

UsingtheTrendMicroAntiThreatToolkit

folderwhereyouranthetool.
12.Goto
GotoTrendMicroAntiThreatToolkitfolder>Output
TrendMicroAntiThreatToolkitfolder>Output..
Youwillfinda.ZIPfilewiththefilenamecontainingthetimestampandGUID.

13.Doeitherofthefollowingifyoustillneedhelpafteryouhavecleanedyourcomputer:
Doeitherofthefollowingifyoustillneedhelpafteryouhavecleanedyourcomputer:
Ifyouhaveanexistingcase,sendthe.ZIPfiletogetherwiththetemporaryIDnumberto
theengineerwhoishandlingyourcase.
Ifyoudonothaveanexistingcase,sendthe.ZIPfiletoourTechnicalSupport
Ifyoudonothaveanexistingcase,sendthe.ZIPfiletoour
TechnicalSupport(/en
(/en
us/home/pages/technicalsupport/contact/srf.aspx)foranalysis.
us/home/pages/technicalsupport/contact/srf.aspx)
foranalysis.

CleanMBR,CIDOX/RODNIXOrRootkitInfectionUsingATTKWithCleanboot

TousetheTrendMicroAntiThreatToolkit(ATTK)withCleanBoot,followthestepsbelow:
1.DownloadtheAntiThreatToolkitbyclickingyouroperatingsystemtypebelow:
DownloadtheAntiThreatToolkitbyclickingyouroperatingsystemtypebelow:
32bit(https://spnsupport.trendmicro.com/attk/c3f5389788da606191e9
32bit
(https://spnsupport.trendmicro.com/attk/c3f5389788da606191e9
032872d72558)
64bit(https://spnsupport.trendmicro.com/attk64/234e16e680fe58a01897
64bit
(https://spnsupport.trendmicro.com/attk64/234e16e680fe58a01897
4aed25a8f18c)
Notes::
Notes
Tocheckyoursystemtype,refertothisKnowledgeBasearticle:Checkifyouare
Tocheckyoursystemtype,refertothisKnowledgeBasearticle:
Checkifyouare
runninga32bitor64bitversionofWindowsoperatingsystem
(https://esupport.trendmicro.com/enus/home/pages/technical
support/1038680.aspx)
Duetothefile'slargesize,itmaytakeawhiletodownload,dependingonthespeed
ofyourInternetconnection.
2.ReadtheLicenseAgreement,thenclickI
ReadtheLicenseAgreement,thenclickIAgree
Agree..
3.Adownloadwillbeinitiated,runthedownloadedtooltostartusingit.
Adownloadwillbeinitiated,runthedownloadedtooltostartusingit.
4.Oncethetoolisopen,clickon
Oncethetoolisopen,clickonScanNow
ScanNowtocheckthecomputerforthreats.
tocheckthecomputerforthreats.

https://esupport.trendmicro.com/enus/home/pages/technicalsupport/1059509.aspx

6/11

25/04/2016

UsingtheTrendMicroAntiThreatToolkit

5.Afterthescan,detectedthreatsshouldbedisplayed.Clickon
Afterthescan,detectedthreatsshouldbedisplayed.ClickonFixNow
FixNowtobeginwith
tobeginwith
thecleanupprocess.

SomethreatsrequireaspecialtoolsuchasCleanBoot.Ifyougetthisoptionjustclick
onCleanBoot
on
CleanBoottocontinue.
tocontinue.

6.Click
ClickOK
OKtoconfirmtheinstallationofCleanBoot.
toconfirmtheinstallationofCleanBoot.

7.Click
ClickOK
OKtorestartthecomputer.
torestartthecomputer.

8.Afterthecomputerrestarts,thecomputerwillnowstartwithCleanBoot.Ontheboot
Afterthecomputerrestarts,thecomputerwillnowstartwithCleanBoot.Ontheboot
manager,pressenteronTrendMicroCleanBoot.

https://esupport.trendmicro.com/enus/home/pages/technicalsupport/1059509.aspx

7/11

25/04/2016

UsingtheTrendMicroAntiThreatToolkit

Onthenextscreen,youwillgettheStartupandinitializationscreen.

Oncethetoolhasbeensuccessfullyinitialized,theQuickscanwillautomatically
trigger.

https://esupport.trendmicro.com/enus/home/pages/technicalsupport/1059509.aspx

8/11

25/04/2016

UsingtheTrendMicroAntiThreatToolkit

9.Afterthescan,thecomputerneedstoberestarted.Onthebootmenu,selectonyour
Afterthescan,thecomputerneedstoberestarted.Onthebootmenu,selectonyour
operatingsystemthenpressenter.

10.Afterloadingtheoperatingsystem,ATTKwillautomaticallyrunanddisplaytheresults
Afterloadingtheoperatingsystem,ATTKwillautomaticallyrunanddisplaytheresults
ofthescan

https://esupport.trendmicro.com/enus/home/pages/technicalsupport/1059509.aspx

9/11

25/04/2016

UsingtheTrendMicroAntiThreatToolkit

CleanZBotOrCryptolockerInfectionUsingATTK

1.Clickanyofthelinksbelowtodownloadthetool:
Clickanyofthelinksbelowtodownloadthetool:
AntithreatToolkitfor32bitsystems(https://spnsupport.trendmicro.com/attk/7993ee29
AntithreatToolkitfor32bitsystems
(https://spnsupport.trendmicro.com/attk/7993ee29
be6eec157c0dddc06856a06a)
AntithreatToolkitfor64bitsystems
(https://spnsupport.trendmicro.com/attk64/4b41b75bcb7604d520705bc98f34c84b)
2.ReadtheTrendMicroLicenseAgreement,thenclick
ReadtheTrendMicroLicenseAgreement,thenclickIAccept
IAccepttoagreewiththeEULAand
toagreewiththeEULAand
downloadthetool.
3.Click
ClickSave
SavewhentheFileDownloadwindowappears.
whentheFileDownloadwindowappears.
4.Select
SelectDesktop
Desktopasthedownloadlocation,thenclick
asthedownloadlocation,thenclickSave
Save..
5.Oncethedownloadcompletes,rightclickthetool,thenclick
Oncethedownloadcompletes,rightclickthetool,thenclickRunasadministrator
Runasadministrator..
6.Click
ClickYes
YeswhentheUserAccountControlwindowappears.
whentheUserAccountControlwindowappears.
7.Click
ClickScanNow
ScanNowwhentheTrendMicroAntiThreatToolkitwindowappears.
whentheTrendMicroAntiThreatToolkitwindowappears.

Thescanmaytakesometime.Thetoolwillscanyourcomputerandlistthethreatsitfinds.

https://esupport.trendmicro.com/enus/home/pages/technicalsupport/1059509.aspx

10/11

25/04/2016

UsingtheTrendMicroAntiThreatToolkit

8.Thetoolwillshowasummaryofthescan.Click
Thetoolwillshowasummaryofthescan.ClickFixNow
FixNowtocleanyourcomputer.
tocleanyourcomputer.
9.Click
ClickClose
ClosetoclosetheAntiThreatToolkitafteryourcomputerhasbeencleaned.
toclosetheAntiThreatToolkitafteryourcomputerhasbeencleaned.

AppliesTo:Antivirus+Security
AppliesTo:
Antivirus+Security2015Antivirus+Security
2015Antivirus+Security2016InternetSecurity
2016InternetSecurity2015InternetSecurity
2015InternetSecurity
2016MaximumSecurity2015Ma
2016MaximumSecurity
2015Ma...
...More
More
LastUpdated:Sep.24,201512:05AM
LastUpdated:
Sep.24,201512:05AM(PST)
(PST)
SolutionID:1059509
SolutionID:
1059509

PrivacyPolicy(http://www.trendmicro.com/us/aboutus/legalpolicies/privacy
PrivacyPolicy(http://www.trendmicro.com/us/aboutus/legalpolicies/privacy
statement/index.html)
TrendMicro(http://www.trendmicro.com/)
TrendMicro
(http://www.trendmicro.com/)
Feedback
Copyright20142015TrendMicroIncorporated.Allrightsreserved.
Copyright20142015TrendMicroIncorporated.
Allrightsreserved.

https://esupport.trendmicro.com/enus/home/pages/technicalsupport/1059509.aspx

11/11