Best Free Trojan Scanner/Trojan Remover

 
In a Hurry?
  Go straight to the Quick Selection Guide
Introduction

Malware, trojans and threats

Most PCs are now connected to the Internet and networks, making easier the spread of malicious software (malware), which includes trojans (also known as trojan horses), viruses, worms, spyware, adware, rootkits and other malicious or unwanted programs.

Like spyware and adware, trojans can get onto your computer in a number of ways, including from a web browser, via e-mail, or in a bundle with other software downloaded from the Internet.  You may also inadvertently transfer malware via a USB flash drive or other portable media.

Unlike viruses or worms, trojans do not replicate themselves but they can be just as destructive. On the surface, trojans appear benign and harmless, but once the infected code is run, trojans kick in and perform malicious functions to harm the computer system without the user's knowledge.

For example, waterfalls.scr is a waterfall screen saver as originally claimed by the author, but it can be associated with malware and become a trojan to unload hidden programs and allow unauthorized access to the user's PC.

Some typical examples of threats by trojans are as follows:

  • Erase, overwrite or corrupt data on a computer
  • Help to spread other malware such as viruses (by a dropper trojan)
  • Deactivate or interfere with anti-virus and firewall programs
  • Allow remote access to your computer (by a remote access trojan)
  • Upload and download files without your knowledge
  • Gather e-mail addresses and use them for spam
  • Log keystrokes to steal information such as passwords and credit card numbers
  • Copy fake links to false websites, display porno sites, play sounds/videos, display images
  • Slow down, restart or shut down your computer
  • Re-install themselves after being disabled
  • Disable the task manager

To minimise the threats, most PC users will need an effective anti-malware program to remove trojans along with other malware.

Anti-malware and anti-trojan programs

As more computer security developers are extending their product capabilities to address more than one type of malware, the boundary between different types of anti-malware programs is no more a clear cut and has become blurred.

For example, an anti-virus program such as AVG Anti-Virus covers not only viruses, but offers protection against spyware, adware and others. An anti-spyware program such as SuperAntiSpyware not only detects spyware, but removes trojans, rootkits and other threats. Likewise an anti-trojan program can offer to remove viruses, spyware and other types of malware.

More appropriately, these security products are to be classified as anti-malware programs rather than to be grouped by the name of the products.

In this respect, anti-malware products which are designed to detect and remove trojans more effectively than the others will be reviewed in this category.

How many anti-malware programs need to install?

Do you still need an anti-virus program plus an anti-spyware program and an anti-trojan scanner?
 
"For the majority of average users the answer is no. A single competent broad spectrum anti-malware product is enough."
 
"Of course, not everyone is an average user. Users who engage in high risk activities, like sourcing their software from P2P services, should load up their PC with all the protection they can get. Similarly, there are users for whom the best possible protection is paramount, regardless of cost or performance implications. Finally, users of freeware scanners who cannot afford [or unwilling to pay for] a premium product may be well advised to use more than one signature-based scanner."
 
-- excerpted from Gizmo Richards' Support Alert Newsletter Issue 156 April 2008.

Disclaimer

Despite their ratings in this review, some anti-malware programs in certain cases are able to detect more malware than the others depending on their designs, online databases and the infections on computers.

Discussion

a-squared Freea-squared Free is a good choice to scan and remove malware, especially trojans, from your PC. It removes reliably the trojans containing backdoors, keyloggers, dialers and other destructive pests which make it dangerous to surf the web.

Other than trojans, it also can be used to recognize and remove spyware, adware, tracking cookies, worms, viruses and other malware from your PC.

Designed for ease of use, this program combines a-squared Anti-Spyware and the Ikarus Anti-Virus engine in the latest version to cut down on unnecessary double detection routines for one and the same malware.

Features such as quarantine, online updates and heuristic scan for unknown malware are included. As disclosed by a-squared Free, its malware database consists of more than 500,000 malware signatures.

However, this free program does not provide other features such as background guard, automatic updates and scheduled scans.

 

ThreatFireIf you prefer background guard, PC Tools ThreatFire is a good choice. It provides proactive defense against both known and unknown threats by trojans as well as viruses, worms, spyware, rootkits and other malware.

ThreatFire provides real-time behavior-based malware protection against new or unknown threats without scanning, but running constantly in the background, light on system resources.

ThreatFire automatically quarantines known and unknown threats detected for your protection. After quarantining, you can choose to permanently delete the threats from your system.

The program interface shows you a world map of prevalent threats, either trojans, worms, viruses, or other malware. Further, ThreatFire provides ThreatExpert Reports on the latest 200 findings of threats, more often with more than 30% of them related to trojans.

ThreatFire comes with a feature which allows you to help identify new threats and provide feedback to its Secure Community while you receive automatic updates from them. If you opt out of the Community, automatic updates will not be supported.

 

Malwarebytes' Anti-MalwareMalwarebytes' Anti-Malware is another alternative which can be used to scan and remove trojans, along with other malware such as viruses, worms, rootkits, dialers and spyware.

MalwareNET, which is Malwarebytes' online database, revealed that nearly 20% of the total objects detected by Anti-Malware were related to trojans.

Other features of this program include multiple-drive scanning, quick scanning, ignore list, quarantine to hold threats and restore them, context menu integration to scan files on demand, extra utilities to help remove malware manually, and settings to enhance performance of the program. It works together with other anti-malware utilities as well.

However, real-time protection and scheduler are only available to the pay version.

 

SUPERAntiSpywareSUPERAntiSpyware is worth a try as well. In addition to its focus on detecting and removing spyware infections, this program deals with trojans and other types of threats such as dialers, keyloggers, worms, rootkits, etc.

It supports a quick scan, complete system scan or custom scan with trust items and exclude folders. It also provides an option to check for latest defination updates before scanning to protect you from the threats. On its Threat Research, some typical threats by about 100 trojans are listed here, while the same by about 150 spyware items and other malware items are listed as well.

Among other features, it includes Hi-Jack Protection to prevent other application, except for Task Manager, from terminating the program.

On the down side, the free version of this program does not support real-time blocking, scheduled scanning and some other features.

Other Related Products
These are a number of other free trojan scanners and removers which were brought up in comments here or noted from other sources. As they are not rated in this review, I am listing them here with brief descriptions and links to their sites for ease of reference.
 
  • Rising PC Doctor comes with a scanner for trojans and spyware, and an option to enable automatic protection such as Trojan Interceptor, Trojan Download Blocker along with some other protections. Other tools such as start up control, process manager, service manager, file shredder, etc., are also included.
  •  
  • SDFix is a free trojan removal program written by AndyManchesta to remove trojans along with other malware such as worms, rootkits and others. It requires rebooting the system into safe mode to run the program.
  •  
  • Trojan Killer is a malware removal application to remove various types of malicious or unwanted programs such as hidden dialers, adware, spyware, etc. Dangerous items are highlighted in red after scanning and can be removed with a right click. Current database has relatively fewer signatures as compared to a-squared Free.
  •  
  • Comodo BOClean Anti-Malware features automatic detection of trojans and other malware in the background with daily database updates. It covers approximately 70,000 trojans in the current database as shown in the list produced by the program with a click on the "Covered Trojans" button.
Have Your Say
You are invited to share and discuss your views in our freeware forum.  To post in the forum you need to register first but that's quick and immediate. Alternatively, anyone can leave a comment at the bottom of this page.
 

Please help us by rating this review

Related Links
Quick Selection Guide

a-squared Free    Rating 8 of 10  Gizmo's Top Pick

Pros   Scan and remove especially trojans and other malware such as worms, viruses, spyware, trackers, dialers, etc. Easy to use, quarantine and updates are available.
Cons   Background guard, auto updates, scheduled scans, etc., are not included.
Developer Home Page   http://www.emsisoft.com/en/software/free/
Download link   http://www.emsisoft.com/en/software/download/
File Size   52.4 MB   Version 4.5.0.8   License Type Private Freeware (not free for commercial use)   Installation Requirements Win XP to Vista

PC Tools ThreatFire    Rating 7 of 10

Pros   Proactive defense against both known and unknown threats by trojans as well as viruses, worms, spyware, rootkits and other malware.
Cons   Automatic updates not provided if opted out of ThreatFire's Secure Community.
Developer Home Page   http://www.threatfire.com/
Download link   http://www.threatfire.com/download/
File Size   7.55 MB   Version 4.5.0.24   License Type Private Freeware (not free for commercial use)   Installation Requirements Windows 2000 to Vista

Malwarebytes' Anti-Malware    Rating 6 of 10

Pros   Scan and remove trojans along with other malware. Features include multiple drive and quick scans, database updates, ignore list and quarantine to hold threats, etc.
Cons   Real-time protection and scheduler are only available to the pay version.
Developer Home Page   http://www.malwarebytes.org/mbam.php
Download link   http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button
File Size   3.86 MB   Version 1.41   License Type Restricted Freeware (full commercial version available)   Installation Requirements Win 2000 to Vista

SUPERAntiSpyware    Rating 6 of 10

Pros   Scan and remove trojans along with spyware and other malware. Other features include quick, complete, or custom scans with definition updates, Hi-Jack protection, etc.
Cons   Real-time blocking and scheduled scanning not supported in free version.
Developer Home Page   http://www.superantispyware.com/index.html
Download link   http://www.superantispyware.com/superantispywarefreevspro.html
File Size   6.94 MB   Version 4.28.1008   License Type Private Freeware (not free for commercial use)   Installation Requirements Windows 98 to Vista
Editor

This software category is maintained by volunteer editor nirvana39

 

Tags

anti-malware, anti-trojan, anti-virus, anti-spyware, adware, remover, scanner, freeware, free trojan scanner, free trojan remover

4.235295
Average: 4.2 (34 votes)
Your rating: None

I tried to install a-squared Free and PC Tools ThreatFire in my mechine (vista), both of them give me a corrupt file error message, got any idea?
Thanks a million,

i used webroot free for a sample try.
it picked up a trojan and Trkng ckkes.
would not remove them because it is free programme.
a-squared recmmnded as best anit trojan... did not pick it up?
only paid for programmes detect and remove?

You could also try running a few other scanners to see if they can detect and remove it. You could use Malwarebytes Antimalware, Superantispyware and Hitman Pro.
http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
http://download.cnet.com/SuperAntiSpyware-Free-Edition/3000-8022_4-10523...
http://download.cnet.com/Hitman-Pro-3/3000-2239_4-10895604.html

Agree with, JonathanT!

hi guys:

to me security suits and/or antivirus resident in memory are useless. I'm an experienced user and I have found:
-clogged systems
-blocked trusted software
-slowed machines
-getting infected.

So, the question is how I can get the maximum protection with minimum resources? check out my current configuration:

-malwawrebytes antimalware full version and resident in memory
-A squared free version (no resident in memory)
-spybot
-Autorun Eater
-sandboxie
-physical router firewall
-windows default firewall
-firefox as unique internet browser with these extensions: adblock, betterPrivacy, taco, sanscrypt, WOT and showIP. (sometimes I use opera and srware Iron)

I have not been infected in 2 years, and it has been my configuration; and believe me: I have tried everything.

so my machine is fast and secure. when I'm browsing normal websites I disconnect sanscrypt; but when I'm browsing shit websites (torrents, porno, warez, gaming, etc.) I run my browser sandboxed and sanscrypt enabled, I tease around those places and when I get tired, I just close FF and I delete the sandbox. When I'm trying new and/or unknown applications I run them sandboxed.

thanks,

memoemc2

It seems that Comodo BOClean Anti-Malware has disappeared from Comodo's website. And it seems Trojan Killer is no longer free but comes at the price of $37 US Dollars.

New link for Comodo BOClean Anti-Malware is here.

This link only goes to the full suite @ 39MB

What do you mean, MidnightCowboy? I hit that link and it goes to the free 1.77 MB version. Thanx, Jojoyee.

Confirmed with Melih from Comodo today.

* BOClean is no longer available as a standalone product from Comodo
* It is still obtainable from some third party download sites but the software does not update.

In this state it has a limited value at best.

BOClean Anti-malware itself is 1.77 MB, but beneath the download button, it does specify that "BoClean is now included in Comodo Internet Security", which is 38.6 MB.

CIS includes Firewall, Antivirus, Defense+, Memory Firewall and Anti-Malware. Upon installing the CIS, either Firewall OR Antivirus can be excluded.

Well, yes, but it seems that the anti-malware can be downloaded by itself without the rest of CIS. Am I right?

Oops! Guess I was wrong. You would have to download the whole thing.

one day i was opening facebook account then suddenly message came that their are 26 trojans in ur computer so i scan with NOD 32 it was nt wrking so i close facbk and open the downloading site of antivirus but nththing happend
bt plz u people tell me a site to download

Try this...Turn off System Restore and restart PC in safe mode by continually tapping F-8 key and choosing Safe Mode with Networking. Next download, update, run Malwarebytes in Full Scan. When done and restarted out of safe mode, download, update, run SuperAntiSpyware and A-squared. Next download and run ccleaner. Turn System Restore back on. This usually works 9 out of 10 times. Once in awhile, for a major infection, a user will want to run ComboFix which you can download and read up on over at Bleeping Computers website...

Some Malware may reside in system restore, so be sure to scan again after turning sys restore back on again.

Facebook is riddled with malware of all descriptions so your PC is now likely infected. Some of this malware is designed to prevent you accessing the sites where you can obtain tools to remove it. If you register and post here in the forum one of us will attempt to help you as this isn't possible here in the comments section.

http://www.techsupportalert.com/freeware-forum/general-computer-support/

A new version of ThreatFire is out 4.6.0.19, and I like it much better than the last version!

Doesn't anyone realize that probably 75% of these "viruses" are created by programmers who work for the same companies that make these so-called "anti-viruses"? They want you to buy their product, so the best way is to pollute the internet with viruses and spyware.

This is a shortsighted myth. If the big names in security were ever caught engaging in such a practice, they would lose everything. And all it would take is a singular conscientious employee to quietly rat them out. In come the auditors/authorities, the place is shaken down, and it's curtains for a very lucrative business.

Modern malware is designed either for profit, or to attack someone. Viruses are most often found in e-mails targeted at politicians and high-profile clergymen. Of course you have the usual spyware and adware, designed to track your surfing activities (kind of like a consumer survey being conducted without your knowledge or permission) or display advertisements. And then you have Trojans packed into files you download from dodgy Web sites and P2P networks, as well as drive-by exploits; these baddies will usually install a backdoor on your computer that allows a hacker to control it remotely for click fraud, pump 'n' dump stock transactions, spamming, etc. The origins of most malware in the wild are well known; most of today's most widespread parasites come from gangs in China and Russia (one well-known cybercrime syndicate calls themselves the Russian Business Network).

Finally, any sought after profit would not be worth the risk, especially when there are so many competitors for the user to choose from. Pretend that Symantec (makers of Norton security products) were to write their own malware in hopes of profiting from it. How do they make sure consumers install their product for protection, and not a product by McAfee, Trend Micro, Kaspersky, Panda, Webroot, PC Tools, AVG Technologies (formerly Grisoft), Avira, ALWIL, Rising, G Data, Softwin, F-Secure, Sunbelt, Sophos, Eset, Norman, TrustPort, Microsoft, Kingsoft, AhnLab, Antiy Labs, Aladdin, Authentium, Cat Computer Services, ClamAV, Comodo, CA, Doctor Web, Emsi, Eset, Fortinet, FRISK, Hacksoft, Hauri, Ikarus, INCA, K7, Prevx, Secure Computing, VirusBlokAda, VirusBuster, Lavasoft, Safer Networking, or anybody else?

Now I should let you know that there are indeed rogue antivirus programs, but these are marketed through scareware. A "Windows" warning box will pop up, telling you that your computer is infected and you need to download their product to have it cleaned. This is the only way to force customers into purchasing your product, and not a competitor's product.

Hopefully you can drop this ridiculous conspiracy theory after a quick lesson in common sense.

That might be true, if the major AV companies were not stating, "We are losing the war against malware".

It has been my experience, that A-squared run after using ComboFix is a superb Trojan-Malware Combo! I was surprised not to see Combofix mentioned here.

Some Trojan info.

'World's nastiest trojan fools AV software'
http://www.theregister.co.uk/2009/09/18/zeus_evades_detection/

This variant on the same theme is also quite interesting!

http://news.softpedia.com/news/Cyber-criminals-Target-Their-Own-Kind-105...

As a footnote, Comodo (CIS) detects it, Symantec (Norton) detects it and Kaspersky detects it. Not sure about any of the others. It would have been a great help is this information had been released by Trusteer in their PDF report.

Nice one! Perhaps it will implode on itself and disappear!

You're quite right.
'Zulfikar Ramzan, technical director, Symantec Security Response told SCMagazineUS.com in an email Wednesday that there are “some issues” with accuracy of the study since it does not provide a breakdown of individual anti-virus companies' effectiveness of detecting ZBot.

“While the numbers produced are noteworthy, it is important to take them with a grain of salt,” Ramzan said.'
http://www.scmagazineus.com/Zbot-evades-most-anti-virus-programs/article...

It is a nasty, customizable/variable, trojan though. Would the software in the TSA article be able to detect it?

As a footnote to my comment below I was able to make contact late yesterday with Christian Mairoll the CEO of Emsisoft who confirmed that a-squared does detect this Trojan. The detection of new variants would be dependent on the update frequency of the free version scanner, but anyone with the full version would be protected by the behavior blocker component, Mamutu.

Cheers for that.
A2 FP's and large daily updates are still an issue IMHO, even though they have supposed to have improved things. But, a price worth paying maybe.

This is a very difficult question to answer because there can be many versions of the same Trojan in circulation at any one time and finding out which might be detected by whom is pretty near impossible. Additionally, different AV vendors do not name the files they detect in the same manner, so one might describe it as Zeus, and another as Zbot.

As the Trojan is almost impossible to detect from its files, the best way to see whether you are infected is to check the registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit. Make sure that there is no ntos.exe in here. It it is, you are infected!!!

A complete removal is quite tricky as the files are rootkit-protected and cannot be easily deleted. However you can disable the trojan by removing the ntos.exe part (just that part!) in the above mentioned registry key. After a restart, the trojan will not be active. However the malicious files (protected by the rootkit) are still on the computer.

These removal instructions are courtesy of TrustDefender Labs at this address, and should only be followed by users with expert system knowledge.

http://www.trustdefender.com/blog/?s=yaludle

Anyone else should seek outside help unless their chosen anti-malware solution confirms it's detection AND removal.

I have a trojan infection and I can't get on the net to download any trojan removing programme (this is my husbands comp) as when I click internet explorer, it closes right away. It is removing some of my programmes and files and is going to kill me! My work is on my comp! Please, tell me a good trojan remover, whether I need to pay or not, that works on Vista. Is Spy Doctor any good? Will it remove a trojan? I'm not bothered by anti whatsit stuff, just something to remove the trojan that I can download from hubby's comp onto my memory stick, to upload onto my comp.

You could follow this guide.
http://www.techsupportalert.com/content/spyware-removal-guide.htm

"Spy Doctor" is almost certainly a rogue program, that means it is also a malware/virus. Spyware Doctor is a legitimate program, their website is here.
http://www.pctools.com/spyware-doctor/

But Malwarebytes Antimalware and Superantispyware are better for removing infections.

Definitely go with SuperAntispyware and Malwarebytes. I use them both with great success in removing infections.

How about a 'portable' anti malware? any recommendations?

See our Best Free Portable Programs page under Best Free Portable Anti-Malware for some suggestions.

any one knows, how to remove trojan horse generic.AHNS ? i have free avg edition, i scan the whole computer, delete it, and it appears again, it seems to have attached to my agp file, which is necessary file that runs my computer. How can i get rid of without deleting the agp file it once and for all?!

Maybe trying Unhack Me?

Malwarebytes' Anti-Malware goes along with XP to not only 2000 and Vista.

Does anyone know how to get rid of trojan.win32agent.azsy?
I have AVG anti-virus and its not detecting anything. However I am getting popups to block or ignore certain viruses. I don't know if its my AVG working or this personal anti-virus scan that just downloaded itself and now wont activate unless I pay 79.99.

Try SDFix.exe

Here are one set of instructions for removing this infection.

http://www.iobit.com/removal/remove-trojan-win32-agent-azsy.html

There will be others if you Google for them - just use the method you feel most comfortable with. After removing the infection I would also download and scan with the free version of a-squared which has an excellent detection rate for this type of malware. Just take care that something it finds is not a "false positive". After that, on the assumption that you received no warning for this infection from AVG I would ditch this in favor of either Avast! or Avira.

howw... um do u download itt?

Download what from where?

BOClean used to be an excelent anti-malware. Now it is part of Comodo Security Suite. It comes with anti-virus and firewall. They don't offer it alone.

ANYONE; any suggestions on how or what to use to get rid of this trojan: TROJAN.METAJUAN, there is so many stuff out there and i don't really know which one to use. thanks guys.

Try this link, http://forums.majorgeeks.com/showthread.php?t=35407

Follow the instructions and see what happens.

Or, just use Avira Free. This is an excellent antitrojan already.

Can I run install and run BOTH ThreatFire and SuperAntiSpyware at the same time? Would it not have conflicts with each other? Thanks!

yes, you can. whether you use SAS FREE or Paid.

We would need to know which version of SUPERAntiSpyware you have (free or commercial) and also details of your other security programs before offering to comment. In any case, you would be guaranteed a much more comprehensive response by posting your request in the forum.

How does SAS Professional fare as a trojan scanner and remover?

Post new comment

  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <b> <address> <blockquote> <br> <caption> <center> <code> <dd> <del> <div> <dl> <dt> <em> <font> <h2> <h3> <h4> <h5> <h6> <hr> <i> <img> <li> <ol> <p> <pre> <span> <strong> <sub> <sup> <table> <tbody> <td> <tfoot> <th> <thead> <tr> <u> <ul> <tr>
  • Lines and paragraphs break automatically.
  • [node:123] - insert full text (themed by theme('node'))
    [node:123 body] - insert node's body
    [node:123 teaser] - insert node's teaser
    [node:123 link] - insert link to node
    [node:123 collapsed] - insert collapsed node's body
  • You may use [view:viewname] tags to display listings of nodes.

More information about formatting options