To download Sergiwa Antiviral Toolkit click here

To buy Sergiwa Antiviral Toolkit Personal Edition click here

To buy Sergiwa Antiviral Toolkit Enterprise Edition click here


Sergiwa Antiviral Toolkit is a set of handy tools that scan, remove malware and re-enables all what a virus had previously disabled (System Restrictions) and gives you back the control over your own computer, common behavior of a virus is to make some changes to the system restrictions in order to hide itself from easy detection, a list of these restrictions can be found here

Sergiwa Antiviral Toolkit protects you from any further infections that come from removable media (Pen Drives). Since we noticed that most of the malware nowadays spread via removable media (Flash disks in specific), we implemented RRT with the ability of monitoring, blocking and removing any type of malware that uses flash disks to spread.

Sergiwa Antiviral Toolkit with AutoRemove enabled will monitor your system and detects any flash disk as soon as it gets plugged into the USB port. The generic technique will work in less than few milliseconds , if it detects any infection in the flash disk, it will block it and remove the infection before it makes any harm to your computer.

Sergiwa Antiviral Toolkit unlike the traditional AVs doesn't need to be updated with malware signatures in order for it to do it's job, instead, it uses a generic and smart technique that detects any type of malware that attempt to infect your system via flash disk inserted into the USB ports.

Sergiwa Antiviral Toolkit beside the heuristic scanner, it includes a traditional scanner and remover for malware. it's database contains more than 60,000 record of common and stubborn malware.

Sergiwa Antiviral Toolkit also includes a smart malware activities recognition technique and a malware signatures database you build yourself, so removing a virus from your computer is the easiest job ever.

Important note:
Since this product is a security software that deals with the file system, the system registry and the running processes, it MUST be given all the rights it demands in order for it to do it's job. Some other security software will try to block the toolkit and prevent it from doing its job, please make sure that it's not blocked by your firewall and there's no other program blocking it.
Before running this toolkit, we recommend you to disable any other security solution you are running such as Antivirus, Firewall, monitoring tools ..etc.

How to buy Sergiwa Antiviral Toolkit?
The demo version of this software is for FREE for personal use only. This limited version does not have the AutoRemove feature and has no Removable Media Malware Defender. If you would like to use the application in a business environment or you want to enjoy those two great features you are required to license the application. Licensing is quick, and the pricing is flexible.

Buy through Plimus (Recommended)
This is the recommended authorized reseller of our products, they accept almost any type of payments methods, CC, PayPal, Wire transfer, pay by fax...etc, they have an excellent customer support 24/7 an live assistance, you can buy in a secured place and enjoy the discounts and the special promotions, and the most great thing is that you don't have to wait to get your product activated as the activation process is fully automated, just enter your RRT ID in the purchase form and get the activation code immediately.

To buy Sergiwa Antiviral Toolkit Personal Edition click here

To buy Sergiwa Antiviral Toolkit Enterprise Edition click here

Didn't get the activation code by email?

Below are some of the most common reasons you might not be getting the activation code by email.

* First, be patient, sometimes it takes a while for the email to arrive.
* Check to ensure you entered your email address correctly when you purchased the software. If it's wrong, contact us and provide a valid email.
* Check your junk email box, the email might have been filtered as junk.
* If you already received the email but you didn't get the activation code it's most likely because you did not enter your RRT ID in the purchase form, in this case please contact sales@sergiwa.com and send them your RRT ID so they can send you the proper activation code.
* If you can't still get any email, post here and we'll help you to sort it out.

RRT - Sergiwa Antiviral Toolkit
Developer: Issam Sergiwa
Company: Sergiwa
OS: Windows XP, Windows Vista, Windows 7 (32Bit only, not tested on 64Bit systems)
Bugs? Problems?
Contact support@sergiwa.com

Sick and tired of constantly seeing the temp2.exe error message?

When you doubleclick on one of your hard drive partitions, does it show you some unexpected results?

When you rightclick on one of your hard drive partitions, do you see a new item called "Autoplay" on top of other items with bold face?

When you right click on one of your hard drive partitions, do you see some new items with garbage text?

When you type a message in yahoo messenger you don't see what you type but your friend on the other end of the line see?

If your answer was ‘Yes’ to any of the above questions then the chances are that you may be infected with the Perlovga virus (otherwise known as temp2.exe) or one of its variants. The problem is that this virus is particularly cumbersome to remove, even by reputable anti-virus programs. But we have the solution and it is called PRT (or Perlovga Removal Tool)!

What does this tool do?
It detects and removes all traces of the Perlovga virus from your system, including floppy disks and USB flash disks (the latter ones must be write enabled during the scan process).

It also removes the leftovers of this virus by removing the 'autorun.inf' files, cleaning up you system registry and resetting your HOSTS file.

How to use it?
Start your computer in Safe mode and run this tool. If you have infected floppy/flash disks you can insert them and click start. You can repeat this process for every disk you have.

Important note:
Since this tool is a security software that deals with the file system, the system registry and the running processes, it MUST be given all the rights it demands in order for it to do it's job. Some other security softwares will try to block the tool and prevent it from doing its job, please make sure that it's not blocked by your filewall and there's no other program blocking it.
Before running this tool, we recommend you to disable any other security solution you are runing such as Antivirus, Firewall, monitoring tools ..etc.

Notes:
If you experience any problems, find any bugs or just want to leave your comments, please contact us here: support@sergiwa.com

This tool is for FREE for personal use only! If you would like to use the application in a business environment you are required to license the application. Licensing is quick, and the pricing is flexible. If you would like to license our application for your business or corporation, please do it here

Important: This product has been discontinued and replaced by RRT - Sergiwa Antiviral Toolkit; If you are a licensed user of this product, please contact support@sergiwa.com and get your copy of RRT - Sergiwa Antiviral Toolkit for free.



If you have reached this page, then you probably have been sent here by one of our other free programs :RRT,PRT, DRT,SRT or isReset

By using our free programs above, you probably have got rid of some common infectors like:

Virus.Win32.Perlovga.a
Virus.Win32.Perlovga.b
Trojan-Dropper.Win32.Small.apl
Backdoor.Win32.small.lo
W32/QQRob-ABX
Alnooh
IM-Worm.Win32.Sohanad.ao
IM-Worm.Win32.Sohanad.as
IM-Worm.Win32.Sohanad.am
IM-Worm.Win32.Sohanad.ap

And you probably have got rid of the problems and the restrictions made by those infectors!

But this is NOT the end, Those infectors are NOTHING comparing to CaSIs!!!

What are CaSIs?

CaSIs is short for Common and Stubborn Infectors. These are malicious programs (viruses, worms, Trojans, etc.) that are notoriously difficult to detect and to remove by regular anti-virus programs. These programs often have the capability to disable your computer or your anti-virus programs.

Good examples of the those infectors are:

Win32.Brontok.q
Win32.Delf.cc
Win32.VB.by
Win32.VB.cz
Trojan.Win32.Small.wv (Medichi & Medichi2)
Trojan-Downloader.Win32.Todon.ai
Trojan-Downloader.Win32.Todon.aj
Worm.Win32.AutoRun.dkk (Ahsan virus)
Trojan-Downloader.Win32.VB.bbl

If one of the above nasty infectors infected your computer you will not be able to install any of the well-known Antivirus software like Kaspersky, Mcafee, Norton, AVG, Panda... (and about 135 more Different AVs)! and please, don't try to use the Safe Mode to remove them manually because those infectors will disable the "Safe Mode"!

How do you get infected by these CaSI's?

Well, mostly because you open an attachment from an email that isn't from one of your friends. Or by using infected removable storage medias (CDs,DVDs/Floppy disks/Flash disks, Memory Cards...). Or just by visiting a suspect website which can result in your computer being compromised.

The only thing that could have saved you was having a good Anti-Virus program with up-to-date signatures. If you didn't have those installed on your computer these CaSI's could enter your system with ease and change lots of settings.

Once you are infected, NOTHING (no well-known anti-virus program such as Kaspersky, Norton, Symantec, McAfee, NOD32, etc.) can rescue you anymore. You and your computer are doomed.

But now there is a solution and it is called CaSIR

What is CaSIR?

CaSIR (Common And Stubborn Infections Remover) -- is an on-demand malware removal software. We designed it especially to remove the most common and stubborn infections from your computer. It can remove their running processes, their bodies, their registry entries and any other leftovers!

CaSIR doesn't randomly search for CaSIs, but he goes directly to the areas that a specific CaSI infects and removes it from there, hence, it does its job in mere seconds!



CaSIR does more than that. It has a generic and strong technique that allows it to do the following:

. CaSIR removes the common restrictions made to your computer by those infectors which none of the AVs deal with.
. CaSIR removes the illegitmate services frequently used by those infectors.
. CaSIR recognizes and instantly kills and deletes any running process that is disguising itself among the legitimate system services.
. CaSIR removes any scripts used by those infectors to autorun.
. CaSIR removes any autostarting registry entries related to the illegitmate services he detects.
. CaSIR deals with all your storage medias (Fixed, floppy, removable...) and cleans them up all if need be.
. CaSIR cleans up your system registry so no more spy keys, garbage activities or messages keep asking for already deleted files.
. CaSIR's signatures are fully updatable, once you download the software, all you need to do is to download the new definitions frequently and you're up-to-date and ready-to-go.

How to use CaSIR?

Just extract the zip-file you download which contains only two files:
- CaSIR20.exe: The main executable file.
- casirdef.cas The definitions file.

Simply run CaSIR (in Normal Mode) and press Start, Wait for seconds' and you're done!

If CaSIR detected any CaSIs, it will restart your computer and works in what we calls "Pre-$hell mode", after finishing it's job, CaSIR will restart your computer in Normal mode.

Important notes:
1. Since CaSIR is a security software that deal with the file system, the system registry and the running processes, it MUST be given all the rights it demands in order to remove any infection. Some other security softwares will try to block CaSIR and prevent it from doing its job, please make sure it's not blocked and there's no other program blocking CaSIR. During disinfection process we recommend you to disable any other security solution you are runing such as Antivirus, Firewall, monitoring tools ..etc.

2. Please do NOT attempt to run CaSIR in safe mode, CaSIR needs to investigate your system to know what CaSIs are active, if you ran CaSIR in safe mode, he might not be able to detect any active CaSIs, as they usually do not run in safe mode!

3. If you have more than one infected computer connected together to the same local network, do NOT attempt to use CaSIR on the infected computer while the other infected ones are connected to it, this would results in getting infected again and again. You always need to disconnect the infected computer from the network before using CaSIR and do so with all your infected computers one by one!

What is "CDS Jobs" button? and why is it there?

CDS is short for "CaSIR Deep Scanner". This is the part of CaSIR which uses the classic method of searching for malware; By the binary signature. We have added this new section of CaSIR starting from v2.0 because we lately noticed that some CaSIs' authors have developed a new method of making identifying their malware more difficult, that is to make the CaSI spread using random file names, random registry keys, random registry values and random running processes names, so that any algorithm based on the malware File/Folder/RegKey/RegVal/Running Modules/Processes/Threads names would fail and be of no use!

If CaSIR detected any such a nasty CaSIs (those with random techniques), he will analyze the situation first and kill the active parts of the CaSI, then invoke the CDS which will scan all your hard disks/floppy disks/flash disks/memory cards/iPod/MP3/WMA Drivers available on your system to clean them, then he will restart your computer in Pre-$hell mode to continue removing the other CaSIs, after finishing it's job, CaSIR will restart your computer in normal mode with a "Congratulations" message!

Please note that you can cancel those processes at any time, but we strongly don't recommend that, because by doing that, you will put your computer in a dangerous situation as the CaSI will come back again when you restart your computer, so please be patient and let CaSIR finish it's job.

Does CaSIR generate a log report?

Yes, after every phase of work, CaSIR will automatically generate a report file and saves it in same folder where CaSIR is. The report file always has the name: casirrpt.txt! This file is needed by us when you have any problem or inquiry and need to contact us, so please don't forget to attach this file with your inquiry.

How to update CaSIR definitions?

There's two methods of getting updates, offline and Online:

1. The Online method:
Simply press "Update" button and follow the instructions on screen.

2. The Offline method:
Visit www.sergiwa.com and go to downloads section, under Security software, you'll find CaSIR Definitions file. Download it. The definitions file is a very small zipped file that contains the CaSIs signatures. All you have to do is to download casirdef.zip, extract its contents and replace it with the old one!

What are those RNP, GFL, SFL, GFD, SFD, RKM, RKD, RKA, RSO?

When CaSIR find an infection on your computer, it shows up the infection in the following way :

XXX - YYY

XXX: is the type of the infection found
YYY: is the infection itself

XXX has 9 different keywords

RNP : Running Process
GFL : Group of Files
SFL : Single File
GFD : Group of Folders
SFD : Single Folder
RKM : Registry Key to be Modified
RKD : Registry Key to be Deleted
RKA : Registry Key to be Added
RSO: Regular System Optimization

How to buy CaSIR?


The Demo-version only detects the infection but doesn't remove them. To fully remove the infections you have to buy the Pro-version. If you are currently using the DEMO version of CaSIR, you will be automatically taken to this page whenever an infection found in your computer.


Buy from Plimus (Recommended)
This is the recommended authorized reseller of our products, they accept almost any type of payments methods, CC, PayPal, Wire transfer, pay by fax ...etc, they have an excellent customer support 24/7 an live assistance, you can buy in a secured place and enjoy the discounts and the special promotions, and the most great thing is that you don't have to wait to get your product activated as the activation process is fully automated. To buy CaSIR from Plimus click here

Buy from Avangate
If you do not have a Credit Card or you want to pay by PayPal or you want enjoy the discount options for bulk orders, you may purchase CaSIR from Avangate by clicking here

Buy from CNET
If you have your Credit Card ready and you need to buy only one unit, you may purchase CaSIR from CNET by clicking here


Notes for CNET buyers:

Once you purchase CaSIR, you'll receive a confirmation asking you to send your CaSIR ID to sales@sergiwa.com. CaSIR ID is the number CaSIR shows up when it starts up, it's usually a number of 8 or 9 digits, once you send your CaSIR ID, you'll instantly get your activation code!

Didn't get the activation code by email?

Below are some of the most common reasons you might not be getting the activation code by email.

* First, be patient, sometimes it takes a while for the email to arrive.
* Check to ensure you entered your email address correctly when you purchased the software. If it's wrong, contact us and provide a valid email.
* Check your junk email box, the email might have been filtered as junk.
* If you can't still get the email, post here and we'll help you to sort it out.

Important notes:
1. Please do NOT send CaSIR IDs asking for activation codes before purchasing CaSIR!
2. Please do NOT send the "Serial Number" or the "Order Number" of the purchase process to us, we do not need those numbers as we automatically receive them from the merchant of record for the transaction you make when purchasing CaSIR, instead, please send us CaSIR ID of your copy of CaSIR, it's the number CaSIR gives you when it starts and asks you to send it to sales@sergiwa.com

CaSIR
Developer: Issam Sergiwa
Company: iSergiwa Software
OS: Windows XP, Vista
Bugs? Problems?
Contact support@sergiwa.com

Important: This product has been discontinued and replaced by RRT - Sergiwa Antiviral Toolkit; If you are a licensed user of this product, please contact support@sergiwa.com and get your copy of RRT - Sergiwa Antiviral Toolkit for free.



What is myRT?
myRT is "Yourself made Malware Removal Tool", it removes any object you want it to remove, myRT comes with a smart malware activities recognition technique and a malware signatures database you build yourself, if myRT Smart Mode suspected a running process, a startup entry or a file that is undetected yet by your Antivirus whether it is an exe, dll, dat, sys or any other file type whether it is active and running on your system or just left there it will point it to you and let you decide if you want to add it to the database or not, once you add it, myRT will be able to remove it and remove all of its hidden friends you can't locate by yourself, if myRT didn't suspect any object you still can do it yourself, just uncheck the Smart Mode option and add the suspicious object to the database. Day by day your own myRT database gets bigger and bigger and you will be able to scan your computer for more and more malware using your own made growing malware database.

How to use it?
Run myRT, click ADD, choose from File System list, Running Processes list or Startup Items list by clicking on the corresponding button, select an object or multiple objects, drag and drop the suspected file(s)/processe(s)/Startup item(s) on the small box beside the main form, this would add this object(s) to the tool's database, then click START, myRT will scan your computer and remove all the objects you have just defined from your computer.

Does myRT generate a report?
Yes, in case you are a normal user, you are advice to generate a report first and send it to a computer techie, you can generate the log file by running the tool, click on ADD then click on Generate Report button.

Warning: myRT is designed for users who know what they do, normal users please be careful, although myRT keeps a backup copy of every single object removed, you are highly adviced to stick on Smart Mode and submit the log file to a computer techie for analysis first! please do *not* attempt to add objects you do not know what they really are, objects revealed by myRT Smart Mode are *not* always harmful and may be system or good files, removing such files may result in system damage or data loss!

Can I restore the removed objects?
Yes, a backup copy of every single object removed by myRT can be found in the root folder of your system drive under a folder named myRTVault, you will always be able to restore your files if you happend to select the wrong object and removed it by mistake! Please refer to c:\myRTVault\_myRTLOG.txt for more details.

Can I use myRT database to scan different computers?
Yes, for example, if you have 10 computers that are infected with the same malware, you do not need to add the malicious objects to the database on every computer, just add them from the first one and then transfer myRT along with the database file (myRTdb.db) to the other computers and start scanning directly by clicking on Start button.

Opps, I have just added a clean object to the database, can I remove it from the database?
Yes, just run the tool and click on Database, the database manager will allow you to delete any object from your database.

Can I exp0rt my database?
Yes, you can exp0rt your database and share it with your friends, just go to the database manager and click Exp0rt, the database would be saved as myRTdb.imp

Can I imp0rt a database?
Yes, you can imp0rt a database created by your friends, just go to the database manager and click imp0rt, the database manager will imp0rt only the new records that don't already exist in your database.

Can I rollback my database after imp0rt?
Yes, If you imp0rted your friend's database but you found that it contains many clean objects you do not want to remove one by one, you can simply go to the database manager and click Rollback, this would rollback your database to its original state before the imp0rt.

What is the different between Demo Mode and Full Mode?
If you purchase myRT you can use the Full Mode which has no limitations, but if you haven't purchased myRT yet, you will only be able to use the Demo Mode. Demo Mode lets you inspect your computer for the suspicious objects presence, myRT Safe Mode will do the best to narrow your inspection, if something suspicious found it will appear in the list but you cannot add it to the database, to be able to add it to the database you must uncheck the Smart Mode option and found suspicious object your self without the help of myRT Smart Mode, once you locate it you can add it to the database.

What is the different between Personal Edition and Enterprise Edition?
The only difference is that Personal Edition can be only used on one single computer where the Enterprise Edition can be used on unlimited number of computers. Personal Edition is good for home users or people who have only one computer to fix, Enterprise Edition is made for users who own more than 10 computers or for computer repair centers as their work needs them to repair their clients computers every day.

When I buy myRT do I have to pay monthly or yearly fees?
No, when you buy myRT you will have it for lifetime, no monthly or yearly fees at all, and this applies to both Personal and Enterprise Editions.

How to buy myRT?
First, decide what edition you need to buy, if you need to buy myRT Personal Edition click here, and if you need to buy myRT Enterprise Edition click here, when you reach the order form, fill in the fields with your regular online ordering info, but the most important field you must enter is the myRT ID field, this field must be filled in with your myRT ID which myRT gives out when it starts up, please do not type this ID by hand, just copy and paste it in the proper filed on the order form, once you complete the order, you will instantly receive a confirmation email includes your activation code, entering this activation code in its proper place within myRT program will activate it.

How to upgrade to Enterprise Edition?
If you have previously purchased the Personal Edition, you can upgrade it to the Enterprise Edition by going to the Enterprise Edition purchase page and enter a valid upgrade code, to get a valid upgrade code you need to contact sales@sergiwa.com and send them your proof of purchase of the Personal Edition, they would provide you with a valid upgrade code.

Change History:
20-3-2009 - v1.2.0.1 released:
Fixed a bug with files size

19-3-2009 - v1.2.0.0 released:
Fixed a bug with zero length files

12-1-2009 - v1.1.0.2 released:
Revision of the previous version

12-1-2009 - v1.1.0.1 released:
Revision of the previous version

11-1-2009 - v1.1.0.0 released:
Fixed some previous version bugs
Added the ability to Exp0rt & imp0rt the database

1-1-2009 - v1.0.0.0 released:
The first version
[/size]

Sick and tired of constantly seeing the New Folder.exe file in the root path of every storage media you have?

Sick and tired of constantly seeing a new folder inside every folder you have?

When you doubleclick on one of your hard drive partitions, does it show you some unexpected results?

When you rightclick on one of your hard drive partitions, do you see a new item called "Autoplay" on top of other items with bold face?

When you right click on one of your hard drive partitions, do you see some new items with garbage text?

When your Antivirus detects and deletes the malware that causes all of that and restart your system, do you see an error message similar to: "Windows cannot find SSCVIIHOST.exe..."?

If your answer was ‘Yes’ to any of the above questions then the chances are that you may be infected with the Sohanad virus (otherwise known as New Folder.exe) or one of its variants:

IM-Worm.Win32.Sohanad.as
IM-Worm.Win32.Sohanad.ao
IM-Worm.Win32.Sohanad.am
IM-Worm.Win32.Sohanad.ap

The problem is that this virus is particulary cumbersome to remove, even by reputable anti-virus programs. But we have the solution and it is called SRT (or Sohanad Removal Tool)!

What does this tool do?
It detects and reoves all traces of the Sohanad virus from your system, including floppy disks and USB flash disks (the latter ones must be write enabled during the scan process).

It also removes the leftovers of this virus by removing the 'autorun.inf' files and cleaning up you system registry, so you won’t see the 'autoplay' item anymore.

How to use it?
Start your computer in Safe mode and run this tool. If you have infected floppy/flash disks you can insert them and click start. You can repeat this process for every disk you have.

Important note:
Since this tool is a security software that deals with the file system, the system registry and the running processes, it MUST be given all the rights it demands in order for it to do it's job. Some other security softwares will try to block the tool and prevent it from doing its job, please make sure that it's not blocked by your filewall and there's no other program blocking it.
Before running this tool, we recommend you to disable any other security solution you are runing such as Antivirus, Firewall, monitoring tools ..etc.

Notes:
If you experience any problems, find any bugs or just want to leave your comments, please contact us here: support@sergiwa.com

This tool is for FREE for personal use only! If you would like to use the application in a business environment you are required to license the application. Licensing is quick, and the pricing is flexible. If you would like to license our application for your business or corporation, please do it here

What does this tool do?
Some malware do change your files' attributes to system/hidden but when you want to change them back to normal you wont be able to do that because the options are grayed.

iReset resets your system/hidden files/folders so you can view/access them normally.

How to use it?
Simply drag & drop your files/folders into the cross sign and then click RESET.

Important note:
Since this tool is a security software that deals with the file system, the system registry and the running processes, it MUST be given all the rights it demands in order for it to do it's job. Some other security softwares will try to block the tool and prevent it from doing its job, please make sure that it's not blocked by your filewall and there's no other program blocking it.
Before running this tool, we recommend you to disable any other security solution you are runing such as Antivirus, Firewall, monitoring tools ..etc.

Notes:
If you experience any problems, find any bugs or just want to leave your comments, please contact us here: support@sergiwa.com

This tool is for FREE for personal use only! If you would like to use the application in a business environment you are required to license the application. Licensing is quick, and the pricing is flexible. If you would like to license our application for your business or corporation, please do it here

Sergiwa AntiRUN ensures security and productivity by only allowing approved applications to run on your computer. Any other programs whether they are unwanted, unlicensed, or simply unnecessary are blocked from ever executing.

Coming soon...