BreakPE is lightweight and powerful stealth malware removal utility being able to make unexecutable most PE files (applications, DLLs, drivers etc.) even if they are protected by simple rootkit technologies.

BreakPE takes different approach to stealth malware removal. This program makes malware unexecutable by overwriting disk sectors where it is stored. In more technical terms BreakPE damages PE header of specified file by overwriting it directly on the volume. BreakPE has the following advantages:

• filesystem independent (supports NTFS, FAT and FAT32, also supports NTFS alternate data streams);
• relatively safe and generic (compared with other software writing directly to disk);
• in most cases (when not warned otherwise) broken PE files can be unbroken afterwards.

Unlike most other stealth malware removal utilities BreakPE doesn't use any kind of in-memory patching. It also doesn't install virtually anything (no services, drivers, hooks - not even temporary), the only exception in some cases is a small temporary file which is immediately deleted. BreakPE is designed to be effective yet safe, so warnings and questions it shows vary for each specific situation. It has very simple GUI and ability to get file name also via command line.
BreakPE can be used on Windows NT 4/2000/XP/2003.
Warning for Windows NT 4 and 2000 users: broken drivers can make these systems unbootable.

Download BreakPE:
   File: BreakPE.zip
   Version: 1.0
   Size: 20159
   MD5: b69e81848c50b7f6bdc04e53d0223c3a
   PGP signature: BreakPE.zip.sig