McAfee Stinger is a free, standalone malware detection and removal tool for Windows, now maintained by Trellix. It is aimed at a particular job: finding and cleaning a defined set of threats on a computer that may already be infected. Separate builds exist for 32-bit and 64-bit Windows, plus packages that administrators can push to managed endpoints.
Stinger is not a replacement for a full antivirus product. It recognizes only the malware families it has been configured to detect. You can view that set under Advanced > Threat List. It shows what the tool knows how to find rather than the results of a scan. GameOver Zeus and CryptoLocker are among the families covered.
What a default scan checks
Started without changes, Stinger examines the places malware most often occupies on a running system: active processes, loaded modules, the registry, WMI and the directories that malicious programs commonly use.
The “Customize my scan” option widens the scope. You can add whole drives or specific folders.
Rootkit scanning and heuristic levels
Stinger includes a rootkit scanner for threats that hide themselves from normal file and process listings. It is off by default, so you must enable it before scanning. On a machine that already runs Trellix endpoint software, enabling rootkit scanning can also update two shared VirusScan core drivers if the copies bundled with Stinger are newer than those installed.
Detection also draws on Global Threat Intelligence (GTI) file reputation and network heuristics. GTI file reputation checks files against Trellix’s cloud reputation data. Both run at a Medium level by default and can be raised to High or Very High. For the first scan at High or Very High, Trellix recommends setting the “On threat detection” action to Report. It then recommends reviewing the results before letting Stinger act.
Repair, quarantine and scan logs
When Stinger finds an infected file, its default action is to repair it. It moves files it removes to a quarantine folder at C:\Quarantine\Stinger. If Stinger cannot repair a file, Windows System Restore may be holding a lock on it. On older Windows versions, turning System Restore off before the scan allows Stinger to clean such files.
Each scan writes a time-stamped log to the folder Stinger runs from. The Log tab lists these reports, and opening one displays it as an HTML page. Stinger also saves its current settings to a Stinger.opt file in the same folder, so the next run starts with the same scan targets and options.
Custom MD5 blacklist
For a threat that is not on the built-in list, Stinger accepts a custom blacklist of up to 1,000 MD5 hashes under Advanced > Blacklist. You can type in hashes or load them from a text file. Stinger detects any scanned file matching one of them under a name beginning with “Stinger!” followed by part of its hash. It removes the file with the same repair process as built-in detections. Stinger accepts only MD5, not SHA-1 or SHA-256. As a safeguard, digitally signed files and files GTI already rates as clean are never treated as matches.
Command line, Windows PE and ePO
You can also run Stinger from the command line, with the parameters listed in its Help menu. It can run inside a Windows PE environment if you add HTML Application support to the custom PE image.
For organizations, administrators can check separate Stinger-ePO packages into Trellix ePolicy Orchestrator and deploy them to many endpoints at once. These packages disable rootkit scanning to avoid updating core drivers across a whole network. Administrators can turn it back on with command-line arguments when adding the package.
