combofix hangs

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by amos1001, Dec 1, 2010.

  1. amos1001

    amos1001 Private E-2

    Hi,

    I have used combofix in the past with excellent results.

    This week I began to notice frequent browser (firefox 3.6.12) lockups, and slow page loads. I decided to run combofix.

    When I ran it, the first thing i noticed was that I got a strange popup asking me if I was attempting to use CFScript, and that it appeared to be "mispelt."

    Combofix never got beyond the "may easily double for badly infected machines" screen. The hard drive would spin for a few moments, < 1 min, and then nothing. After waiting 5-10 min and realizing nothing was happening, I would have to power cycle to reboot.

    I tried this several times hoping for a different response but of course didn't get one. I deleted the Qoobox folder and all references to Combofix, downloaded a new copy (from bleepingcomputer) and tried again with the same result.

    I have tried Malwarebytes and Spybot, both tell me my system is clean. My antivirus is Clamwin, and it is updated.

    Except for Combofix not being able to run, I don't really see any concrete evidence that anything is wrong with my system. I just "got a feeling" that it wasn't right because of the browser issues. But now I'm pretty sure it must be infected. Either that or I'm just not giving Combofix enough time.

    In the past I've never had to wait more than just a few moments for the scrolling numbers showing each Combofix section. But now they simply don't appear.

    The only log that is generated is catchme.log, and the only entry is the date.
    There were multiple combofix logs that I deleted, thinking that a fresh copy would generate and have more pertinent information.

    I would appreciate any help. Thank you very much.


    System: WinXP Home SP3, Intel Celeron 1.5 Ghz, 2GB Ram.
     
  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    What it is important to remember is that Combofix is not a tool you should be running on a regular basis like Malware Bytes or SUPERantispyware. Things can sometimes go very wrong when running Combofix, especially on your own without guidance. If things DO go wrong, are you able to help yourself in that situation? If the answer is no, then you should not be running Combofix without assistance, and certainly not just for the reasons you outlined. Not having "a go" just trying to help you understand it's a powerful piece of software.

    How were you running it in the first place? By double clicking its icon or were you using a script for whatever reason?

    Then can I see a log from Malware Bytes? You should also run SUPERantispyware as per the instruction I will link you to further down.

    Lots of reasons why Combofix won't run, it does not always mean that it's a bad thing, or that malware is blocking it. You should always try renaming Combofix if it does not run, or run it in safe mode. But as I said, you cannot just be running it as you see fit.

    As mentioned, I'll link to our malware removal procedures below, go through everything but skip Combofix for now. Attach logs when you are ready and we'll take a look. :)
     
  3. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Welcome to Major Geeks!

    Please read ALL of this message including the notes before doing anything.

    Pleases follow the instructions in the below link:

    READ & RUN ME FIRST. Malware Removal Guide


    and attach the requested logs when you finish these instructions.
    • **** If something does not run, write down the info to explain to us later but keep on going. ****
    • Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.

    • After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!
    Helpful Notes:

    1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
    2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
    3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
    4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:
    Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
     
  4. amos1001

    amos1001 Private E-2

    Thank you for your help!

    I'm not sure how important this bit of information is, but using the Recovery Console I attempted to fix the Master Boot Record. The console told me that my computer appeared to have an unstandard MBR. After the FIXMBR command it said that my Master Boot Record was successfully restored. I immediately type FIXMBR again to see what report I would get, and to my suprise it again told me that it saw an unstandard MBR. I can't think of a legimate reason I would have an unstandard MBR.

    I was clicking the icon, not using a script. Later, I tried renaming the Combofix executable, and I also tried running the file (not renamed) in safe mode. The result was the same each time.

    The logs are attached. I only ran a quick scan or SUPERantispyware, but I'll run a full scan later.

    I'm reading your Malware Removal Guide now. Thanks again.

    -amos
     

    Attached Files:

  5. amos1001

    amos1001 Private E-2

    Attached is the TDSSkiller log.

    Also, I have turned system restore off, and find it turned back on. I haven't traced when it turns back on.
     

    Attached Files:

  6. amos1001

    amos1001 Private E-2

    I downloaded and tried to run MGTools. It opens and extracts the files into C:\MGtools, and says wait for the files to finish.

    It locks up and never gets past that.
     
  7. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Note if you have a Dell PC which uses a non-standard MBR ( or another manufacturer's who does similar to Dell ) then you will see this message regarding the MBR. Do you have any non-standard or special MBRs which can occur from companies like Dell or HP who frequently install additional partitions used for recovery partitions in lieu of giving CD/DVDs?

    Please click Start, Run, and enter cmd and click OK. This will open a command prompt window. Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The purple is merely informational.

    cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
    GetRunKey <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
    ShowNew <-- this will try to run all another scan from MGtools. Tell me what error messages, if any, you see.

    Any luck? Is there a C:\MGlogs.zip now?
     
  8. amos1001

    amos1001 Private E-2

    I have a Toshiba L25-S119. I am not aware of any unstandard MBR. The restore disk is a CD, not on the hard drive. It is certainly possible that there is some sort of emergency restore on the hard drive that I am unaware of.

    I ran the batch files as you suggested. Getrunkey.bat is fired by the executable, and just as it did when I clicked the exe's icon, it locked up in the same place. However, shownew.bat ran wih no problems.

    Yes, and it's attached. Should I run more of the batch files next?
     

    Attached Files:

  9. amos1001

    amos1001 Private E-2

    I ran a full SUPERantispyware scan. Here is the log. It didn't find anything, though.
     

    Attached Files:

  10. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    • Download bootkit_remover.rar
    • Click the underlined DOWNLOAD text to download the file and save it to your Desktop.
    • You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use7-Zip
    • After extracing remover.exe to your Desktop, double click the remover.exe file to run the program.
    • Attach or post inline here, the output from remover.exe
     
  11. amos1001

    amos1001 Private E-2

    bootkit_remover_debug_log.txt attached below
     

    Attached Files:

  12. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    No, no, no. What I should be seeing is this: :) (I ran it on my machine so I could take you a screenshot)
     

    Attached Files:

  13. amos1001

    amos1001 Private E-2

    oops, sorry. i looked at that text file and thought to my self, wow that Kestrel must be a rocket scientist to read that. :-D


    [​IMG]

    Just to be clear, I did have to re-run it to get the screen shot.
     
  14. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hi amos

    That's better. :-D Well there is not a problem with your MBR. Now, I am positive you are not having malware issues. Let's just do this:

    Messenger Plus! Live
    <--- Uninstall this crap.
    J2SE Runtime Environment 5.0 Update 2 <---Uninstall outdated Java.

    Download OTL to your desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Vista and Windows 7 users Right-click OTL and choose Run as Administrator)
    • When the window appears, underneath Output at the top change it to Minimal Output.
    • Check the boxes beside LOP Check and Purity Check.
    • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

    When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

    Attach both of these logs into your next reply.
     
  15. amos1001

    amos1001 Private E-2

    Here they are.

    I'd like to tell you what happened to make me think I had gotten infected. I can't give you all the details because I don't remember them. But here's what I can remember.

    I was on facebook. I don't use or install ANY of facebook's cute little apps; I'm not into them. So it's rare that I even click on one of the links. However, sometimes I will click on the link to see what it is, but not authorize any install. Anyway, as I was saying, I was on facebook, and someone had a link that caught my eye. I don't remember exactly what it said, and I can't find the link to show you. It was different in that the user had instructions that said "click on this box, and then hit accept, and then click on the 2nd box and hit accept."

    I thought how that could be a virus or malware. I was curious, so I decided to hit the first box but not hit accept. Well, there was no accept box. I got a popup that disappeared so quickly I didn't even get a glimpse of what it said. At that moment I thought man I hope my antivirus software stopped whatever that was. I didn't click the 2nd box, and left the page.

    That was about two weeks ago, or a little less.
     

    Attached Files:

  16. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
  17. amos1001

    amos1001 Private E-2

    Hi Kestrel,

    Thanks for all the help. You're really great!

    I do really appreciate all the help you gave me and time you spent with me, but I am still unable to run combofix.

    Before you yell at me, yes I know it's a dangerous tool. But I've had such success with it in the past I hate to leave my computer in a state that will not run the program. I've had infections that combofix easily handled, and I'd still like to be able to resort to that, even if only as a last resort.

    Since I have run it in the past on this very machine, I know it should be able to run here. You've exhausted the search for malware, but as you said earlier

    Can you help me with this? I would really appreciate it.
     
  18. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Post a new thread in malware. Link back to this thread. Perhaps one of the other malware fighters/experts will see it and you can see what they say. I am sure you have no malware remaining to block CF from running though.
     
  19. amos1001

    amos1001 Private E-2

    thanks a lot kestrel. i've started a new thread as you suggested.

    i really appreciate all your help!
    -amos
     
  20. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Most welcome.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds