MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Reply
 
Thread Tools Display Modes
  #1  
Old 01-25-10, 05:53
stevep119 stevep119 is offline
Private E-2
 
Join Date: Jan 2010
Posts: 13
Thanks: 6
Thanked 0 Times in 0 Posts
Default Combofix - Deleted Desktop, docs, programs etc

Hi,

I need some help with Combofix.

Its deleted all of my docs, userprofile and files from the systems32 folder

Ive tried system restore but it didnt fix it..

What do I need to provided to get things back?
Reply With Quote
Sponsored links
  #2  
Old 01-25-10, 08:04
stevep119 stevep119 is offline
Private E-2
 
Join Date: Jan 2010
Posts: 13
Thanks: 6
Thanked 0 Times in 0 Posts
Default Re: Combofix - Deleted Desktop, docs, programs etc

Sorry didnt have enough time earlier to fully explain whats happened.

It all started when my PC was infected with win32.patched and a couple of other viruses

I tried to remove then using AVG but AVG kept reporting that its own exe "avggui.exe" was infected.

I tried Malwarebytes, Spybot and spyware doctor.

None of these seemed to clean the system and so I downloaded Avast.

Avast found the viruses in the memory and after a boot time scanned came back clean....

It then reported I had a infection in firefox which kept forwarding me to upwin.co.cc

After googling this a forum said "Combofix" would sort this out and so I downloaded it to my desktop, disabled avast and then set it off....

It took HOURS for the scan to complete and then after the PC rebooted I logged back into my profile to find the desktop was blank and all of my documents and programs where missing....

In a panic I restored the PC back to the last restore point but all it fixed was the missing icons on my desktop but still no documents or programs.

I am also unable to open firefox and any other exe.

I have found the backup files that combofix made under Qoobox but am unsure how I go about restoring things back?

If someone could help me out that would be really great.

Thanks in advance.
Reply With Quote
  #3  
Old 01-25-10, 11:49
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,603
Thanks: 62
Thanked 7,744 Times in 4,184 Posts
Default Re: Combofix - Deleted Desktop, docs, programs etc

Welcome to Major Geeks!

The ComboFix program bug has now been resolved and a new version is available. Also an automatic fix tool has been created to restore what it removed.


Download the new version of combofix.exe and save it to your Desktop. DO NOT RUN IT YET!!! Just make sure you have the new version downloaded and saved.

Now download this file > http://download.bleepingcomputer.com/sUBs/CFDQ-UsrPrf.exe

You should be able to run it from any location but save it to your Desktop if possible. As long as Qoobox has not been tampered with, the tool shall be able to automatically do the below.
  • restore all the required files/folders
  • restore the perms
  • set the correct attributes for desktop.ini
Now run the CFDQ-UsrPrf.exe program by double clicking on it.
  • Immediately after you run it, YOU MUST NOT reboot your PC. Don't do anything else but continue on with the below..
  • Now immediately run the new version of ComboFix that you saved to your Desktop earlier. This should cause a reboot of your PC after running if malware was detected and removed.
  • After reboot attach the C:\combofix.txt log.
  • Also please run the MGtools.exe program as specified here:Using MGtools Then attach the requesetd C:\MGlogs.zip file
  • (See: HOW TO: Attach Items To Your Post )
Now tell us how things are working.
  • Do things seem to have been restored?
  • What malware problems are you having?
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
The Following User Says Thank You to chaslang For This Useful Post:
stevep119 (01-25-10)
  #4  
Old 01-25-10, 13:29
stevep119 stevep119 is offline
Private E-2
 
Join Date: Jan 2010
Posts: 13
Thanks: 6
Thanked 0 Times in 0 Posts
Default Re: Combofix - Deleted Desktop, docs, programs etc

Hi,

when i run CFDQ-UsrPrf.exe I get the following error:

"Windows cannot find "Nircmd" make sure yu typed the name correctly."


any suggestions?
Reply With Quote
  #5  
Old 01-25-10, 13:46
stevep119 stevep119 is offline
Private E-2
 
Join Date: Jan 2010
Posts: 13
Thanks: 6
Thanked 0 Times in 0 Posts
Default Re: Combofix - Deleted Desktop, docs, programs etc

Im now getting the following error:

Error 0x00007766



Last edited by stevep119; 01-25-10 at 13:55..
Reply With Quote
Sponsored links
  #6  
Old 01-25-10, 14:06
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,603
Thanks: 62
Thanked 7,744 Times in 4,184 Posts
Default Re: Combofix - Deleted Desktop, docs, programs etc

Quote:
Originally Posted by stevep119 View Post
when i run CFDQ-UsrPrf.exe I get the following error:

"Windows cannot find "Nircmd" make sure yu typed the name correctly."
any suggestions?
Is all of your protection software disabled. If not, it may be deleting the files the tool needs to use to run. Nircmd is one of the tools use by ComboFix
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
The Following User Says Thank You to chaslang For This Useful Post:
stevep119 (01-25-10)
  #7  
Old 01-25-10, 14:07
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,603
Thanks: 62
Thanked 7,744 Times in 4,184 Posts
Default Re: Combofix - Deleted Desktop, docs, programs etc

Quote:
Originally Posted by stevep119 View Post
Im now getting the following error:

Error 0x00007766
When exactly are you getting this and what else does it say.
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
The Following User Says Thank You to chaslang For This Useful Post:
stevep119 (01-25-10)
  #8  
Old 01-25-10, 14:15
stevep119 stevep119 is offline
Private E-2
 
Join Date: Jan 2010
Posts: 13
Thanks: 6
Thanked 0 Times in 0 Posts
Default Re: Combofix - Deleted Desktop, docs, programs etc

Quote:
Originally Posted by chaslang View Post
When exactly are you getting this and what else does it say.
Hi,

all of my virus protection is disabled

when i double clicked "CFDQ" for the 1st time, it asked if I wanted to create a log file as it couldnt find one in the temp folder.

I wasnt sure so I cancelled it....

When i re-ran the program I got the "Nircmd" error....

so I went to google and found the "Nircmd" program and followed the instructions putting it into the "systems32" folder.

Straight after that I got the following error when I double clicked the "CFDQ" file:

A black screen appears an then the following:

Error

Error: 0x00007766 !! Aborting


Before I got your 1st instructions I used system restore thinking it might fix things...

I dont know what else to try? All of the files are in the Qoobox folder along with the following:

Add-remove programs.txt
Combofix-quarantined-files.txt
snapshot@2010-01-24

Any ideas? I really need to get the system back as I had loads of work on my PC before...

Thanks in advance
Reply With Quote
  #9  
Old 01-25-10, 14:22
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,603
Thanks: 62
Thanked 7,744 Times in 4,184 Posts
Default Re: Combofix - Deleted Desktop, docs, programs etc

Please do the below portion and attach the MGlogs.zip file so I can get some insight into your system.


Also please run the MGtools.exe program as specified here:Using MGtools Then attach the requesetd C:\MGlogs.zip file
(See: HOW TO: Attach Items To Your Post )
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
The Following User Says Thank You to chaslang For This Useful Post:
stevep119 (01-25-10)
  #10  
Old 01-25-10, 14:27
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,603
Thanks: 62
Thanked 7,744 Times in 4,184 Posts
Default Re: Combofix - Deleted Desktop, docs, programs etc

Quote:
Originally Posted by stevep119 View Post
Im now getting the following error:

Error 0x00007766
Okay! This occurs because you tried to run the tool a second time. It only allows you to run the tools once.

Let me see the MGlogs.zip file and then we will continue.
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
The Following User Says Thank You to chaslang For This Useful Post:
stevep119 (01-25-10)
Sponsored links
  #11  
Old 01-25-10, 14:36
stevep119 stevep119 is offline
Private E-2
 
Join Date: Jan 2010
Posts: 13
Thanks: 6
Thanked 0 Times in 0 Posts
Default Re: Combofix - Deleted Desktop, docs, programs etc

Quote:
Originally Posted by chaslang View Post
Okay! This occurs because you tried to run the tool a second time. It only allows you to run the tools once.

Let me see the MGlogs.zip file and then we will continue.

Thanks for checking that out...

Im just running MGtools now....

I wish I had of known you can only run the above fix once....

Really appreciate all your help
Reply With Quote
  #12  
Old 01-25-10, 14:45
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,603
Thanks: 62
Thanked 7,744 Times in 4,184 Posts
Default Re: Combofix - Deleted Desktop, docs, programs etc

Quote:
Originally Posted by stevep119 View Post
I wish I had of known you can only run the above fix once....
There is a way to get to run again. After you attach your MGlogs.zip file, I will explain. Also I may have to send you a link to something via a private message (PM) when I have it available. You will not be able to respond to the PM when you get it, but you will be able to read it.
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
  #13  
Old 01-25-10, 14:49
stevep119 stevep119 is offline
Private E-2
 
Join Date: Jan 2010
Posts: 13
Thanks: 6
Thanked 0 Times in 0 Posts
Default Re: Combofix - Deleted Desktop, docs, programs etc

Ok. logs are now attached:
Attached Files
File Type: zip MGlogs.zip (396.0 KB, 7 views)
Reply With Quote
  #14  
Old 01-25-10, 14:57
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,603
Thanks: 62
Thanked 7,744 Times in 4,184 Posts
Default Re: Combofix - Deleted Desktop, docs, programs etc

Okay! That confirms that your files are still present in the QooBox folders. And we will have the ability to restore them.

Whatever you do, do not try to run System Restore again and DO NOT uninstall ComboFix or make any other changes to your PC in any form. Running System Restore the first time may be the reason why the fix tool could not run properly when you ran it the first time.

Please hang on since I'm waiting for a special version of the tool to be built by the sUbs (the creator or ComboFix).
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
The Following User Says Thank You to chaslang For This Useful Post:
stevep119 (01-25-10)
  #15  
Old 01-25-10, 15:03
stevep119 stevep119 is offline
Private E-2
 
Join Date: Jan 2010
Posts: 13
Thanks: 6
Thanked 0 Times in 0 Posts
Default Re: Combofix - Deleted Desktop, docs, programs etc

Thanks

I await further instructions

Reply With Quote
Sponsored links
  #16  
Old 01-25-10, 15:50
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,603
Thanks: 62
Thanked 7,744 Times in 4,184 Posts
Default Re: Combofix - Deleted Desktop, docs, programs etc

Sorry for the delay. It takes awhile to create the new version and also it takes additional time to run tests with it to make sure it works as desired before it can be release. In order to test it, a PC needs to be broken with the old verson of ComboFix first. This is what is going on now.
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
  #17  
Old 01-25-10, 15:59
stevep119 stevep119 is offline
Private E-2
 
Join Date: Jan 2010
Posts: 13
Thanks: 6
Thanked 0 Times in 0 Posts
Default Re: Combofix - Deleted Desktop, docs, programs etc

Quote:
Originally Posted by chaslang View Post
Sorry for the delay. It takes awhile to create the new version and also it takes additional time to run tests with it to make sure it works as desired before it can be release. In order to test it, a PC needs to be broken with the old verson of ComboFix first. This is what is going on now.
No worries....

im just really greatfull that there's someone out there who can help....

if you need a pc thats broken you can always have mine lol....

I'll sit tight until the fix is ready.

Thanks again for all your help
Reply With Quote
  #18  
Old 01-25-10, 16:43
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,603
Thanks: 62
Thanked 7,744 Times in 4,184 Posts
Default Re: Combofix - Deleted Desktop, docs, programs etc

Okay download this new version

http://download.bleepingcomputer.com/sUBs/CFDQ-UsrPrf.exe

Run it by double clicking on it. Let me know if it runs or gives you the same error messages or if it works.
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
  #19  
Old 01-25-10, 16:47
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,603
Thanks: 62
Thanked 7,744 Times in 4,184 Posts
Default Re: Combofix - Deleted Desktop, docs, programs etc

I'll be going out in a little while and will not be back until around 9 PM EST. So it would be good if you tried this ASAP before I go out.
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
  #20  
Old 01-25-10, 16:59
stevep119 stevep119 is offline
Private E-2
 
Join Date: Jan 2010
Posts: 13
Thanks: 6
Thanked 0 Times in 0 Posts
Default Re: Combofix - Deleted Desktop, docs, programs etc

Quote:
Originally Posted by chaslang View Post
I'll be going out in a little while and will not be back until around 9 PM EST. So it would be good if you tried this ASAP before I go out.
Trying it now

Thanks
Reply With Quote
Sponsored links
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Combofix Deleted all Personal Files - docs, pics, music, desktop, etc Rolin Malware Removal 3 01-25-10 00:20
ComboFix deleted all icons and setting, need help! sdf1965 Malware Removal 31 01-24-10 23:43
ComboFix is deleted by the virus automatically qqwqwqq Malware Removal 1 10-12-08 21:22
What programs convert new docs to 98SE? Starkman Software 7 06-06-05 18:02


All times are GMT -5. The time now is 00:52.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


All content Copyright © MajorGeeks.com source code Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger