MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Reply
 
Thread Tools Display Modes
  #1  
Old 12-01-10, 09:08
amos1001 amos1001 is offline
Private E-2
 
Join Date: Dec 2010
Posts: 20
Thanks: 1
Thanked 0 Times in 0 Posts
Default combofix hangs

Hi,

I have used combofix in the past with excellent results.

This week I began to notice frequent browser (firefox 3.6.12) lockups, and slow page loads. I decided to run combofix.

When I ran it, the first thing i noticed was that I got a strange popup asking me if I was attempting to use CFScript, and that it appeared to be "mispelt."

Combofix never got beyond the "may easily double for badly infected machines" screen. The hard drive would spin for a few moments, < 1 min, and then nothing. After waiting 5-10 min and realizing nothing was happening, I would have to power cycle to reboot.

I tried this several times hoping for a different response but of course didn't get one. I deleted the Qoobox folder and all references to Combofix, downloaded a new copy (from bleepingcomputer) and tried again with the same result.

I have tried Malwarebytes and Spybot, both tell me my system is clean. My antivirus is Clamwin, and it is updated.

Except for Combofix not being able to run, I don't really see any concrete evidence that anything is wrong with my system. I just "got a feeling" that it wasn't right because of the browser issues. But now I'm pretty sure it must be infected. Either that or I'm just not giving Combofix enough time.

In the past I've never had to wait more than just a few moments for the scrolling numbers showing each Combofix section. But now they simply don't appear.

The only log that is generated is catchme.log, and the only entry is the date.
There were multiple combofix logs that I deleted, thinking that a fresh copy would generate and have more pertinent information.

I would appreciate any help. Thank you very much.


System: WinXP Home SP3, Intel Celeron 1.5 Ghz, 2GB Ram.
Reply With Quote
Sponsored links
  #2  
Old 12-01-10, 11:24
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 27,885
Thanks: 834
Thanked 3,466 Times in 3,390 Posts
Default Re: combofix hangs

Quote:
This week I began to notice frequent browser (firefox 3.6.12) lockups, and slow page loads. I decided to run combofix.
What it is important to remember is that Combofix is not a tool you should be running on a regular basis like Malware Bytes or SUPERantispyware. Things can sometimes go very wrong when running Combofix, especially on your own without guidance. If things DO go wrong, are you able to help yourself in that situation? If the answer is no, then you should not be running Combofix without assistance, and certainly not just for the reasons you outlined. Not having "a go" just trying to help you understand it's a powerful piece of software.

Quote:
When I ran it, the first thing i noticed was that I got a strange popup asking me if I was attempting to use CFScript, and that it appeared to be "mispelt."
How were you running it in the first place? By double clicking its icon or were you using a script for whatever reason?

Quote:
I have tried Malwarebytes and Spybot, both tell me my system is clean. My antivirus is Clamwin, and it is updated.
Then can I see a log from Malware Bytes? You should also run SUPERantispyware as per the instruction I will link you to further down.

Quote:
Except for Combofix not being able to run, I don't really see any concrete evidence that anything is wrong with my system.
Lots of reasons why Combofix won't run, it does not always mean that it's a bad thing, or that malware is blocking it. You should always try renaming Combofix if it does not run, or run it in safe mode. But as I said, you cannot just be running it as you see fit.

As mentioned, I'll link to our malware removal procedures below, go through everything but skip Combofix for now. Attach logs when you are ready and we'll take a look.
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
  #3  
Old 12-01-10, 11:26
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 27,885
Thanks: 834
Thanked 3,466 Times in 3,390 Posts
Default Re: combofix hangs

Welcome to Major Geeks!

Please read ALL of this message including the notes before doing anything.

Pleases follow the instructions in the below link:

READ & RUN ME FIRST. Malware Removal Guide


and attach the requested logs when you finish these instructions.
  • **** If something does not run, write down the info to explain to us later but keep on going. ****
  • Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.
  • After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!
Helpful Notes:

  1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
  2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
  3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
  4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:
Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
  #4  
Old 12-01-10, 12:34
amos1001 amos1001 is offline
Private E-2
 
Join Date: Dec 2010
Posts: 20
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: combofix hangs

Thank you for your help!

I'm not sure how important this bit of information is, but using the Recovery Console I attempted to fix the Master Boot Record. The console told me that my computer appeared to have an unstandard MBR. After the FIXMBR command it said that my Master Boot Record was successfully restored. I immediately type FIXMBR again to see what report I would get, and to my suprise it again told me that it saw an unstandard MBR. I can't think of a legimate reason I would have an unstandard MBR.

Quote:
How were you running it in the first place? By double clicking its icon or were you using a script for whatever reason?
I was clicking the icon, not using a script. Later, I tried renaming the Combofix executable, and I also tried running the file (not renamed) in safe mode. The result was the same each time.

Quote:
Then can I see a log from Malware Bytes? You should also run SUPERantispyware
The logs are attached. I only ran a quick scan or SUPERantispyware, but I'll run a full scan later.

I'm reading your Malware Removal Guide now. Thanks again.

-amos
Reply With Quote
  #5  
Old 12-01-10, 13:02
amos1001 amos1001 is offline
Private E-2
 
Join Date: Dec 2010
Posts: 20
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: combofix hangs

Attached is the TDSSkiller log.

Also, I have turned system restore off, and find it turned back on. I haven't traced when it turns back on.
Attached Files
File Type: txt TDSSKiller.2.4.10.0_01.12.2010_13.59.41_log.txt (41.0 KB, 6 views)
Reply With Quote
Sponsored links
  #6  
Old 12-01-10, 14:41
amos1001 amos1001 is offline
Private E-2
 
Join Date: Dec 2010
Posts: 20
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: combofix hangs

I downloaded and tried to run MGTools. It opens and extracts the files into C:\MGtools, and says wait for the files to finish.

It locks up and never gets past that.
Reply With Quote
  #7  
Old 12-01-10, 18:18
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 27,885
Thanks: 834
Thanked 3,466 Times in 3,390 Posts
Default Re: combofix hangs

Quote:
and to my suprise it again told me that it saw an unstandard MBR
Note if you have a Dell PC which uses a non-standard MBR ( or another manufacturer's who does similar to Dell ) then you will see this message regarding the MBR. Do you have any non-standard or special MBRs which can occur from companies like Dell or HP who frequently install additional partitions used for recovery partitions in lieu of giving CD/DVDs?

Please click Start, Run, and enter cmd and click OK. This will open a command prompt window. Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The purple is merely informational.

cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
GetRunKey <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
ShowNew <-- this will try to run all another scan from MGtools. Tell me what error messages, if any, you see.

Any luck? Is there a C:\MGlogs.zip now?
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
  #8  
Old 12-01-10, 19:02
amos1001 amos1001 is offline
Private E-2
 
Join Date: Dec 2010
Posts: 20
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: combofix hangs

Quote:
Note if you have a Dell PC which uses a non-standard MBR
I have a Toshiba L25-S119. I am not aware of any unstandard MBR. The restore disk is a CD, not on the hard drive. It is certainly possible that there is some sort of emergency restore on the hard drive that I am unaware of.

Quote:
Open a command prompt window. Enter the below commands
I ran the batch files as you suggested. Getrunkey.bat is fired by the executable, and just as it did when I clicked the exe's icon, it locked up in the same place. However, shownew.bat ran wih no problems.

Quote:
Is there a C:\MGlogs.zip now?
Yes, and it's attached. Should I run more of the batch files next?
Attached Files
File Type: zip MGlogs.zip (85.7 KB, 11 views)
Reply With Quote
  #9  
Old 12-02-10, 01:31
amos1001 amos1001 is offline
Private E-2
 
Join Date: Dec 2010
Posts: 20
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: combofix hangs

I ran a full SUPERantispyware scan. Here is the log. It didn't find anything, though.
Attached Files
File Type: log SUPERAntiSpyware Scan Log - 12-02-2010 - 02-21-38.log (465 Bytes, 2 views)
Reply With Quote
  #10  
Old 12-02-10, 10:37
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 27,885
Thanks: 834
Thanked 3,466 Times in 3,390 Posts
Default Re: combofix hangs

  • Download bootkit_remover.rar
  • Click the underlined DOWNLOAD text to download the file and save it to your Desktop.
  • You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use7-Zip
  • After extracing remover.exe to your Desktop, double click the remover.exe file to run the program.
  • Attach or post inline here, the output from remover.exe
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
Sponsored links
  #11  
Old 12-02-10, 11:59
amos1001 amos1001 is offline
Private E-2
 
Join Date: Dec 2010
Posts: 20
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: combofix hangs

Quote:
Download bootkit_remover.rar
Attach or post inline here, the output from remover.exe
bootkit_remover_debug_log.txt attached below
Attached Files
File Type: txt bootkit_remover_debug_log.txt (36.3 KB, 9 views)
Reply With Quote
  #12  
Old 12-02-10, 17:28
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 27,885
Thanks: 834
Thanked 3,466 Times in 3,390 Posts
Default Re: combofix hangs

No, no, no. What I should be seeing is this: (I ran it on my machine so I could take you a screenshot)
Attached Images
File Type: jpg bootkit output.jpg (33.9 KB, 6 views)
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
  #13  
Old 12-02-10, 18:34
amos1001 amos1001 is offline
Private E-2
 
Join Date: Dec 2010
Posts: 20
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: combofix hangs

Quote:
No, no, no.
oops, sorry. i looked at that text file and thought to my self, wow that Kestrel must be a rocket scientist to read that.




Just to be clear, I did have to re-run it to get the screen shot.
Reply With Quote
  #14  
Old 12-03-10, 06:32
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 27,885
Thanks: 834
Thanked 3,466 Times in 3,390 Posts
Default Re: combofix hangs

Hi amos

That's better. Well there is not a problem with your MBR. Now, I am positive you are not having malware issues. Let's just do this:

Messenger Plus! Live
<--- Uninstall this crap.
J2SE Runtime Environment 5.0 Update 2 <---Uninstall outdated Java.

Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Vista and Windows 7 users Right-click OTL and choose Run as Administrator)
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Attach both of these logs into your next reply.
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
  #15  
Old 12-03-10, 07:24
amos1001 amos1001 is offline
Private E-2
 
Join Date: Dec 2010
Posts: 20
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: combofix hangs

Quote:
OTL.Txt and Extras.Txt
Attach both into your next reply.
Here they are.

Quote:
Now, I am positive you are not having malware issues.
I'd like to tell you what happened to make me think I had gotten infected. I can't give you all the details because I don't remember them. But here's what I can remember.

I was on facebook. I don't use or install ANY of facebook's cute little apps; I'm not into them. So it's rare that I even click on one of the links. However, sometimes I will click on the link to see what it is, but not authorize any install. Anyway, as I was saying, I was on facebook, and someone had a link that caught my eye. I don't remember exactly what it said, and I can't find the link to show you. It was different in that the user had instructions that said "click on this box, and then hit accept, and then click on the 2nd box and hit accept."

I thought how that could be a virus or malware. I was curious, so I decided to hit the first box but not hit accept. Well, there was no accept box. I got a popup that disappeared so quickly I didn't even get a glimpse of what it said. At that moment I thought man I hope my antivirus software stopped whatever that was. I didn't click the 2nd box, and left the page.

That was about two weeks ago, or a little less.
Attached Files
File Type: txt Extras.Txt (47.1 KB, 4 views)
File Type: txt OTL.Txt (64.9 KB, 4 views)
Reply With Quote
Sponsored links
  #16  
Old 12-03-10, 17:26
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 27,885
Thanks: 834
Thanked 3,466 Times in 3,390 Posts
Default Re: combofix hangs

If you are not having any other malware problems, it is time to do our final steps:
  1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
  2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
    • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
    • "%userprofile%\Desktop\combofix" /uninstall
      • Notes: The space between the combofix" and the /uninstall, it must be there.
      • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
  3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
  4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
  5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
  6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
  7. Go to add/remove programs and uninstall HijackThis.
  8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
    related to MGtools and some other items from our cleaning procedures.
  9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
    • Refer to the cleaning procedures pointed to by step 7 of the READ ME
      for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
    • Then reboot and Enable System Restore to create a new clean Restore Point.
  10. After doing the above, you should work thru the below link:
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
  #17  
Old 12-03-10, 18:50
amos1001 amos1001 is offline
Private E-2
 
Join Date: Dec 2010
Posts: 20
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: combofix hangs

Hi Kestrel,

Thanks for all the help. You're really great!

Quote:
If you are not having any other malware problems
I do really appreciate all the help you gave me and time you spent with me, but I am still unable to run combofix.

Before you yell at me, yes I know it's a dangerous tool. But I've had such success with it in the past I hate to leave my computer in a state that will not run the program. I've had infections that combofix easily handled, and I'd still like to be able to resort to that, even if only as a last resort.

Since I have run it in the past on this very machine, I know it should be able to run here. You've exhausted the search for malware, but as you said earlier

Quote:
Lots of reasons why Combofix won't run, it does not always mean that it's a bad thing, or that malware is blocking it. You should always try renaming Combofix if it does not run, or run it in safe mode.
Can you help me with this? I would really appreciate it.
Reply With Quote
  #18  
Old 12-04-10, 07:03
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 27,885
Thanks: 834
Thanked 3,466 Times in 3,390 Posts
Default Re: combofix hangs

Post a new thread in malware. Link back to this thread. Perhaps one of the other malware fighters/experts will see it and you can see what they say. I am sure you have no malware remaining to block CF from running though.
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
The Following User Says Thank You to Kestrel13! For This Useful Post:
amos1001 (12-04-10)
  #19  
Old 12-04-10, 07:46
amos1001 amos1001 is offline
Private E-2
 
Join Date: Dec 2010
Posts: 20
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: combofix hangs

Quote:
Originally Posted by Kestrel13! View Post
Post a new thread in malware. Link back to this thread. Perhaps one of the other malware fighters/experts will see it and you can see what they say. I am sure you have no malware remaining to block CF from running though.
thanks a lot kestrel. i've started a new thread as you suggested.

i really appreciate all your help!
-amos
Reply With Quote
  #20  
Old 12-05-10, 10:59
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 27,885
Thanks: 834
Thanked 3,466 Times in 3,390 Posts
Default Re: combofix hangs

Most welcome.
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
Sponsored links
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Very Infected Laptop, Combofix doesn't run, Random Hangs Saneicon Malware Removal 2 06-20-09 11:51
combofix hangs (does not start?) motoslide Malware Removal 3 04-25-09 19:19
Vista hangs after running combofix techmed Malware Removal 1 03-13-09 13:23
ComboFix Hangs johnfx Malware Removal 7 03-04-09 18:01
PC Hangs gumbo06 Hardware 5 05-07-08 03:25


All times are GMT -5. The time now is 14:13.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger