ComboFix deleted several progams-Win7 64

Willybgates · Jun 3, 2011

Hi. I am running Windows 7 Pro 64-bit. Using Eset Nod 32 v.4.2.35 w/ current definitions, Windows firewall and no other anti-spyware/malware s/w. Eset kept detecting "Ramnit.A.Gen virus" in an Autorun.inf file and "Win32/Kryptik.OEN" in Setup50777.fon file and would delete/quarantine them. Eset also reported the "LNK/Exploit.CVE-2010-2568 Trojan in one of the associated .lnk files.

I booted from USB and ran BitDefender-Rescue-CD from the ISO file, autoupdated to latest definitions, but it did not find anything. Rebooted and malware "evidence" was still there. I have know of Combofix for years as I work in IT and have spent plenty of time removing and cleaning up after endusers' virii/malware. My mistake was thinking "I'll just run ComboFix! It will fix everything!". (yeah, I know I'm gonna get scolded!) So anyway, ran ComboFix, it did not find the malware, BUT it did find every program I installed under C:\Program Files\Utility and C:\Program Files (x86)\Utility and moved them all to the C:\Qoobox\Quarantine directory.

So the question is: How do I restore all of these apps to their original locations w/o having to re-install each one?

I read through all the similar threads and have a rough idea how the Dequarantine function works, but I did not want to ruin my chances of a clean recovery.

Any help would be greatly appreciated! TIA

TimW · Jun 3, 2011

The below procedure with a new fixed version of ComboFix and new tool to repair the damage should automatically fix it and permissions problems.

Download the new fixed version of combofix.exe and save it to your Desktop. DO NOT RUN IT YET!!! Just make sure you have the new version downloaded and saved.

Now download this file > http://download.bleepingcomputer.com/sUBs/CFDQ-UsrPrf.exe

You should be able to run it from any location but save it to your Desktop if possible. As long as Qoobox has not been tampered with, the tool shall be able to automatically do the below.

restore all the required files/folders

restore the perms

set the correct attributes for desktop.ini

Now run the CFDQ-UsrPrf.exe program by double clicking on it.

Immediately after you run it, YOU MUST NOT reboot your PC. Don't do anything else but continue on with the below..

Now immediately run the new version of ComboFix that you saved to your Desktop earlier. This should cause a reboot of your PC after running if malware was detected and removed.

After reboot attach the C:\combofix.txt log.

Also please run the MGtools.exe program as specified here:Using MGtools Then attach the requesetd C:\MGlogs.zip file

(See: HOW TO: Attach Items To Your Post )

Now tell us how things are working.

Do things seem to have been restored?

What malware problems are you having?

Willybgates · Jun 3, 2011

Hi TimW,

Thanks for your speedy response. I tried to run CFDQ-UsrPrf.exe, but received the error message "Error: 0x00007766 !! Aborting".

I wanted to check w/ you before running ComboFix again per you instructions.

Thank you!

TimW · Jun 3, 2011

No, don't run Combo again.

Not sure if this will work or not:

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
Code:
KILLALL::

DeQuarantine::
C:\qoobox\quarantine\c:\program files\Utility
C:\qoobox\quarantine\c:\program files\Utility\*.*
C:\qoobox\quarantine\c:\users\AndrewR\AppData\Local\.#
C:\qoobox\quarantine\c:\users\AndrewR\AppData\Local\.#\*.*
C:\qoobox\quarantine\c:\program files (x86)\Utility
C:\qoobox\quarantine\c:\program files (x86)\Utility\*.*

Quit::
* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the previous file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Let me know if that worked or not. Attach the new Combo log.

TimW · Jun 3, 2011

If this doesn't work, you will have to manually take every file and folder within your Qoobox Combo.txt log and add the C:\Qoobox\Quarantine in front of each file and folder and then run the Dequarantine script as I have it.

Then for all your quarantined reg files such as:
C:\Qoobox\Quarantine\Registry_backups\AddRemove-B991B020-2968-11D8-AF23-444553540000_is1.reg.dat ( found in your zip file in the Cpmbo Quarantine-files log)
You do the same thing but remove the .dat extension.

It's going to take a lot of time to do this properly.

Willybgates · Jun 13, 2011

Hi All,

Finally getting time to post an update. I found an easier way to rename all of my progams/dlls/files back to their original names, removing the .vir extension which was added during the ComboFix quarantine process. As there were 7,146 files in 800+ folders quarantined, I did not want to manually update each filename, nor did I want to reinstall 15+ applications. http://forums.majorgeeks.com/images/smilies/confused.gif So, I searched for a more elegant solution.

If you are running Windows and have PowerShell installed, you can navigate to the C:\Qoobox\Quarantine\C directory and use the following command string to remove the .vir extension from all the files in all the sub-folders:

C:\Qoobox\Quarantine\C\> gci .\ *.vir -recurse | Foreach-Object {rename-item $_.fullname -newname $_.basename}

You will then need to move or copy the folders/directories back to their original locations. In my case, C:\Program Files\Utility and C:\Program Files (x86)\Utility

For the Registry mod backups in C:\Qoobox\Quarantine\C\Registry_backups, you can run the following PowerShell command:

gci .\ *.dat |% {rename-item $_.fullname -newname $_.basename}

This is essentially the same command, with the *.dat extension.

The only caveat I found in my PowerShell research is that you may fill up available memory buffers when running this command on a very large number of sub-folders. In my case, I had 2Gb available RAM and the 7,000+ files mentioned and it worked fine.

Hope this is helpful for others.

p.s. With no offense intended to the good people who wrote the ComboFix code, it might be good to correct the "algorithm" which determines that anything located in "C:\Program Files\Utility" must be malware and should be quarantined. Not necessarily so in my case anyway.

Thanks again for your help with this!

TimW · Jun 14, 2011

Great job. We will pass this along.

Log in or Sign up

ComboFix deleted several progams-Win7 64

Willybgates Private E-2

Attached Files:

Qoobox.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Willybgates Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Willybgates Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Log in or Sign up

ComboFix deleted several progams-Win7 64

Willybgates Private E-2

Attached Files:

Qoobox.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Willybgates Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Willybgates Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches