BleepingComputer.com: Combofix killed two of my computers

I foolishly ran Combofix on two almost identical Shuttle systems running Windows XP SP2.
After combofix did its scan, and did a reboot both machines failed to boot.
When i try to boot into safe mode / safe mode command line, one of them goes into a booting loop when loading gagp30kx.sys. The other blue screens when loading gagp30kx.sys with a 07b error.
Both machines were working fine before i ran combofix on both.

I tried going into the recovery console using the Windows XP CD, but when i try to run c:\windows\system32\restore\rstrui.exe i get a "Command is not recognized" error.
I guess the only way to run this is to boot into safe more from the computer itself.. unfortunately, i can't boot into safe mode because the computers either go into a loop or bluescreen.

Using the Windows XP CD and the Microsoft instructions for "How to recover from a corrupted registry that prevents Windows XP from starting" I backed up the following files in one of the computers:

c:\windows\system32\config\system, software, sam, security, default
and restored them from c:\windows\repair\.

After i did all this, the system still failed to boot into safe mode.. it would go still go into a loop!!!.
Is there a way i can do a system restore without having to boot into safe GUI mode?
Whatever combofix did to my systems there has to be a way to restoring them without having to reinstall everything!
Right now my apache server and two websites, plus another website's forum are currently down because of this..
PLEASE HELP!

This post has been edited by yj7777: 21 November 2009 - 01:34 AM

Booting from the Win XP CD-ROM and going into the recovery console, i was able to find my way into the system recovery folder and restored the system, software, sam, security, default files from a previous date to c:\windows\system32\config.

After trying to reboot into normal or safe mode, i am still getting a blue screen.. so i am not really sure what combofix did, but doing a registry recovery wasn't enough..

Hi click over to "This" forum and sopy past your post, this one, into a new top0ic over there. That's where all the people who know HJT and ComboFix stuff are.

I take it you didn't read the WARNING that said ComboFix could wipe your OS out if you toyed around with it without professional help.

If you're real lucky someone in that forum MIGHT be able to get you back up and running without having to do a destructive recovery of your operating system.

I'm just s bit curious about this statement here Boo

Quote

If that's true then what possessed you to run something like ComboFix?
Good luck Boo.

Wendy

You cannot run the System Restore GUI (rstrui.exe ) from the Recovery Console, so that is why that won't work.

You can read about gagp30kx.sys in the Bleeping Computer File Database forum (or Internet searches) and find it is video related:

Quote

It is also not part of the 5 registry files you copied over, but good effort!

I don't know why/how it is related to Combofix, but there are still some alternatives.

Since you can boot into RC, some other folks with this problem have resolved it by using Recovery Console to run:

chkdsk /r

So I would try that since you can. It may not find anything to do, but you will then know what it is not.

While in RC, navigate to c:\windows\system32\drivers and be sure that you find gagp30kx.sys.

If suspicion of malware is what prompted Combofix, maybe the file was corrupted and Combofix removed it and needs to be replaced.

If the gagp30kx.sys is missing or even suspicious, you can simply replace it from c:\windows\system32\dllcache.

You can do all of this using Recovery Console.

Yes here sometyhing like that.

Recovery same failures as here, almost every command a failure in console.

It turns out that combofix put the driver pciide.sys as pciide.sys.vir in quarantine did a replacement of that files (HD on other pc) then normal boot and back working !!!

?

This post has been edited by yesyep: 21 November 2009 - 10:20 AM

Good for you

I don't know too much about Combofix, if you have the log or can describe how you were able to figure out those were the files involved, I would like to see it/know more about it.

I wish I had a system that was not working after Combofix so I could study it!

Not to beat a dead horse, but one of the reasons it is not recommended to use ComboFix without supervision is because of these kinds of problems, as you already know. What hasn't been pointed out is that, if you had had supervision, your helper could have gotten in contact with CF's author to resolve the issue. He won't do that with people who ignore the disclaimer and run it on their own--he uses his time to make CF better.
papakid

This post has been edited by garmanma: 21 November 2009 - 10:34 AM

joseibarra, on Nov 21 2009, 10:30 AM, said:

I did a lot of pc's with combofix never had a serious issue before!

Now i don't know with the updated combofix from today it went wrong but that laptop is from a student i'm helping out with some hmm internet and reason limewire probs ( i think from that downloads anyway!)

IN combofix quarantine txt file this was the only one in quarantine.

( because almost nothing in the repairconsole was working "unknown commands" and so on. )

I only could read this txt file of the laptop disk after put/connnect (through ide/usb converter) it on a other not "important" pc with virus soft up to date.
Scan that disk but didn't found anything

Read the file of combofix, looked for same sys file in windows/system32/drivers copy this good one to that disk put the disk back in laptop.

did some extra checks on MBR and so on. ( i did that before to but wasn't working)

Now updating and checking the rest it look OK for sofar.

As some important hardware basic driver (.sys) issues here with combofix from today mabye in combofix somewhere a false positive or infected (.sys) or corrupted (.sys) files now to let combofix put them in quarantine!

Sorry for my English.

This post has been edited by yesyep: 21 November 2009 - 12:53 PM

ComboFix also did a number on my computer yesterday.

When I started ComboFix it declared that I HAD to do a MANDATORY update, which seemed a bit strange.

After the scan was completed the following file was deleted:

C:\Windows\System32\Drivers\pciide.sys

It then tried a reboot and was unsuccessful and any attempts to restart the computer were also unsuccessful. An error message kept appearing stating that the startup was prevented to avoid possible damage to the computer.

I learned that this file that was removed is a necessary system operating file and the subsequent problems were indeed caused by ComboFix!!

It occurred to me that perhaps ComboFix has been compromised in order to cause this problem or perhaps the creators of ComboFix didn't properly test this "Mandatory" update?

I had to reinstall Windows XP by hitting F12 at Startup, inserting the CD and scrolling down to the the CD option in the Boot Startup menu.

It took about 40 minutes and I had to reinstall all the XP updates (59 I believe), which included updating Internet Explorer from 6 to 7. I also had to update the Media Player, everything else on the computer appears to be unaffected by the reinstallation.

Sorry about your troubles with ComboFix. There are postings everywhere advising people not to run this without supervision.

ComboFix should not to be discussed outside the HijackThis forums and then only when requested by a HJT Team member. It is an extremely powerful tool which should only be used when instructed to do so by someone who has been properly trained. ComboFix is intended by its creator to be "used under the guidance and supervision of an expert", NOT for general public or personal use. Please read Combofix's Disclaimer. Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.


I think you can see by your own postings that there are downfalls to running the program without supervision. If you need help after running the tool, please create a new topic in our advanced malware forums. Please follow this guide. Post a DDS log to the HJT forum and a Team member will be along to help you as soon as possible.

This discussion is now closed.

rigel
BleepingComputer Furms Moderator

I will respond in more detail in your other topic, but yes, for those who ran ComboFix recently and then were unable to boot Windows properly will need to move the pciide.sys from the C:\Qoobox quarantine folder into C:\Windows\System32\drivers\ folder. Reboot and your machine will boot properly. If you have a second machine then you can copy it from another computer.

I am leaving this topic opened in case others need help performing this action.

Grinler, on 23 November 2009 - 12:00 PM, said:

^ How do you do this?

Edit: Moved topic from XP to the more appropriate forum. ~ Animal

Reika, if you have caused a problem on your PC by using Combofix without supervision you should read the advice in post 10 and start your own thread