Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

ComboFix Deleted Everything


  • This topic is locked This topic is locked
4 replies to this topic

#1 y2roby

y2roby

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:07:32 AM

Posted 24 January 2010 - 08:43 PM

Hello, this is my second post and my first new topic. Per the suggestion of "OrangeBlossom" in a similar thread in another forum, i'm starting a topic of my own here.

A couple of days ago I began to notice virus issues. Symantec and SuperAntispyware(Free Edition) appeared to get rid of everything except that virus that redirects google searches. Also, I kept getting an alert when logging in that said symantec was turned off, even though it appeared to be on so i'm not sure if that was related to the viruses or not. The alert would go away if I right-clicked on the tray icon and actually shut autoprotect off, and then turned it back on. I couldn't for the life of me get rid of that google redirect virus though, despite multiple scans from symantec and SuperAntispyware.

So now we come to the embarrassing part. I used ComboFix, because I thought that I would be ok by looking at other topics on the subject. Mea Culpa.

ComboFix took a long time to run, at least given what I had read about it. When it was finally done and rebooted the computer, all of my files appeared to be gone. There are no programs listed in the 'Start', 'All Programs' tab apart from 'Startup'. I can't see any of my documents or pictures. Thanks to Robert717's thread in the Antivirus, Firewall, and Privacy Products and Protection Methods forum, I learned that my files and programs are in fact not deleted, but quarantined at the location C:\Qoobox

I did the start, run thing for "C:\Qoobox" and a folder comes up, within which are 2 folders named "BackEnv" and "Quarantine" and 3 files named "Add-Remove Programs.txt", "ComboFix-quarantined-files.txt", and "SnapShot@2010-01-24_23.44.18.dat". Just for the heck of it, I tried to see if the files that had been in "MyDocuments" were still there, and saw that they were under "C:\Qoobox\Quarantine\C\Documents and Settings\[My User Account Name]\My Documents." However, everything ends in ".vir" and I am afraid to try to open any of it since the icons for Word, Excel, or whatever other programs created them aren't appearing.

I attempted to attach the ComboFix log file instead of pasting it, since it is extremely long, but the upload failed and I got the message "the file was larger than the available space". If you want me to still paste it, I will. Any help is greatly appreciated, and again I'm sorry I didn't do this before running ComboFix sad.gif

Edited by y2roby, 24 January 2010 - 09:57 PM.


BC AdBot (Login to Remove)

 


#2 y2roby

y2roby
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:07:32 AM

Posted 24 January 2010 - 09:02 PM

Oh, and I just tried to edit the first post and paste the log, but the screen froze, apparently because of the size of the log file?

#3 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:32 AM

Posted 25 January 2010 - 01:24 PM

Hi,

Please refer to this page on running the de-quarantine tool (CFDQ-UsrPrf.exe): http://www.bleepingcomputer.com/forums/t/290138/combofix-problems-and-resolution-for-legitimate-files-being-deleted/

If you have any problems, please report back here letting us know.

Thanks.

With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#4 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:32 AM

Posted 28 January 2010 - 01:06 PM

Hello.

Are you still there?

If you are please follow the instructions in my previous post.

If you still need help, follow the instructions I have given in my response. If you have since had your problem solved, we would appreciate you letting us know so we can close the topic.

Please reply back telling us so. If you don't reply within 5-7 from the last day I replied initially, the topic will need to be closed.

Thanks for understanding.

With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#5 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:32 AM

Posted 31 January 2010 - 03:01 PM

Hello.

Due to Lack of feedback, this topic is now Closed

If you need this topic reopened, please Send Me a Message. In your message please include the address of this thread in your request.
This applies only to the original topic starter.

Everyone else please start a new topic.

With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users