After the scan Combofix told me: ----- File Replicators ----- and a list of my documents i many different volumes. Then i searched a system restore point to undo, but surprise, Comofix does not provide a system restore point before to start, only a registry backup to use in case a pc becomes unbootable. I refer just un example, Opera web browser makes alone and silently a system restore point before install or uninstall it. This a part, I cant understand why Combofix deletes filels like "vmnat.exe" (part of Vmware), "install.exe" (part of Microsoft® Visual Studio® 2008) and the worst of all imho it is that in the "C:\Qoobox\Quarantine\Replicators" folder there is a file, I imagine it is a sort of archive of the quarantineted/replicated files. At this point I find very grave that inside the file located in "C:\Qoobox\Quarantine\Replicators\Replicator_6.txt" there is not instructions how to restore the files archived in my case into a single file w/o extension of 2 MB named using hexadecimal values. I agree that an error can happen, but I can't accept that you hide the way to repair at the error. I lost my data, time to write because it is not my first language. All that I get should be avoided simply making at first a system restore point, at second when quarantined, all files stored on a zip for instance protect by a passphrase witten into the log. Last to do should be an easy batch to restore files an folders exaclty where they where. In the wile, I woul like suggest to add the ability to use Combofix by command line switches, or if you don't like it for some reason, should be very appreciate a dialog box when double clicking on Combofix.exe that lets configure the entiere cleaning process. For instance, accept the Eula, skip the download of ms restore machine, skip if it is not updated, or skip updating. A command to clean Combofix.exe and all its tracks should be te minimum that a person ask to a cleaning tolls, do you agree?
I used the search in the forum and I get this responce ... http://www.bleepingcomputer.com/forums/ind...t&p=1026101
Another useful answer http://www.bleepingcomputer.com/forums/ind...t&p=1026186
Se you soon, Paolo
Edited by nodnolse1, 16 June 2010 - 01:51 PM.