Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Combofix CFScript error everytime CF updates!


  • Please log in to reply
6 replies to this topic

#1 Br0k3nLiNk

Br0k3nLiNk

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:46 AM

Posted 01 March 2011 - 05:20 AM

Hi there thought after using CF for a year or 2 now i would finally register and try to find a few things out.

Everytime i used to use CF, i could download and update the application and it would restart as expected and run through a virus scan. Recently though (say the last few months), everytime i run CF and it prompts theres a new version available i allow it to run through. I am then greeted with CF needs to restart, hit yes etc..

CF then restarts and goes through its usual AV checking procedure and eventually brings the blue command windows up stating its about to begin the scan. 3-4 seconds after i see this a message box pops up saying, "Were you trying to run CFScript? The name, CFScript appears to be incorrectly spelt". Now i havnt noticed this on any other OS apart from Windows XP, home or business regardless.

My question is WHY does this happen? It is the most frustrating thing, especially seeing as the past 30+ machines i have run virus removal on have all done the same sort of things.
Any help on why this might be happening would be appreciated, as it takes a long time to sort the issues out with CF all i want to do is remove the darn infections.

Thanks in advance for any help.

- Max


EDIT: Just working on another machine now with the same problem, was going to uninstall CF and download a new version. However, i miss spelt uninstall on the run command i typed 'combofix /unisntall' and this time CF ran without having the script error. What is going on?

Edited by Br0k3nLiNk, 01 March 2011 - 07:03 AM.


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,246 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:46 PM

Posted 01 March 2011 - 07:41 AM

ComboFix usage, Questions, Help - Look here - http://www.bleepingcomputer.com/forums/topic273628.html

This forum is devoted to XP operating system problems/situations...not malware removal tools :).

I will move this to what may be a more appropriate forum for your questions.

Louis

#3 Br0k3nLiNk

Br0k3nLiNk
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:46 AM

Posted 01 March 2011 - 07:47 AM

Hi, sorry about that wasnt sure if it were to be posted under the troublesome OS board instead of malware removal tools.

Thanks.

Edited by Br0k3nLiNk, 01 March 2011 - 09:04 AM.


#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,939 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:10:46 PM

Posted 01 March 2011 - 09:20 AM

As a general policy, Bleeping Computer does not offer advice on how to run ComboFix unless we asked someone to run it. This is because people should not be using ComboFix without being advised to do so by a trained expert (i.e. Malware Response Team) who is assisting a member deal a malware issue on that system. When issues arise due to complex malware infections, possible false detections, problems running ComboFix or with other security tools causing conflicts, experts are usually aware of them and can advise what should or should not be done while providing individual assistance. When false detections are identified, experts have access to the developer and can report them so he can investigate, confirm and make corrections. Those attempting to use ComboFix on their own do not have such information and are at risk when running the tool in an unsupervised environment.

Further, using ComboFix is only one part of the disinfection process. Preliminary scans from other tools like DDS, RSIT and GMER should be used first because they provide comprehensive logs with specific details about files, folders and registry keys which may have been modified by malware infection. Analysis of those logs allows planning an strategy for effective disinfection and a determination if using ComboFix is necessary.

If you ran or want to run ComboFix on your own just to see what it does or finds, please be aware that ComboFix was never meant to be used as a general purpose malware scanner like SuperAntispyware or Malwarebytes' Anti-Malware which scan individual drives or different folders on a computer for viruses.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 Br0k3nLiNk

Br0k3nLiNk
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:46 AM

Posted 01 March 2011 - 10:32 AM

Well its merely me wanting to know why its happening. Fair enough you dont support people who you havnt advised to use it, although it is available for anyone to use and that means people will always use it. Seemed like it was worth a try posting to see if i would be helped at all. I do work in IT myself and repair computers day in day out as well as offering support, Malware removal is a long process i know but Combofix sorts the main issues out quickly compared to other solutions. As its a nice piece of software i thought maybe even this feedback would be useful as others might have the same issues, as it does it when it restarts from updating.

Possibly its a misstype in some line of code? That is if the update process launches the new exe from a script. I dont know, its just this is an annoying thing and it would be nice to solve it.

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,939 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:10:46 PM

Posted 01 March 2011 - 11:11 AM

A CFScript Name Error should not occur unless you are trying to drag a CFScript file on top of the ComboFix executable so further investigation as to exactly what you are doing and the type of malware you are dealing with is necessary.

While our policy is not to offer advice on running ComboFix unless we asked someone to run it, we are certainly willing to help with malware disinfection. If that assistance requires running ComboFix, you will be advised what to do in order to get the tool to run properly or investigate any error messages. If you need such assistance, please read the "Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help".
  • If you cannot complete a step, then skip it and continue with the next.
  • In Step 7 there are instructions for downloading and running DDS which will create a Pseudo HJT Report as part of its log.
  • When you have done that, post your log in the Virus, Trojan, Spyware, and Malware Removal Logs forum, NOT here, for assistance by the Malware Response Team Experts.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 Br0k3nLiNk

Br0k3nLiNk
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:46 AM

Posted 02 March 2011 - 04:17 AM

Yea thanks for telling me what i already knew, if i didnt know that i wouldnt have been posting here to begin with. But oh well :thumbup2:

Today i have had my first machine in about 3/4 weeks that has run through the update and restart without erroring.

And thanks for the steps to remove virus', but i am all too firmiliar with how to do it.


EDIT: Following the one working machine, i have since had 2 with the same error. Boot the machine to safe mode, run CF and then it will prompt to update as its off my memory stick and then have the same CFScript error. Running CF with a random parameter such as 'combofix /iliketoeatmincemeat'(!?!?!) and it will run without the error, regardless of machine or OS and even if it updates as long as the parameter is there its fine.

Edited by Br0k3nLiNk, 02 March 2011 - 05:16 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users