Posted 22 March 2011 - 06:30 PM
Hello Bleepingcomputer team! I have a stubborn trojan or virus in my computer running Vista Professional 32 bit. I suspected something was amiss because suddenly the computer would become slow, and as I connected to the internet, it seemed very active. I have Comodo Free Firewall installed and updated, Avira Personal Free (updated) and Spyshelter. Since no normal scan showed anything, I decided (I know, against your suggestions) to run Combofix. I did this because I've already used it several times before successfully to clean my PCs and other people's PC. Yet I am glad I did, because here's the funny thing: I forgot to turn off Spyshelter. This means that I disabled the firewall and Avira as Combofix usage suggests, but luckily I forgot to turn off Spyshelter. As I started Combofix, immediately a warning came from Spyshelter notifying me that an application called NirCmd.cfxee with a parent process called CF24160.cfxxe was trying to do something. I denied it and it tried again several times, after that, a file called PEV.cfxxe was brought to my attention, again from Spyshelter saying it was trying to do something. It goes on like this, and several files with the same cfxxe extension do their job. One is called catchme, another one is called rmbr.cfxee, and the last one that appears in the process is REGT.cfxee. The interesting thing is that if I turn off spyshelter, and run combofix, it runs smoothly as if nothing was there. This virus has the ability to hide itself from Combofix. I wanted your help, because I don't know how to tackle this stubborn virus. It's still there. I am no stranger to reinstallation and have my data backed up, but this virus or trojan seems to spread in USBs and the like, so I wanted your advise to really clean my PC, and to know how to face this threat in case it comes up again. I'm sorry for the verbosity, but I felt it was needed. Thanks again in advance for your time, patience and help.
Edit: Moved topic from Vista to the more appropriate forum, due to the subject matter relating to ComboFix as identified by staff. ~ Animal