Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Ran Combofix now have code page 1252


  • Please log in to reply
13 replies to this topic

#1 DWHarris

DWHarris

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:06:13 PM

Posted 09 August 2011 - 09:38 AM

After running Combofix my computer is set to code page 1252 which displays very weird stuff. I was able to reset it back to code page 437. However when running DOS software it still displays characters from 1252. While my computer is booting up Windows if I launch DOS software it will display 437 characters but if I launch DOS after Windows finishes booting then DOS displays 1252 characters.

I am running Windows XP Media Center Edition, Version 5.1, Service Pack 3

BC AdBot (Login to Remove)

 


#2 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:11:13 PM

Posted 10 August 2011 - 04:47 AM

Can you post a screenshot so we can get a better idea of what is happening?

#3 DWHarris

DWHarris
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:06:13 PM

Posted 10 August 2011 - 08:01 AM

On this image http://keyhut.com/chcp.jpg the top is what I get when I start a DOS app, the bottom is correct and is after I use the command CHCP 437 from the command prompt to change the code page.

Dale

#4 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:11:13 PM

Posted 10 August 2011 - 08:08 AM

Even when you download the DOS application again, have you changed settings at all on the command prompt window?

Go to Properties and then the Font tab and see if the correct fonts are listed.

#5 DWHarris

DWHarris
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:06:13 PM

Posted 10 August 2011 - 08:27 AM

I am the author of this application so I do not need to download it. I run this on several computers so I know the app is good. Plus I have many DOS apps and it happens to all of them.

I have checked the properties and they are correct. In fact when I set the font to "raster fonts" I get the correct characters, with Lucinda Console I get the weird stuff. I have had my DOS apps set to Lucinda Console for many years and this only started happening after I ran Combofix.

Dale

#6 DWHarris

DWHarris
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:06:13 PM

Posted 10 August 2011 - 08:28 AM

I am going to work now and I will not be back for 8 hours

#7 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:11:13 PM

Posted 10 August 2011 - 11:12 AM

try reimporting the Lucinda Fonts fonts from another computer and see if that fixes the issue.

#8 DWHarris

DWHarris
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:06:13 PM

Posted 17 August 2011 - 09:18 AM

I reinstalled Lucinda Console and there was no change.

Dale

#9 abauw

abauw

  • Members
  • 951 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Kebun Kelapa
  • Local time:06:13 AM

Posted 17 August 2011 - 07:16 PM

Could you tell why you using Combofix?

:guitar: Take me to a place where time is frozen
You don't have to close your eyes to dream :busy:
You can find escape inside this moment :smash:
And I will follow  :whistle:


#10 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:11:13 PM

Posted 18 August 2011 - 05:07 AM

Would you still happen to have the Combofix log available for analysis if it is required?

#11 DWHarris

DWHarris
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:06:13 PM

Posted 18 August 2011 - 12:08 PM

I had a rootkit redirect that would send my Google searches to somewhere else. I could not get rid of it with Norton, Adaware, or MalwareBytes.

Where would ComboFix save the log?

Dale

#12 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:11:13 PM

Posted 18 August 2011 - 01:06 PM

the log would be in c:\

#13 DWHarris

DWHarris
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:06:13 PM

Posted 18 August 2011 - 02:22 PM

This is what I found...

Mod edit: Combofix logs have been removed - ComboFix logs may only be analyzed in our advanced malware forums.

Thanks,
rigel
BC Moderator

Dale

Edited by rigel, 18 August 2011 - 02:36 PM.
Logs removed


#14 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,994 posts
  • ONLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:07:13 PM

Posted 18 August 2011 - 02:38 PM

Hello,

Please follow the instructions in ==>This Guide<== starting at step 6.

Once the proper logs are created, then post them in a reply to this topic by using the Add Reply button. Since you have run ComboFix, please include the ComboFix log in the new topic.

If you can produce at least some of the logs, then please create the post and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the reply and explain that you followed the Prep. Guide, include the information that you were unable to produce the other logs, include the ComboFix log, and describe what happens when you try to create the other logs.

Please note that I am not a member of the Malware Removal Team and will not be assisting you in removing the infection. I'm simply helping you to post the information they need in order to assist you.

If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.

Orange Blossom :cherry:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users