Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Missed warning and ran combofix on my own - now what?


  • This topic is locked This topic is locked
6 replies to this topic

#1 bluewaterbob

bluewaterbob

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:00 AM

Posted 05 September 2011 - 12:12 AM

I have a 64-bit, Windows 7 HP laptop. Late, late last night after running many virus and spyware programs I gave Combofix a try. I did see the warning or requesting a helper first, but I've done so much of this that I thought I could let it run then get help if I needed it. Yes, I was wrong and should have got help first.

I fell asleep waiting for it, but it seems to have completed, rebooted, and lists a log file in Notepad, mentioning at the end of the log that a quarantine file was created.

Every program icon is giving me a Marked for deletion message and not opening, so I don't know what to do. I rely on the laptop to make my living as a web developer, and work has been so slow that downtime like this really hurts.

I don't know if there is a way to reverse what Combofix did and start over, or what should be done? I didn't read about the other programs that should possibly be run first, until today. I'm accessing the internet now with my son's PC.

I can tell you that prior to Combofix I ran Shopzilla, but didn't pay to have it fix the 49 problems it found (just don't have the $40! - times are that tough!) I did run Spy Bot Search and Destroy, then Adaware, then Virusfighter with Spywarefighter. Each found a few things but didn't appear to be a large count like Shopzilla's list of 49 items.

However, the reason I started all this is because a searchdiscovered.com browser redirect was hijacking IE, Firefox, and Chrome, and it was still happening despite running the above. So late, late last night out of desperation at not being able to get to my customer's website to install his shopping cart, I ran combofix on my own and now I'm stuck. I realize I shouldn't do anything else to mess things up further, and after seeing other posts with trouble booting up, I'm leaving the laptop on with hybernate/sleep mode turned off.

Can anyone help me? At this point I would borrow the $40 to use Stopzilla, but would love a free fix if someone out there can figure this out.

I'm really surprised searchdiscovered.com, that lists a mailing address in the USA (Wilmington Delaware) can continue to get away with such malicious behavior without being blacklisted from the internet.

BC AdBot (Login to Remove)

 


#2 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:05:00 AM

Posted 05 September 2011 - 12:16 AM

You can request assistance via follow this post.

Please follow the instructions in ==>Malware Removal and Log Section Preparation Guide<==.

Once the proper logs are created, then make a NEW TOPIC and post it ==>HERE<== Please include the link to this topic in your new topic and a description of your computer issues and what you have done to resolve them.

If you can produce at least some of the logs, then please create the new topic and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.

Once you have created the new topic, please reply back here with a link to the new topic.

Most importantly please be patient till you get a reply to your topic.

#3 bluewaterbob

bluewaterbob
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:00 AM

Posted 05 September 2011 - 12:53 AM

I posted the above after finding #4 on http://www.bleepingcomputer.com/forums/topic273628.html As I said above, I didn't run any other programs, like DDS, so I'll post the ComboFix log to the link you provided and wait for instruction.

#4 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:03:00 PM

Posted 05 September 2011 - 03:04 AM

I didn't run any other programs, like DDS,

Hi -
Please post a DDS or similar log for diagnosing your problem -
The experts will ask for one so they can check the programs and if any of them are infected -
Just my extra to cryptodan, that he would advise to you -

Thank You -

#5 bluewaterbob

bluewaterbob
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:00 AM

Posted 05 September 2011 - 07:21 AM

I'm unable to run DDS or anything it seems. I copied DDS to a flash drive from another PC, plugged it into the laptop, and tried to run it and again got the error message: "Illegal operation attempted on an item marked for deletion in the registry." ComboFix did this, and I need help reversing what it did, or whatever is suggested.

#6 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:05:00 AM

Posted 05 September 2011 - 11:40 AM

Did you create the new post? I requested this topic be closed because of the above link thinking it was your new topic.

#7 Animal

Animal

    Bleepin' Animinion


  • Site Admin
  • 35,302 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Where You Least Expect Me To Be
  • Local time:10:00 PM

Posted 05 September 2011 - 11:44 AM

Now that your log is properly posted, here, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the logs you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another Malware Removal Team member is already assisting you and not open the thread to respond.

To avoid confusion, I am closing this topic.

The Internet is so big, so powerful and pointless that for some people it is a complete substitute for life.
Andrew Brown (1938-1994)


A learning experience is one of those things that say, "You know that thing you just did? Don't do that." Douglas Adams (1952-2001)


"Imagination is more important than knowledge. Knowledge is limited. Imagination circles the world." Albert Einstein (1879-1955)


Follow BleepingComputer on: Facebook | Twitter | Google+




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users