Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Likely Rootkit Infection


  • This topic is locked This topic is locked
127 replies to this topic

#16 countrysquire

countrysquire
  • Topic Starter

  • Members
  • 79 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 20 November 2011 - 12:56 PM

OK, I'll leave it running and let you know as soon as it finishes or gives me another message.

Thanks again for your help with this Myrti, it has been invaluable.

Bobby

BC AdBot (Login to Remove)

 


#17 countrysquire

countrysquire
  • Topic Starter

  • Members
  • 79 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 20 November 2011 - 01:31 PM

Still no action and I just realized that the clock has not changed time since I confirmed the pop-up on combofix. Should I reboot?

#18 countrysquire

countrysquire
  • Topic Starter

  • Members
  • 79 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 20 November 2011 - 02:20 PM

It was locked up so I had to reboot. Several suspicious programs show up in the processes tab of the task manager. Rebooting to try again, this time in safe mode without networking.

Edited by countrysquire, 20 November 2011 - 02:21 PM.


#19 countrysquire

countrysquire
  • Topic Starter

  • Members
  • 79 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 20 November 2011 - 02:41 PM

Running Combofix again, and it took it a long time to start, like the first time. The clock is locked up again. Not sure if this is normal while combofix is running.

#20 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:04:16 AM

Posted 20 November 2011 - 07:42 PM

Hi,

if this doesn't work try running combofix, by going to Start and select Run As.... In the window that opens type: combofix /nombr.

Let me know if this works better than the previous runs.

regards myrti

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#21 countrysquire

countrysquire
  • Topic Starter

  • Members
  • 79 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 20 November 2011 - 07:47 PM

OK, I will reboot and try that. It has been running for four hours but might be stuck as the clock hasn't changed in four hours and you cannot select anything with the cursor.

#22 countrysquire

countrysquire
  • Topic Starter

  • Members
  • 79 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 20 November 2011 - 07:53 PM

Doesnt work. Says windows cannot find 'combofix'.

#23 countrysquire

countrysquire
  • Topic Starter

  • Members
  • 79 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 20 November 2011 - 07:55 PM

OK, working now, had to include full path in the Run window.

#24 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:04:16 AM

Posted 20 November 2011 - 07:56 PM

Hi,

ok try this command instead (assuming you saved combofix onto your desktop and it is now called fun.com): "%userprofile%\Desktop\fun.com" /nombr.

regards myrti

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#25 countrysquire

countrysquire
  • Topic Starter

  • Members
  • 79 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 20 November 2011 - 07:57 PM

OK Myrti, I'll try that. Thanks.

#26 countrysquire

countrysquire
  • Topic Starter

  • Members
  • 79 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 20 November 2011 - 08:07 PM

OK, got a message that I haven't seen before:

Current Date is 2011-11-20. Combofix has expired
Click 'Yes' to run in REDUCED FUNCTIONALITY mode
Click 'No' to exit

What should I select?

Edited by countrysquire, 20 November 2011 - 08:16 PM.


#27 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:04:16 AM

Posted 20 November 2011 - 08:31 PM

Hi,

that's odd. You should have a newer version of ComboFix. Which link did you use for downloading? If you chose the first, could you try the second one instead and download a fresh copy to run.

regards myrti

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#28 countrysquire

countrysquire
  • Topic Starter

  • Members
  • 79 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 20 November 2011 - 08:34 PM

I used the second link (the first was in Spanish). I uninstalled it and will try downloading it again.

#29 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:04:16 AM

Posted 20 November 2011 - 08:38 PM

Hi,

the english link should be up to date. Is that the one you just downloaded and ran? Please download and try again. :)

regards myrti

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#30 countrysquire

countrysquire
  • Topic Starter

  • Members
  • 79 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 20 November 2011 - 08:40 PM

OK, downloaded again from bleepingcomputer.com. Running now.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users