Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Combofix uninstall


  • Please log in to reply
7 replies to this topic

#1 Plocploc

Plocploc

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:11:26 AM

Posted 19 March 2012 - 04:40 PM

Hi everybody,

Well firstly, ok, I admit I misused combofix and deserve a good whip. Still, I'd need your help..
One week ago I was diagnosed some trojans, and was instructed to use Combofix to eradicate it. But I misread the instructions and copied the combofix.exe on c:\ instead of my desktop. Plus when I ran it in safe mode, although I did nothing and let it work, CF would stall/freeze (not reaching even step #1). I let it work overnight but at the morning it was still at the same step, displaying "blablabla could take 10minutes or longer if severerly infected" and doing nothing else.. So I reset the PC, and tried again, unsuccessfully. Finally I gave up and used other tools to clean up the threats. Now my pc is kinda cleared but I noticed those strange recursive folders, that do have the icon of My Computer, and display the whole contents of my C:\
Well I read everywhere people had to type in combofix /uninstall to fix it. But that was meant for people who had CF on the desktop. As I said, I ran it from c:\ and so far, couldn't find a way to remove those CF recursive folders.
So I'm asking for your help. Thank you in advance, and sorry for my bad English.

BC AdBot (Login to Remove)

 


#2 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,316 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:01:26 PM

Posted 20 March 2012 - 02:14 AM

The simplest solution is to navigate to combofix.exe, right click it and select Rename. Rename the file to uninstall.exe and run it like that.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#3 Plocploc

Plocploc
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:11:26 AM

Posted 20 March 2012 - 06:11 AM

Hello,

Actually I tried that already, renaming into uninstall.exe and running it. But the CF recursive folder is still here.

#4 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,316 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:01:26 PM

Posted 20 March 2012 - 06:23 AM

Did you get a message that combofix was uninstalled successfully to confirm the uninstall was complete?

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#5 Plocploc

Plocploc
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:11:26 AM

Posted 20 March 2012 - 07:13 AM

Yes I did. To give more details, here's what happened.
Some days ago, I downloaded combofix and renamed it into c:\cfx.exe as requested by instructors
I ran it and it stalled. After resetting the PC, I found a recursive folder named cfx at c:\
I was told in order to uninstall it, I had to rename combofix into the exact name of the folder. So I did it, and when I typed cfx /uninstall, I could quickly see the program launching and making a folder called like cfx1234, then display "Combofix successfully uninstalled" and then saw both folder cfx1234 and cfx.exe disappeart. But the old cfx folder was still there.
Then I tried rename into uninstall.exe and ran it twice, one time from desktop, second time from c:\
Same thing at both attempts. I saw the program create a folder called uninstallxxxx (x = random letters and numbers), display "Combofix has been successfully uninstalled", then the uninstallxxxx folder and uninstall.exe disappear. So I assumed it cleared the folder it made, indeed, but didn't uninstall the folders that were previously made by its predecessors.

#6 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,316 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:01:26 PM

Posted 20 March 2012 - 09:15 AM

renamed it into c:\cfx.exe as requested by instructors

Where was this requested?

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#7 Plocploc

Plocploc
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:11:26 AM

Posted 20 March 2012 - 11:30 AM

Oh I mean by people on another (French) forum, not this one. I guess eachh forum experts have their own methods

#8 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,316 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:01:26 PM

Posted 20 March 2012 - 12:50 PM

If they recommended you to run combofix, then it really would be the best to get back to them with the issues combofix caused. :)

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users