Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Using Combofix for non Virus issues


  • This topic is locked This topic is locked
7 replies to this topic

#1 ayeshash

ayeshash

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Mumbai -INDIA
  • Local time:01:45 AM

Posted 02 March 2013 - 07:44 AM

Hello, this post is unusual in that I used Combofix to tackle a non virus/malware related issue.After downloading and installing Nokia Suite on my Windows 7 64bit machine from

 

http://www.nokia.com/in-en/support/product/nokia-suite/?cid=ncomprod-fw-src-na-nokiayo_0x0-nokiasuite-google-in-en-1todtmte17a54&gclid=CL37rbmD3rUCFcUt6wod-D0AiQ

 

I kept on having windows explorer opening to "My Computer" at every reboot. Extensively Googling and looking at solns, I finally came upon a post where the writer said that he had run Combofix on his computer and though he did not understand how or why the problem dissapeared.

 

I did the same keeping the page from

 

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

 

open on another computer while running it on the affected one.

 

The problem was solved in that, the Windows Explorer opening on startup stopped. Everything else seemed to be working fine, so I went thru with the uninstall process.

 

File attached, log file.

 

Only much later I noticed that all my restore points created in the last 2 days at least 20 or so had all dissappeared , and the first one showing was the one combofix made just before installing.

 

The settings for Creating Restore Points was not in error, I had assigned about 10% of my new 1Tb hard disk for this. All other settings were ok. Just in case you are wonddering why I was creating so many restore points..... I was setting up a new Lenovo Z580 1Tb, 8gGb memory, 2Gb graphics machine. With every program installation before and after i would create a restore point in case the installation created a problem and would not go away after uninstall. The last program I installed was tha Nokia Suite as I knew it was giving the issue mentioned above. After that I only ran Combofix.

 

As the machine is running fine, I perhaps dont need the resore points lost, but I though you should know of Combofix's behavoiur nevertheless !!! Any idea how I could find and re-enstate the missing restore points

 

Thanks

 

AyeshaAttached File  ComboFix.txt   38.35KB   3 downloads

 



BC AdBot (Login to Remove)

 


#2 1972vet

1972vet

  • Malware Response Team
  • 1,698 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midwest U.S.A.
  • Local time:03:15 PM

Posted 04 March 2013 - 03:41 PM

Greetings ayeshash and Welcome to the Forums,

 

You discovered, albeit with some lamentation, what we (trained users of combofix) have known all along. Combofix, as it is uninstalled, will remove your old restore points. One point of reasoning that sUBs used when deciding to write this into it's behavior, is the fact that many types of malicious code can imbed themselves into your system's restore points and respawn when activating any of them. Now, it would seem to me that you could use the restore point that combofix made, and restore the system to it's condition prior to running combofix...however, in so doing, you will likely restore the very issue that you said combofix resolved for you.

 

Tell us please...is it critical that you recover those deleted restore points that you made?


Disabled Veteran, U.S.C.G. 1972 - 1978
mvpsigpic.jpg
2009 - 2013

Member: U.N.I.T.E.
Performance and Maintenance for Windows XP, Windows Vista and Windows Seven


#3 ayeshash

ayeshash
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Mumbai -INDIA
  • Local time:01:45 AM

Posted 05 March 2013 - 01:12 AM

Attached File  CombofixReport.txt   38.35KB   3 downloadsAttached File  CombofixReport.txt   38.35KB   3 downloads

Greetings ayeshash and Welcome to the Forums,

 

You discovered, albeit with some lamentation, what we (trained users of combofix) have known all along. Combofix, as it is uninstalled, will remove your old restore points. One point of reasoning that sUBs used when deciding to write this into it's behavior, is the fact that many types of malicious code can imbed themselves into your system's restore points and respawn when activating any of them. Now, it would seem to me that you could use the restore point that combofix made, and restore the system to it's condition prior to running combofix...however, in so doing, you will likely restore the very issue that you said combofix resolved for you.

 

Tell us please...is it critical that you recover those deleted restore points that you made?

 

Hello Forum Member, and thank you for your reply.

 

Pursuant to my message above there were other  developements !! The Computer was behaving a bit quirkly after the Combofix uninstall, but it did not seem major th me. Anyway I did not install any more programs for a few hours. Ultimately the Computer simply refused to reboot at all and all repair options offered by the system and which are inbuilt did not work. Also as I had no file/image backup finally I opted for system restore and chose the first point which was the combofix created point. After System restore was finished, and rebooted the computer seemed ok !!! and what was more suprising to me was the problem which I was having ie that of Windows Explorer opening up on reboot to My Computer, which started on the last SW installation(Nokia Suite) before I used Combofix was not occuring.

 

I would still be happy to restore to the one restore point prior to this which I created just before installing the Nokia Suite as I feel more safe with it. If The problem then reccurs again after I install the Nokia Suite I would have to takle it some other way, not thru a Virus/Malware Solution like Combofix !!!!. I had about 20 resore points including one just before i installed combofix, and post Nokia Suite install, both those I expect would restore the system but also the problem. I am more curious as to why the problem of windows explore box opening on startup/reboot did not come up after syestem restore to the restore point created by combofix.

This-- ie having a problem of windows explorer opening after certain installations is not uncommon. In my case it was occuring occuring after 2 installations 1) After an HP printer SW updater installation which i ultimatey uninstalled and chose not to install again and after the Nokis Suite installation which I chose not to uninstall.

 

Anyhelp you can give me regarding the missing restore points is welcome. Also I dont think I was having a virus/malware issue when combofix installed, as I had McAfee running from the beggining,on this new computer. Attached again for your ready use is the Combofix created log

 

Regards

Ayesha

 

 

 



#4 ayeshash

ayeshash
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Mumbai -INDIA
  • Local time:01:45 AM

Posted 05 March 2013 - 01:13 AM

Hello Forum Member, and thank you for your reply.

 

Pursuant to my message above there were other developements !! The Computer was behaving a bit quirkly after the Combofix uninstall, but it did not seem major th me. Anyway I did not install any more programs for a few hours. Ultimately the Computer simply refused to reboot at all and all repair options offered by the system and which are inbuilt did not work. Also as I had no file/image backup finally I opted for system restore and chose the first point which was the combofix created point. After System restore was finished, and rebooted the computer seemed ok !!! and what was more suprising to me was the problem which I was having ie that of Windows Explorer opening up on reboot to My Computer, which started on the last SW installation(Nokia Suite) before I used Combofix was not occuring.

 

I would still be happy to restore to the one restore point prior to this which I created just before installing the Nokia Suite as I feel more safe with it. If The problem then reccurs again after I install the Nokia Suite I would have to takle it some other way, not thru a Virus/Malware Solution like Combofix !!!!. I had about 20 resore points including one just before i installed combofix, and post Nokia Suite install, both those I expect would restore the system but also the problem. I am more curious as to why the problem of windows explore box opening on startup/reboot did not come up after syestem restore to the restore point created by combofix.

This-- ie having a problem of windows explorer opening after certain installations is not uncommon. In my case it was occuring occuring after 2 installations 1) After an HP printer SW updater installation which i ultimatey uninstalled and chose not to install again and after the Nokis Suite installation which I chose not to uninstall.

 

Anyhelp you can give me regarding the missing restore points is welcome. Also I dont think I was having a virus/malware issue when combofix installed, as I had McAfee running from the beggining,on this new computer. Attached again for your ready use is the Combofix created log

 

Regards

Ayesha



#5 1972vet

1972vet

  • Malware Response Team
  • 1,698 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midwest U.S.A.
  • Local time:03:15 PM

Posted 05 March 2013 - 10:19 AM

Hello Forum Member, and thank you for your reply.

 

Pursuant to my message above there were other developements !! The Computer was behaving a bit quirkly after the Combofix uninstall, but it did not seem major th me. Anyway I did not install any more programs for a few hours. Ultimately the Computer simply refused to reboot at all and all repair options offered by the system and which are inbuilt did not work. Also as I had no file/image backup finally I opted for system restore and chose the first point which was the combofix created point. After System restore was finished, and rebooted the computer seemed ok !!! and what was more suprising to me was the problem which I was having ie that of Windows Explorer opening up on reboot to My Computer, which started on the last SW installation(Nokia Suite) before I used Combofix was not occuring.

 

I would still be happy to restore to the one restore point prior to this which I created just before installing the Nokia Suite as I feel more safe with it. If The problem then reccurs again after I install the Nokia Suite I would have to takle it some other way, not thru a Virus/Malware Solution like Combofix !!!!. I had about 20 resore points including one just before i installed combofix, and post Nokia Suite install, both those I expect would restore the system but also the problem. I am more curious as to why the problem of windows explore box opening on startup/reboot did not come up after syestem restore to the restore point created by combofix.

This-- ie having a problem of windows explorer opening after certain installations is not uncommon. In my case it was occuring occuring after 2 installations 1) After an HP printer SW updater installation which i ultimatey uninstalled and chose not to install again and after the Nokis Suite installation which I chose not to uninstall.

 

Anyhelp you can give me regarding the missing restore points is welcome. Also I dont think I was having a virus/malware issue when combofix installed, as I had McAfee running from the beggining,on this new computer. Attached again for your ready use is the Combofix created log

 

Regards

Ayesha

Regardless of McAfee running, you did in fact have a malicious tool bar that combofix removed. Microsoft considers Alexa's tool bar to be malware, and as such, it won't even install to Windows Vista. If you are no longer having issues relating to malware on the system, then I think we can archive this thread. Please remember that the developer of combofix plainly states that the tool should NOT be used by inexperienced users...rather, they should be guided by trained support folks, such as what is available to members of these various help forums.

 

As to the missing restore points, from your description, they appear to have been deleted. Creating a new restore point for each piece of software you install isn't necessary but if you insist, simply uninstall the software that you created the restore points for...and after having uninstalled ALL the software, then you could start over and begin re-installing each piece and creating your restore points after each one. I'd like to say though, that I personally don't recommend that you do that, but you have said that is what you had, and seem adamant about having them available so...that is one way you could approach it to put things back as they were before you used combofix.

 

Are you having any issues now since you've restored the system yet again?


Disabled Veteran, U.S.C.G. 1972 - 1978
mvpsigpic.jpg
2009 - 2013

Member: U.N.I.T.E.
Performance and Maintenance for Windows XP, Windows Vista and Windows Seven


#6 ayeshash

ayeshash
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Mumbai -INDIA
  • Local time:01:45 AM

Posted 05 March 2013 - 01:00 PM

Hello Forum Member, and thank you for your reply.

 

Pursuant to my message above there were other developements !! The Computer was behaving a bit quirkly after the Combofix uninstall, but it did not seem major th me. Anyway I did not install any more programs for a few hours. Ultimately the Computer simply refused to reboot at all and all repair options offered by the system and which are inbuilt did not work. Also as I had no file/image backup finally I opted for system restore and chose the first point which was the combofix created point. After System restore was finished, and rebooted the computer seemed ok !!! and what was more suprising to me was the problem which I was having ie that of Windows Explorer opening up on reboot to My Computer, which started on the last SW installation(Nokia Suite) before I used Combofix was not occuring.

 

I would still be happy to restore to the one restore point prior to this which I created just before installing the Nokia Suite as I feel more safe with it. If The problem then reccurs again after I install the Nokia Suite I would have to takle it some other way, not thru a Virus/Malware Solution like Combofix !!!!. I had about 20 resore points including one just before i installed combofix, and post Nokia Suite install, both those I expect would restore the system but also the problem. I am more curious as to why the problem of windows explore box opening on startup/reboot did not come up after syestem restore to the restore point created by combofix.

This-- ie having a problem of windows explorer opening after certain installations is not uncommon. In my case it was occuring occuring after 2 installations 1) After an HP printer SW updater installation which i ultimatey uninstalled and chose not to install again and after the Nokis Suite installation which I chose not to uninstall.

 

Anyhelp you can give me regarding the missing restore points is welcome. Also I dont think I was having a virus/malware issue when combofix installed, as I had McAfee running from the beggining,on this new computer. Attached again for your ready use is the Combofix created log

 

Regards

Ayesha

Regardless of McAfee running, you did in fact have a malicious tool bar that combofix removed. Microsoft considers Alexa's tool bar to be malware, and as such, it won't even install to Windows Vista. If you are no longer having issues relating to malware on the system, then I think we can archive this thread. Please remember that the developer of combofix plainly states that the tool should NOT be used by inexperienced users...rather, they should be guided by trained support folks, such as what is available to members of these various help forums.

 

As to the missing restore points, from your description, they appear to have been deleted. Creating a new restore point for each piece of software you install isn't necessary but if you insist, simply uninstall the software that you created the restore points for...and after having uninstalled ALL the software, then you could start over and begin re-installing each piece and creating your restore points after each one. I'd like to say though, that I personally don't recommend that you do that, but you have said that is what you had, and seem adamant about having them available so...that is one way you could approach it to put things back as they were before you used combofix.

 

Are you having any issues now since you've restored the system yet again?

Hello 1972vet

Thanks so much for your reply. No I am not having any serious issues after restoring to the Combofix created restore point.

Would you have any idea why the problem of having Windows explorer opening on startup/rebooting dissapeared when I restored to the Combofix created restore point, at the time of creation, which was before Combofix ran, the issue was very much there. Or is it the case that Combofix has not quite restored to that point ??

Regarding the missing restore points, I suppose we could drop the issue now. Just out of academic interest is it at all possible to restore some or all of them, albeit with some dificulty ??

Thanks

Ayesha



#7 1972vet

1972vet

  • Malware Response Team
  • 1,698 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midwest U.S.A.
  • Local time:03:15 PM

Posted 05 March 2013 - 02:50 PM

If the restore points are deleted, they are no longer available so it would be impossible to recover them. Anything else we can help with?


Disabled Veteran, U.S.C.G. 1972 - 1978
mvpsigpic.jpg
2009 - 2013

Member: U.N.I.T.E.
Performance and Maintenance for Windows XP, Windows Vista and Windows Seven


#8 1972vet

1972vet

  • Malware Response Team
  • 1,698 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midwest U.S.A.
  • Local time:03:15 PM

Posted 08 March 2013 - 06:38 AM

This issue appears to be resolved as the member has restored the system, and for the lack of response, the thread is closed to prevent others from posting here. Other members who need assistance please start your own topic in a new thread. Thanks!

The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.


Disabled Veteran, U.S.C.G. 1972 - 1978
mvpsigpic.jpg
2009 - 2013

Member: U.N.I.T.E.
Performance and Maintenance for Windows XP, Windows Vista and Windows Seven





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users