Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I ran combofix now all my documents, pictures and songs are gone please help


  • This topic is locked This topic is locked
5 replies to this topic

#1 assistanceplease

assistanceplease

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:03:53 PM

Posted 02 December 2015 - 12:49 PM

I ran combofix now all my documents, pictures and songs are gone please help.

Attached are the combofix and srft logs. 

I have booted to safe mode and still don't see my files. 

Any assistance is greatly appreciated.

 

thank you.

Attached Files



BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 40,532 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:53 PM

Posted 03 December 2015 - 09:53 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===


If you did not remove Combox or it's folders the file may still be quarantined.

ComboFix-quarantined-files.txt 2015-12-01 20:51


1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:
 

DeQuarantine::
C:\Qoobox\Quarantine\C\Documents and Settings
C:\Qoobox\Quarantine\C\WINDOWS\system32\config\systemprofile
Quit::



Save this as CFScript.txt, in the same location as ComboFix.exe

CFScriptB-4.gif

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at DeQuarantine_log.txt which I will require in your next reply.

Enable your Anti virus and malware programs.
===

If the files are restored I suggest your execute the Farbar tool one more time.
This time make sure that the checkbox "Create Addition.txt file" is checked.
This will create a new Addition.txt that you should attach.

Let me know what problem persists now that the files have been dequarantined.

#3 assistanceplease

assistanceplease
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:03:53 PM

Posted 03 December 2015 - 12:01 PM

Hi Nasdaq,

 

thank you for your help. I did the following:

I closed the browsers, disbaled AV, created that txt file and saved it as CF Script.txt 

The combo.exe was gone from where i downloaded it. I did locate it under C:\Qoobox\Quarantine\C\users\jenni\downloads I removed the .vir and saved the cf script.txt to that same folder location. I draged it ontop of the combofix.exe and let it run. Attached is the log. I now have the folders back under user for pictures my docs and such but they are still empty.

 

Thank you again for your assistance.

 



#4 assistanceplease

assistanceplease
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:03:53 PM

Posted 03 December 2015 - 12:01 PM

Hi Nasdaq,

 

thank you for your help. I did the following:

I closed the browsers, disbaled AV, created that txt file and saved it as CF Script.txt 

The combo.exe was gone from where i downloaded it. I did locate it under C:\Qoobox\Quarantine\C\users\jenni\downloads I removed the .vir and saved the cf script.txt to that same folder location. I draged it ontop of the combofix.exe and let it run. Attached is the log. I now have the folders back under user for pictures my docs and such but they are still empty.

 

Thank you again for your assistance.

 

Attached Files

  • Attached File  log.txt   14.69KB   3 downloads


#5 nasdaq

nasdaq

  • Malware Response Team
  • 40,532 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:53 PM

Posted 04 December 2015 - 08:48 AM

At the outset you executed the Combofix on your own.

The files that were quarantined had their extension changed to .vir

I did not ask you to change them. You did it on your own.

If the file are still in the quarantine folder rename the files with the the .vir extension as they were before.

Reinstall Combofix in the same folder you place the tool originally. < Important.

Run the Combofix as I have suggested in post no 2 with the script.

If that fails to restore you files, I'm sorry but there is nothing else I can do.

#6 nasdaq

nasdaq

  • Malware Response Team
  • 40,532 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:53 PM

Posted 10 December 2015 - 09:39 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users