Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

ComboFix - Taking a very long time...


  • Please log in to reply
3 replies to this topic

#1 GriffMG

GriffMG

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:08:15 PM

Posted 04 May 2016 - 11:02 AM

I have a virus of some kind - think it is in my IP stack - invisible copies of notepad, srvhost, presentationhost, cmd all running in task manager, CPU goes to 100%.

 

Trying to scan with ComboFix now, for the last five hours in fact, it seems to have stopped at the bit where it tells me that it will take 10 minutes or maybe 20.

 

The hard drive is going like the clappers, so I am reluctant to stop, but there comes a point - doesn't there?

 

Should I stop it and restart with the NOMBR option?

 

 



BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,399 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:03:15 PM

Posted 05 May 2016 - 05:49 AM

As a general policy, Bleeping Computer does not offer advice on how to run ComboFix unless we asked someone to run it or if there is a problem with the computer caused by running the tool. We recommend that people should not be using ComboFix without being advised to do so by a trained expert (see here) who is assisting them deal with a malware problem. When issues arise due to complex malware infections, problems running ComboFix (i.e. stalling, hanging, crashing) or with other security tools causing conflicts, experts are usually aware of them and can advise what should or should not be done while providing individual assistance.

With that said, there are circumstances ComboFix will hang, crash or stall at various stages due to malware interference, failure to disable other real-time protection tools or the presence of CD Emulators (Daemon Tools, Alchohol 120%, Astroburn, AnyDVD) so that it does not complete successfully. Also, depending on how badly a system is infected, ComboFix may take longer to complete its routine than it normally does or fail to run properly. While that is not normal behavior, it is not unusual. In such cases, it is helpful to know at what stage ComboFix stalled/crashed and to provide that information to the Helper who is assisting you so they can investigate. Using Task Manager to stop ComboFix's related process usually is enough to abort it.

Open Task Manager and look for the following ComboFix related processes (some have a .3XE extension):
  • PEV.exe
  • NirCmd.3XE
  • PEV.3XE
  • SED
  • GREP
  • any file that has the extension *.3XE except CF*****.3XE <- do not end this process
One at a time, right-click and select End Process. If doing that did not free ComboFix and allow it to continue, then you will need to reboot the computer manually.

Afterwards, please do NOT run ComboFix again unless asked to do so by a member of the Malware Removal Team.

If you need further assistance with a malware infection, please follow the instructions in the Malware Removal and Log Section Preparation Guide starting at Step 6.
  • If you cannot complete a step, then skip it and continue with the next.
  • In Step 6 there are instructions for downloading and running FRST which will create two logs.
When you have done that, post your logs in the Virus, Trojan, Spyware, and Malware Removal Logs forum, NOT here, for assistance by the Malware Response Team.

Start a new topic, give it a relevant title and post your log(s) along with a brief description of your problem, a summary of any anti-malware tools you have used and a summary of any steps that you have performed on your own. If you cannot produce any of the required logs...start the new topic anyway. Explain that you followed the Prep. Guide, were unable to create the logs, and describe what happened when you tried to create them. A member of the Malware Removal Team will walk you through, step by step, on how to clean your computer.

After doing that, please reply back in this thread with a link to the new topic so we can close this one.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 GriffMG

GriffMG
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:08:15 PM

Posted 06 May 2016 - 03:03 AM

Thank you.

 

 

I managed to get the ComboFix to finish, it was stuck on a folder that was being 'held' by the virus.

Ultimately I used SpyHunter4 to rid the laptop of the virus, which it did well.

 

They (SpyHunter 4) did add a recurring 'subscription' to my order, which I would not have known about until

they acted on it - if I hadn't seen an article on here about them, so thank you for that as well.

 

Martin


Edited by GriffMG, 06 May 2016 - 03:03 AM.


#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,399 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:03:15 PM

Posted 06 May 2016 - 07:04 AM

You're welcome.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users