Do not use Combofix on your own!!

[mohamedkamel]

Thanks

 

[Joshatdot]

Where do you get special training to use this app?
There aren't any options or setting or anything you can mess with when running this app, you just run it and let it do it's thing.
I use it all the time on systems that are infected, haven't had an issue in the 3-4 years I've used it.
It's usually the only thing that can fix a machine to get it to boot properly and then I can run other malware and virus apps to get rid of anything else left over.

Same here .. I've used it many times to fix many computers.

 

[darksent21]

I just use it to remove my PC's malware and Im just an average computer user..

 

[A Guy]

The point is, it may well bork your PC. Not that people have been successful using it on their own. Many, many people may read this thread. It was meant as a caution. A Guy

 

[tom982]

I just use it to remove my PC's malware and Im just an average computer user..

While you may have escaped without it kicking up a fuss this time, it's impossible to guarantee the same will happen if you choose to run it again. CF acts in kernel-mode and can therefore delete core Windows files with ease, if something goes wrong, it's likely to go very wrong. Like many other malware removal tools, they are designed for us under the supervision of a trained instructor so we can analyse the logs to see if any issues remain. If an untrained user runs CF out of the blue, it may well remove the symptoms of the malware that you have, but for all you know there could be leftover parts that are still active, at which point you would be under false pretences and would probably use the computer as if it was clean, when it may not be. A lot of the time, CF requires a custom script to complete the removal process. There are thousands (probably tens or hundreds of thousands) of malware removal threads where the helper has had to use a custom script to finish off, here's one example:

http://www.bleepingcomputer.com/forums/topic466102.html

When you run ComboFix, the disclaimer clearly says that the tool should not be run unsupervised. As stated by the author of ComboFix:

ComboFix is a very powerful tool which when improperly used may render your machine to a doorstop.


We first need to verify if there are any rootkits present and how they could affect our tools. Thus, we use preliminary scans like DDS and GMER and their logs to map our strategy for attack.

With these logs, we can determine the infections present and decide whether to deploy ComboFix.

Tom

 

[darksent21]

I get your point.. it's a bit risky.. now I can compare it to an antibiotic.. it kills bacteria.. even the good one.. same with the combo fix.. it may delete the virus.. even your core files..
in my situation where I find CF useful.. I have a cousin who watch porn every night.. and when I use my computer I suddenly notice that its already infected(trojans,worms,backdoor). I install avira, AVG and other free antivirus software.. I also install malwarebye and ccleaner.. still no luck.. I entered the darkside (ifyouknowwhatImean).. it might work because it's a full version.. but STILL no LUCK!!.. so my last resort is to reformat my computer.. but I misplace my windows 7 DVD.. and using a pirated one is a bit hassle because I paid for my OS.. and at last... someone suggest to use CF.. it's like a do or die situation... and im really really impress because it fix my computer... the end

 

[A Guy]

Good post Tom

A Guy

 

[Golden]

so my last resort is to reformat my computer.. but I misplace my windows 7 DVD.. and using a pirated one is a bit hassle because I paid for my OS..

Let me make your day, and bring you from the dark side into the light : if you have paid for your OS, then you have a Product key. All you need is a Windows 7 installation DVD, which you can create in a matter of minutes by downloading the ISO for the version you are using:
Download Windows 7 ISO (Official 32-bit and 64-bit Direct Download Links) « My Digital Life

 

[darksent21]

I didn't knew I can use other windows ISO before..
well I found mine at the attic

so if combo fix can mess up your system.. can you just repair it using your windows installation disc?

 

[F5ing]

Even a full fresh install, as long as you can download/burn that iso and boot it from UFD or optical drive, as well as having your paid for product key in your posession.

 

[Golden]

so if combo fix can mess up your system.. can you just repair it using your windows installation disc?

Yes, but I think its likely you will probably have to do a clean install.

 

[tom982]

I get your point.. it's a bit risky.. now I can compare it to an antibiotic.. it kills bacteria.. even the good one.. same with the combo fix.. it may delete the virus.. even your core files..
in my situation where I find CF useful.. I have a cousin who watch porn every night.. and when I use my computer I suddenly notice that its already infected(trojans,worms,backdoor). I install avira, AVG and other free antivirus software.. I also install malwarebye and ccleaner.. still no luck.. I entered the darkside (ifyouknowwhatImean).. it might work because it's a full version.. but STILL no LUCK!!.. so my last resort is to reformat my computer.. but I misplace my windows 7 DVD.. and using a pirated one is a bit hassle because I paid for my OS.. and at last... someone suggest to use CF.. it's like a do or die situation... and im really really impress because it fix my computer... the end

I know it can seem very tempting to run what seems to be an automated malware removal program, especially when you're pulling your hair out trying to get to the bottom of a problem. At the end of the day it's your choice, but I just wanted to point out the risks anyway

Just remember, there's plenty of security experts around the place (we have one here and I'll be joining her in the next few months ) so if you're ever stuck with something then just post in the security forum and we'll come to your rescue!

so my last resort is to reformat my computer.. but I misplace my windows 7 DVD.. and using a pirated one is a bit hassle because I paid for my OS..

Let me make your day, and bring you from the dark side into the light : if you have paid for your OS, then you have a Product key. All you need is a Windows 7 installation DVD, which you can create in a matter of minutes by downloading the ISO for the version you are using:
Download Windows 7 ISO (Official 32-bit and 64-bit Direct Download Links) « My Digital Life

Nice post Colin

 

[Alejandro85]

Just a question (probably already answered thousand times).

What does exactly that Combofix do? I saw much fuss around it but never saw any post explaining how to use or what it does or how it does that. Maybe it's a nice tool to have

Is there any tutorial, documentation or something about it? Any where to download it?

 

[Shane Williams]

I've never had any training with it. I have used it on several machines to recover from bad virus intrusion where the AV just wasn't enough to fix it. I wouldn't send that kind of warning out unless you are referring to a network situation. Then I would let the HMIC take care of it. On your own machine, I wouldn't use it unless it was a last resort but I wouldn't be sending fear out like the OP did.

 

[A Guy]

I've never had any training with it. I have used it on several machines to recover from bad virus intrusion where the AV just wasn't enough to fix it. I wouldn't send that kind of warning out unless you are referring to a network situation. Then I would let the HMIC take care of it. On your own machine, I wouldn't use it unless it was a last resort but I wouldn't be sending fear out like the OP did.

The OP is a Security expert, and a MVP. I can't get over people saying, "I used it myself, and had no problems". As if that means that will be the case for everyone. The original warning was for a valid reason, and it still applies. A Guy

 

[Layback Bear]

I'm simple so I will keep it simple.
When Jacee speaks on security, believe it.
Jacee
MS MVP Consumer Security 2006~2012
I'm done.

 

[ICIT2LOL]

Just a question (probably already answered thousand times).

What does exactly that Combofix do? I saw much fuss around it but never saw any post explaining how to use or what it does or how it does that. Maybe it's a nice tool to have

Is there any tutorial, documentation or something about it? Any where to download it?

Probably been mentioned before but I found this looking for an answer to the query what does it do? Noq some of the refs are oldish and I suspect combofix is in here but I have only had a cursory look s far.
Spyware And Malware Removal Guides Index

Just found this too

http://i.techrepublic.com.com/downloads/Gilbert/adl_six_tools_malware.pdf

and this - what is needed I suspect.

http://www.bleepingcomputer.com/combofix/ < excellent guide.

 

[Alejandro85]

Just a question (probably already answered thousand times).

What does exactly that Combofix do? I saw much fuss around it but never saw any post explaining how to use or what it does or how it does that. Maybe it's a nice tool to have

Is there any tutorial, documentation or something about it? Any where to download it?

Probably been mentioned before but I found this looking for an answer to the query what does it do? Noq some of the refs are oldish and I suspect combofix is in here but I have only had a cursory look s far.
Spyware And Malware Removal Guides Index

Just found this too

http://i.techrepublic.com.com/downloads/Gilbert/adl_six_tools_malware.pdf

and this - what is needed I suspect.

http://www.bleepingcomputer.com/combofix/ < excellent guide.

Great, thanks very much. That's what I've been looking for. Will give it a try on a virtual machine to see what it does, but seems a nice thing to have handy, just in case. Thanks!

 

[Shane Williams]

I've never had any training with it. I have used it on several machines to recover from bad virus intrusion where the AV just wasn't enough to fix it. I wouldn't send that kind of warning out unless you are referring to a network situation. Then I would let the HMIC take care of it. On your own machine, I wouldn't use it unless it was a last resort but I wouldn't be sending fear out like the OP did.

The OP is a Security expert, and a MVP. I can't get over people saying, "I used it myself, and had no problems". As if that means that will be the case for everyone. The original warning was for a valid reason, and it still applies. A Guy

You will note that in my post I said "I wouldn't send that kind of warning out unless you are referring to a network situation. Then I would let the HMIC take care of it." HMIC = Head man in charge. That would be the expert. on your own PC, you should be fine. I also said that I have used it on several machines as a last resort. Which makes me an expert on personal use of the program. I've used it on everything from 98SE to 7 and have never had an issue when used at default settings.

 

[A Guy]

on your own PC, you should be fine.

False. On your own PC you MAY be fine. I am amazed that you disagree with trained windows security experts, and feel the need to continue to belabor the issue.

I also said that I have used it on several machines as a last resort. Which makes me an expert on personal use of the program. I've used it on everything from 98SE to 7 and have never had an issue when used at default settings.

False. It means you have used it with no apparent issues, at least so you say. It in no way makes you an expert of any kind. We have hundreds of thousands of visitors here. We do not want to condone using Combofix on your own. Everyone has the right to do so if they please. But we will still warn them of the dangers!

A Guy