when I tried running ComboFix, it said "The copy of ComboFix has expired, Please download an updated copy". And then it deleted itself, it wasn't in my recycle bin. Is it normal for it to delete itself? Or did it go somewhere in my drive? I also did a search on ComboFix and other forums warn of ComboFix's possible dangers. Let me know what the risks are because if it involves risking data loss then I would prefer to not run it. And if we've come down to where I might possibly need to re-format, wouldn't doing a recovery console re-install critical system files and flush out the virus?
I don't understand why that happened, below are links to the un-renamed version try one if you want to, or we can call it quits if you want. Your choice.
OKAY, I TRIED IT AGAIN AND IT WORKED. TO CLEAR UP THAT THING ABOUT THE COMBOFIX EXE FILE DELETING ITSELF. IT ACTUALLY TURNED ITSELF INTO AN INTERNET EXPLORER ICON AND WHEN I DELETED THAT, IT WASN'T IN THE RECYCLE BIN. SO I DON'T KNOW IF THATS A NORMAL THING BUT THATS EXACTLY WHAT OCCURRED. BELOW IS MY COMBOFIX LOG FILE:
ComboFix 08-02-13.2 - Administrator 2008-02-13 1:11:48.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1480 [GMT -8:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
* Click START then RUN
* Now type Combofix /u in the runbox and click OK
* Notice the space between combofix and the /
The above procedure will:
* Delete the following:
o ComboFix and its associated files and folders.
o VundoFix backups, if present
o The C:\Deckard folder, if present
o The C:_OtMoveIt folder, if present
* Reset the clock settings.
* Hide file extensions, if required.
* Hide System/Hidden files, if required.
* Reset System Restore.
If you are no longer having any more trouble here is some preventative measures for you.
Be sure to re-hide hidden files/folders if you were asked to unhide them
Here are some preventive measures you can take to keep your computer from getting infected again. also keep all these and Ad-awareSE and SpybotS&D updated.
Double-click ATF-Cleaner.exe to run the program, to clean junk files off your PC.
If you would like to keep your cookies don't check that item
* Under Main "Select Files to Delete" choose: Select All.
* Click the Empty Selected button.
* If you use Firefox browser click Firefox at the top and choose: Select All
* Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
* If you use Opera browser click Opera at the top and choose: Select All
* Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
RegProtect
This small registry protection tool will save you hours of heartache by notifying you when some program good or bad is trying to access your registry.
You have the option of allowing(good) items or blocking(bad)items.
To reduce the re-infection potential for malware and protect yourself against spyware, here are a few helpful suggestions:
1. Keep Windows and Internet Explorer current with the latest critical security updates from Microsoft. This will patch many of the security holes through which attackers can gain access to your computer. You CANNOT complete this update using an alternate browser. http://v5.windowsupdate.microsoft.co....aspx?ln=en-us
2. Run your antivirus software regularly, and to keep its definitions up-to-date. If you are thinking about switching, there are a some good free Antivirus programs that are decent, including AVG and Avast!. AVG:http://free.grisoft.com/doc/1
5. Consider using an alternate free browser for general web surfing but you must use IE for windows update. Mozilla Firefox: www.mozilla.org/products/firefox/
6. Consider increasing your browser security by using these programs: SpywareGuard will protect your homepage from being hijacked: http://www.javacoolsoftware.com/spywareguard.html SpywareBlaster will increase browser protection by blocking Thousands of known malware sites by adding them to IE's restricted sites zone. Download it here:
If you use SpywareBlaster, you can also use a customblocklist to add even more entries into IE restricted sites zone. Go to this site for the current list and how to use instructions: http://customblockinglist.cjb.net/
You can prevent your computer from visiting a myriad of untrustworthy sites and ad-servers by installing a customised hosts file. One of the best available is the: MVPS Hosts File. Simply follow the instructions to install the file in the correct location. This will not only make surfing safer but will improve website load times and block popups from many of the large ad-servers.
*Remember just like your primary anti-virus software, it is important to keep all of these programs up-to-date and use them on a regular basis. It's Free
