Got this sucker Malwarebytes finds but won't remove. Been suggested to use Combofix to get rid of it. Anybody used that program before?
Global Moderator
Got this sucker Malwarebytes finds but won't remove. Been suggested to use Combofix to get rid of it. Anybody used that program before?
Professional Member
I would not touch combofix unless you have a rootkit installed on the system and you know what you are doing. It can nuke your system. I only touch it for really infected comps.
I would just let malware remove it and see if it pops back up. Also you should check any system connected to your network. What OS you running win7 or xp??
Professional Member
If you do decide to go ahead and try it, make sure you download it from bleeping computers. If I remember correctly someone has the domain for combofix and is hosting something different there.
Professional Member*
See if you can find the exact name of the malware in question... then google it. Usually there is a specific patch available to 'cure it'. Sometimes one needs to run two different malware programs to catch all the 'stuff' out there.
Along with running Kaspersky and Nod32 (the latter is manually only--AV/malware programs tend to not mix well...need to shut one down before starting the other); I have my IT guy come by once a year and wipe/rebuild the entire software on my workstation. Takes around 3-4 hours to get all the apps and routines set up again on a fresh Windows install... and costs me around a C note... however it also rids me of 'build-up'. This time I will leave WinXP pro and go to Win7Pro64. Hardware will handle 64bit... I have some new photo-processing software that does not run on XP... and M$FT is not gonna support XP much longer.
Try the google approach.
You could also try CCcleaner... it is a registry tool... WARNING... one can delete most of the cookies and DLL's if they are not careful... and take hours to get all your apps and routines working again.
GA-HVAC-Tech
Your comfort, Your way, Everyday!
GA's basic rules of home heating and AC upgrades:
*Installation is more important than the brand of equipment
*The duct system keeps the house comfortable; the equipment only heats and cools (and dehumidifies)
*The value of comfort, over the long term; leave economic choices behind!
Choose your contractor wisely!
Professional Member
If this is the type of Trojan that is coming back I would try this out. I have heard good things but have not had a chance to try it out yet. This is malwarebytes anti-root kit tool.
http://www.malwarebytes.org/products/mbar/
One last thing, you might want to check your router out if you keep getting this sorta infection back. I have seen viruss that will login to the router and set it up the DNS so everything goes through say Russa. This can also be done on your computer through the dns and proxy settings.
Professional Member
The title of this thread could go many directions
I'm thinking Dad would be the one to ask about it....he's a computer geek and a darn good one compared to me
Professional Member*
I thought the same thing, this thread is not what I was expectingOriginally Posted by Senior Tech
The title of this thread could go many directions
I'm thinking Dad would be the one to ask about it....he's a computer geek and a darn good one compared to me
Why am I the only naked person at this gender reveal party
AOP Committee/Professional Member*
And here, I thought someone had just become a grandfather again.
As for computer trojans, get the name and search Major Geeks. They have some top notch members.
I use CCleaner, malwarebytes, registry mechanic, super anti-spyware, and Avira free edition.
[Avatar photo from a Florida training accident. Everyone walked away.]
2 Tim 3:16-17
RSES CMS, HVAC Electrical Specialist
Member, IAEI
AOP Forum Rules:
Professional Member*
Weird, I always thought svchost.exe was a normal windows program. I use Malwarebytes Pro, it actively does malicious website blocking and file system protection, so for all has been well. I would also try booting in "F8" safe mode and run Malwarebytes, might be better.
__________________________________________________ _______________________
“Experience is a hard teacher because she gives the test first, the lesson afterwards" ~ Vernon Law
"It's what you learn after you know it all that counts." ~ John Wooden
"When the teachers become unteachable we're all in trouble" ~ Mr. Bill
"Remember "Pro" is only a name, it's not always a mindset determined to do everything correctly" ~ Mr. Bill
Professional Member
I recently ran most of the scanners I found here:
https://support.mozilla.org/en-US/questions/938759
The one that found a trojan on my computer was the microsoft security scanner. It took 3 hours.
Vacuum Technology:
CRUD = Contamination Resulting in Undesirable Deposits.
CRAPP = Contamination Resulting in Additional Partial Pressure.
Change your vacuum pump oil now.
Test. Testing, 1,2,3.
Regular Guest
svchost isn't the bad process itself - it's just an executable file which hosts some processes.
You have to find and delete the infected files, then remove the registry keys associated with it.
ccleaner only finds invalid registry references - it doesn't remove trojans.
Professional Member*
I was thinking someones gonna be a daddy.
Global Moderator
Sorry boys, not those kind of Trojans
Regular Malwarebytes doesn't touch it. What is the MB anti-root tool thingie? Might it get what the regular one doesn't? I'll sure try Bill's suggestion of running it in safe mode.
My IT friend who suggested combofix did say getting it from bleeping computer.
This is at work with a crazy network and a crazy IT lady who keeps finding ways to blame me for it like using Firefox not IE, going on Facebook for 30 seconds to send a message to a customer or running Outlook with the preview pane open. I pointed out I do lots riskier things at home without a problem.
Professional Member*
A successful story here.
http://www.pchelpforum.com/xf/thread...st-exe.129642/
__________________________________________________ _______________________
“Experience is a hard teacher because she gives the test first, the lesson afterwards" ~ Vernon Law
"It's what you learn after you know it all that counts." ~ John Wooden
"When the teachers become unteachable we're all in trouble" ~ Mr. Bill
"Remember "Pro" is only a name, it's not always a mindset determined to do everything correctly" ~ Mr. Bill
Professional Member
http://www.softpedia.com/reviews/win...w-308741.shtml
This is the safer tool mind you. Rootkits are nasty things, I really hope you don't have one on your system
Professional Member
The malwarebytes ant-rootkit tool is like combofix but supposed to be safer, supposed to, because I have not gotten to use it on anything yet.Sorry boys, not those kind of Trojans
Regular Malwarebytes doesn't touch it. What is the MB anti-root tool thingie? Might it get what the regular one doesn't? I'll sure try Bill's suggestion of running it in safe mode.
My IT friend who suggested combofix did say getting it from bleeping computer.
This is at work with a crazy network and a crazy IT lady who keeps finding ways to blame me for it like using Firefox not IE, going on Facebook for 30 seconds to send a message to a customer or running Outlook with the preview pane open. I pointed out I do lots riskier things at home without a problem.
Depending on what the virus has done to the system combofix goes in a uses alot of tools that computer experts use on a lot but normally one at a time. The problem is that it's like a nuclear option in that it tends to either fix the system, or you end up reinstalling the OS. It's a good tool but I view it as a last resort.
svchost.exe is a classic target of viruses because there are always tons on them running the in the process view of the task manager making it imposable for people like me to go in a manually kill it.
I would try a couple of the normal tools like some others have suggested in the thread, then move to malwarebytes anti-rootkit. Bleeping computers have a forum set up to help out with problems like this. They tend to advise using combofix last and will ask you to run logging tools to find out exactly what has changed on your system. Stuff like seek and destroy.
Professional Member
Your best bet is to save /backup important files, not an entire backup,, Than reinstall operating system. Only way to guarantee. Never use explorer firefox is safer
Customer is alWays opposite of Left
Professional Member
He is right about this. It hurts and is painful but backing up important files, formatting the partitian and full reinstall is the only guarantee these days. I prefer chrome, but almost anything is better the IE,
Professional Member
iM A BIG FAN OF CHROME with all the goog add on's etc....I use when lets say normal searching/tasty surfing. When i surf things i dont want the world to know i use firefox/duck duck go.
Just the thought of working on one of googles office units is scary. I sign there ticket and they have access to my entire search history that's cree.py
Customer is alWays opposite of Left
Professional Member
When reinstall and all your basics Browser,,addons antivirus r up and running than go to search programs and type cmd u will have a black screen type netstat -ano
take a snapshot of it,, than compare to another one a few weeks down the road and see who's communicating with your computer. This is the only 100 percent way of telling whats really communicating. Very important that everybody does this.
Customer is alWays opposite of Left
Posting Permissions
Reply