[phpbay]anti-virus, 2, “”, “”[/phpbay]
As far as I can tell you should NOT use Combofix on Windows Vista and Windows 7. I’ve been doing some pretty extensive testing with Combofix in VMware and my VM’s were corrupted about 50% of the time (unbootable). I’ve really only used Combofix on Windows XP 32-bit to get rid of rootkits quickly and easily. Since more and more PC’s are being shipped with 64-bit OS’s dealing with malware has gotten a lot easier in the past few months for me since Rootkits cannot be installed in a 64-bit OS.
Using Combofix On Windows Vista and Windows 7 – I wouldn’t
Previous post: Muliple RunDLL32.exe’s in Task Manager? That Dern Conficker…
Next post: Twitter Updates for 2009-10-23
{ 26 comments… read them below or add one }
lol i am running windows 7 LOVE IT! since beta its been amazing and i saw some of the new technology in a hour preview on m$ website. thanks for the heads up Matt lol knowing my luck i would have ran it and broken my dads business PC!
‘Unbootable’ why? What specifically is Combofix doing to Vista/7 computers that it doesn’t do to an XP computer?
will you review a squared anti malware?
I’ve used Combofix on my Vista computer twice. No problems so far, it must be VMware.
Same here. No problems running combofix on Vista.
I’ve not had any problems running ComboFix on Vista yet, either. It’s suppose to be compatible.
Same here, no problems – Vista.
Combofix is a no-no for Win 7.
I personally tried it on win7 and had to use restore to recover screwed up desk top.
Combofix for win7 is not yet ready
combofix doesnt run as well on vista and win7 pc’s because it will go through and delete system files. it doesnt know any better. if those files are infected they go bye-bye and then you have a corrupted os. so just because you vista users havent had any problems yet be careful.
ComboFix has been working wonderfully on all 32bit Vista, XP & 2000 PCs I’ve had to fix for almost a year now. Some 350+ PCs.
Had a BSOD error with ComboFix back in 2007.
Correct, it’s not Win7 or 64bit ready.
You get plenty of beeps and warnings to deter you from proceeding…
I think you *MAY* run into some problems if you have UAC enabled still.
… back to the manual removal methods
I have used Combofix on well over a hundred machines, never an issue. It will not run on 64 bit ….yet.
Every computer I touch, I turn off the UAC, what a pain.
Doesn’t play well with Windows7 Pro… window previewing (when you mouse-over an icon in the taskbar at the bottom) doesn’t work afterward, and I lost the CMD prompt path (i.e. CMD opens with a blinking cursor and no prompt)… possibly other issues too. Performed a restore and above problems were fixed.
Ran Combofix tonight to detect Google Redirect virus problem on Win7 Home.
It detected it easily and cleaned up without any problems, I’ve got no complaints with it.
Interestingly M’soft Security Essentials and Malwarebytes Antimalware couldn’t pick it up.
Leaves me wondering just how effective they actually are ?
I just ran ComboFix on Win7 Home. It removed a few items and reset all features back to normal.
No issues on this end.
i need help badly i have windows 7 and im trying to use combofix to restore evrything back on my computer and this virus thing wont let me at all run the program it keeps stopping it saying there something else opened
Renee, I should be able to help you, but not here. My email is meyersmktg@cox.net
He is talking about being unable to install combofix on 64 bit OS’s, not Vista, or XP, or 7 in general. We all know it works on 32 bit OS systems, what about the 64 bits?
Mark Meyers March 13, 2010 at 7:14 pm
I have used Combofix on well over a hundred machines, never an issue. It will not run on 64 bit ….yet.
hi, I’m on Win7 Pro 64-bit.
I have a mebroot.mbr trojan something or other that nod32 detects but can’t touch, googling it indicated it had something to do with rootkits… but you said rootkits can’t be installed on 64-bit machines….
Combofix won’t run (it says it’s incompatible with my machine), mbr.exe (recommended in my google searches) doesn’t work, and booting from the windows cd to fix the mbr is problematic because the virus(i assume it’s the virus) keeps disabling system restore and other system tools.
argh, sry about length. any ideas?
Daniel, I suggest running your Nod32 in safe mode. Also download malwarebytes (free), update it, and run it in safemode also.
Mark, thanks for your reply.
I tried what you said:
Nod32 in safe mode ran overnight and closed on its own. I can’t find a log or anything so i don’t know how it ran. I still have the virus though.
malwarebytes doesn’t see the virus.
I need to replace my current HD with a bigger one pretty soon and i’d do this by copying an image of my old hd to the new one. Could i somehow delete the virus out of the image?
Just bouncing random ideas around, anyone know something else i can try?
thx
there are other programs out there to try before you give up
There is no ‘one’ antivirus or spyware that’s a cure all. Two others you might want to try are Ad-Aware2010 & Spybot Search & Destroy. Spybot has the option to run again as the computer restarts. Another you could try is ‘SuperAntispyware’. I would try this first.
http://www.superantispyware.com/superantispywarefreevspro.html
As for antivirus software on your pc, there is nothing better than ‘Norton Antivirus w/ antispyware 2010. By it at a store, so you have the disk. NOT Internet Security or 360.
You should probably start a thread in the forums for this, but… if you’re about to replace the hard drive, why not just backup the documents you need and start with a fresh copy of windows? There’s nothing like a freshly formatted hard drive. And I would definitely recommend putting either MS Security Essentials or Comodo Internet Security on that fresh new HD to protect it in the future.
I’ve been busy lately so i’m only responding now, but thanks for the suggestions.
SuperAntiSpyWare didn’t find it.
I started a thread as recommended:
http://remove-malware.com/forums/viewtopic.php?f=23&t=6565
renee voss & Daniel
I HAVENT TRIED THIS BUT I KNOW YOU CAN DO IT ON A 32/86 MACHINE,
WHY NOT TRY BOOT INTO DOS AND EXECUTE THE COMBO-FIX EXE,
ALSO I HEARD THAT SOME VIRUSES DETECT IT BY NAME SO RENAME IT TO SOME RANDOM JIBBER-JABBA BEFORE YOU DO THIS.
THERE IS A VIDEO ON YOUTUBE IF YOU SEARCH COMBO FIX AND THE GUY SHOWS YOU HOW TO USE IT, IT’S WORTH A WATCH!
renee voss & Daniel
Try it in safe mode