Link to home
Start Free TrialLog in
Avatar of ianmal2
ianmal2

asked on

Combofix always hangs badly infected Acer Laptop

I have an Acer Aspire laptop that has been badly infected by a virus picked up by visiting a malicious website.   Its’s the one where your desktop program shortcuts appear to be missing and there is a program suggesting you activate a windows fix.

Have uninstalled anti-virus software to allow combofix to run

First time Combofix ran, it successfully installed the Recovery Module, then successfully created the restore point but hung after it started to run the 50 virus check stages and never completed the first virus check stage (I left it running for about 8 hours).  There is no disk activity and no response to mouse etc.    Have to switch off by holding in Switch Off key. Have tried to run Combofix with normal user logon, in Safe mode and in Safe Mode with networking but always hangs just after starting the virus check stage.

Have also ran SuperAntispyware which did complete and found a few items to delete.

Any ideas for getting Combofix to run or can someone suggest an alternative cleanup app. I have used Combofix many time in the past with great success.
Avatar of Christopher Martinez
Christopher Martinez
Flag of United States of America image

Do you have any CD emulators installed and running? i.e. Daemon, Alcohol 120% etc
SOLUTION
Avatar of ☠ MASQ ☠
☠ MASQ ☠

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
try running something like AVG's boot cd first then move onto things like malwarebytes in normal mode
Avatar of ianmal2
ianmal2

ASKER

No CD emulators running.  I'll check out the referenced article and AVGs boot CD.
You could also potentially find the bad files causing the headache if you boot to UBCD/Slave this HDD and use Autoruns, to "Analyze Offline System". It enumerates all the startup locations. They are often very simple to find, in %allusersprofile%\Application Data, or underneath the user's Local Settings\Application Data directories.....

Autoruns
http://live.sysinternals.com/autoruns.exe

Have you also just tried logging in as another user account? Some of these are USER based, and do not affect the entire system.....
Avatar of ianmal2

ASKER

Yes I have created another user account where everything seems to work normally.  But Combofix still stops at the same point.
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
If you could use the Autoruns util under the other account, and hit the Users option at the top, and select the infected user, we should be able to spot the infection.....
i can recommend mbam; it runs fast and cleans most problems : http://www.malwarebytes.org/mbam.php       
Try deleting that copy and download a new version of ComboFix, if that was a fresh download then it's possible that the file got corrupted so try getting a new one and see if it works.
Avatar of ianmal2

ASKER

Thanks for all your help.  Just a couple of thing to note. Had to run Kaspersky Virus Removal Tool before TDSSKiller would run.  Found RKill to be more effective that RogueKiller.

And finally even although laptop is now virus free, combofix still won't run?