[Last Call] Learn about multicloud storage options and how to improve your company's cloud strategy. Register Now

x
?
Solved

Win 7 - can't run combofix, safe mode starts in low res

Posted on 2013-11-23
19
Medium Priority
?
635 Views
Last Modified: 2013-11-26
Yes, it's a multi-question!  But they might be connected.

Running Windows 7 Pro SP1 (32 bit).  I tried running Combofix numerous times, with anti-virus installed and uninstalled.  It freezes the whole computer right after it says it will start to scan, which usually takes ten minutes.  It never gets to the part where it shows the stages.

I decided to try it in Safe Mode, and to my surprise Safe Mode starts in low res (640 x 480).  I cannot change it in properties.  Very weird.  

My motherboard (Gigabyte ga-970a-ud3) doesn't come with a graphic chip, so I have an Nvidia GeForce GT 520.  

This all started a couple of days ago, when MBAM gave hourly notices about blocking avast from accessing a website.  After uninstalling, it's apparent that it's Firefox, not Avast, that's doing that.  Might just be a banner ad that I can't find, but I thought a full scan was in order.  MBAM and Avast! scans come up with nothing, as does TDSSKiller.  I thought Combofix might be a good idea.

As often happens, that led to the Combofix freeze and then the Safe Mode weirdness.  Any thoughts on the subject would be appreciated.
0
Comment
Question by:therealex123
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 4
  • 3
  • +2
19 Comments
 
LVL 98

Expert Comment

by:John Hurst
ID: 39671914
Try doing a full scan (a couple of hours) with Malwarebytes. Does that reveal more viruses?  If Combofix will not load/run, you may have a root kit viruses or a virus that is turning off A/V in your computer.

Try the above and let us know. At the stage you are at, you might be in for a fresh install of Windows so keep that in mind.

... Thinkpads_User
0
 
LVL 19

Assisted Solution

by:*** Hopeleonie ***
*** Hopeleonie *** earned 1000 total points
ID: 39671995
Step 1:

Download OTL:
http://oldtimer.geekstogo.com/OTL.exe

And save it to your Desktop

Step 2:

Run it as an Administrator and scan with these settings:

OTL Settings
Note you have to Include 64bit Scans only in 64bit Systems!


Step 3:

OTL will create 2 logs on the Desktop (OTL.Txt & Extras.Txt) . Please post them to us.
0
 

Author Comment

by:therealex123
ID: 39672223
Should I post the actual file contents or add them as an attachment?  I looked through the results, can't find a darn thing that looks out of place!  

The only weird thing is in the Alternate Data Streams section a bunch of stuff (some of it quite old) attributed to Roxio EMC Stream.  I had Roxio Easy Media Creator 10 installed some time ago, but it never worked right and I eventually uninstalled it.

Don't get thrown by the folder "Hacking".  I'm taking a White Hat Hacking course on Udemy, no funny stuff going on there!
0
Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

 
LVL 19

Expert Comment

by:*** Hopeleonie ***
ID: 39672248
Please post both as attachments. :-)
0
 
LVL 93

Expert Comment

by:nobus
ID: 39672303
>>  to my surprise Safe Mode starts in low res (640 x 480).  I cannot change it in properties.  Very weird.  <<<   no  - not at all
safe mode does not load drivers - other than basic ones, so it always is in 640x480.
0
 

Author Comment

by:therealex123
ID: 39672631
Hi Nobus,

I realize safe mode doesn't load drivers, but I've gone into safe mode many times.  I haven't seen it in 8 bit resolution since Windows 98 for safe mode.  Plus, it's usually 800 x 600, not 640 x 480.  Something is wrong.
0
 

Author Comment

by:therealex123
ID: 39672643
Hopeleonie - I've attached the logs.  I appreciate your help, I'd be really interested to see if you can find anything there!  I've looked, but don't see anything unusual.  I also used Process Explorer and don't see any rogue processes.

According to my MBAM logs, the attempts to connect stopped at about 3:00 pm yesterday.  I believe that at the point I had closed a browser window to the site http://www.thedogchick.com (we're looking for a dog trainer, and she was recommended).  Seeing that the attempts had stopped when I checked a few hours later, I re-opened the page to see if they would start again.  So far, nothing.  Very odd.

Thinkpads_user - as I said, MBAM shows nothing.  Neither does a scan with TDSSKiller and an Avast! scan.  A nuke and pave doesn't sound right at this point, but I appreciate your input.

Thanks again to everybody for their comments and help.  Please let me know if you find anything in the logs.
OTL.Txt
Extras.Txt
0
 
LVL 19

Expert Comment

by:*** Hopeleonie ***
ID: 39672711
Please download Kaspersky Virus Removal Tool and run a full scan:
http://www.kaspersky.com/antivirus-removal-tool-register
0
 
LVL 32

Expert Comment

by:_
ID: 39672720
>> Safe Mode starts in low res (640 x 480).  I cannot change it in properties.

Point of clarification, which properties? Or did you mean right click Desktop > Screen Resolution ?

And you are correct about something's wrong, I just checked a W7 Pro I'm futzing with, and it came up in 1024 x 768 (with 800 x600 as the lowest option).

Check to see if you are using the Nvidia drivers, or if Windows Update hijacked the video.
0
 
LVL 93

Assisted Solution

by:nobus
nobus earned 500 total points
ID: 39672851
right - my bad
but in safe mode, it can point to a bad video card also
you can test if you have a correct resolution when booted from a live cd :
http://www.ubcd4win.com/                              ubcd  Win
ftp://mirrors.kernel.org/knoppix-dvd/KNOPPIX_V7.0.5DVD-2012-12-21-EN.iso      Knoppix
0
 

Author Comment

by:therealex123
ID: 39673416
Ok, I booted from Hiren's.  No problem there.  Booted back into Safe Mode, and here's the answer:

Go to right click Desktop > Screen Resolution, click on Advanced Settings.  Click on the Monitor tab.  Change the resolution to 32 bit (you'd think it would be under the adapter settings, but THANKS SO MUCH, MICROSOFT!)  Now, you can change it to the regular resolution.

So, no virus there.  BUT - I STILL can't run combofix.  It still freezes at exactly the same place, right when it says it's going to run and then never actually gets to Stage 1.  

Any ideas are welcome.
0
 
LVL 32

Assisted Solution

by:_
_ earned 500 total points
ID: 39673569
>> Now, you can change it to the regular resolution.

ahhhhhh... adding that one to my notes.  Thanks.   : )

As for Combofix, using S.W.A.G., it suggests a hardware issue.
Take it down to basic hardware (take out un-needed addin cards, disable un-needed things in the BIOS, unplug unneeded drives, etc).
If Combofix runs, then add things back, a couple at a time.

If it still doesn't run, maybe it doesn't understand your hard drive setup (AHCI, RAID, etc).
Just a thought...
0
 
LVL 98

Expert Comment

by:John Hurst
ID: 39673578
@therealex123  - There may be no viruses now, but there probably were viruses at one point, and it looks like they have permanently corrupted your operating system.

... Thinkpads_User
0
 
LVL 93

Expert Comment

by:nobus
ID: 39673834
0
 
LVL 19

Accepted Solution

by:
*** Hopeleonie *** earned 1000 total points
ID: 39674288
Did you run Kaspersky Virus Removal Tool?
You should not simply run Combofix, this should be the last option!
But if you want it uninstall Avast and Malwarebytes. Then try to run Combofix.
Will it freeze?
0
 

Author Comment

by:therealex123
ID: 39674534
Hopeleonie - I ran kaspersky (I thought I posted that, but I see I didn't).  Nothing.  I'll try running sfc, as Nobus suggested, if that doesn't work, I'll try your suggestion and remove any additions I have on (at this point, I think I just have an SSD attached.)

Thinkpads_user - why do you say " it looks like they have permanently corrupted your operating system."  That's pretty strong.  What are you basing that on?

Thanks again.
0
 
LVL 98

Expert Comment

by:John Hurst
ID: 39674543
"why do you say"  <-- Because I look at lots of machines on a day to day basis. When viruses attack systems and all manner of anti virus is tried without success, then normally the operating system cannot be repaired. My comment is based on years of experience.  I am just saying "normally"  and "it looks like".

... Thinkpads_User
0
 

Author Comment

by:therealex123
ID: 39676679
Nobus - sfc said everything is fine.  

Thinkpads_user - I'm guessing then that you didn't actually look at the logs, you're just assuming that 1. I've had a virus in the past (no, I haven't, not since I did a clean install of this system two years ago), 2. my operating system is hopelessly corrupted (no, if it was a number of other errors would show), 3.  your "years of experience" lead to you to recommend a nuke and pave if you can't come up with a quick answer.  Thanks anyway, but I think I'll troubleshoot this one since the only thing that doesn't work is Combofix.

coral47 - excellent idea.  I'll take off any additional hardware (not much there) and see what happens.  For all I know, it could be my AD/DA converter!  At this point, it's more of a curiosity than a pressing issue, as I no longer have outgoing port attempts and the Safe Mode thing is resolved.

Hopeleonie - I'll boot from another drive that doesn't have any protection on it, just to see what happens.  That will definitely take hardware out of the picture if it works.
0
 
LVL 32

Expert Comment

by:_
ID: 39679625
Thank you much.    : )
0

Featured Post

Are You Ready for GDPR?

With the GDPR deadline set for May 25, 2018, many organizations are ill-prepared due to uncertainty about the criteria for compliance. According to a recent WatchGuard survey, a staggering 37% of respondents don't even know if their organization needs to comply with GDPR. Do you?

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many people tend to confuse the function of a virus with the one of adware, this misunderstanding of the basic of what each software is and how it operates causes users and organizations to take the wrong security measures that would protect them ag…
Windows 7 does not have the best desktop search built in. This is something Windows 7 users have struggled with. You type something in, and your search results don’t always match what you are looking for, or it doesn’t actually work at all. There ar…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
Want to learn how to record your desktop screen without having to use an outside camera. Click on this video and learn how to use the cool google extension called "Screencastify"! Step 1: Open a new google tab Step 2: Go to the left hand upper corn…

650 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question