Skip to main content

ComboFix - Malware Removal Tool

Again, I am writing this down more for my own future reference, with the hope that it will benefit others Googling for this info as well.

ComboFix is a relatively unknown but surprisingly good anti-malware tool. I had in the past received a number of computers from relatives/friends that have been infected with malware. The general characteristics are that the machines boots OK into Windows, but runs erratically eg. displays fake error messages, prevents you from running certain executables, logs you off after awhile etc.

In my experience, it was impossible to get the existing antivirus software to perform a proper scan, or to install a new antivirus software because the system ran so erratically. Offline antivirus software that runs off a CD didn't help much either. I have a collection of them and none of them had helped on the computers I was trying to fix.

Enter ComboFix, which was able to get the computers back into good enough working condition so that I can reinstall the antivirus software and perform a proper scan. I am not sure what's the exact magic behind the program. It seems to "implement a collection of pre-made fixes for large amount of known malware and hunts down all files associated with it". Sounds good to me!

Windows Repair (All In One) is also helpful after running ComboFix. Some malware messes up all kinds of stuff, and functions like "Set Windows Services To Default Startup" is invaluable for straightening the system.

Of course, some people will tell you it's best to wipe the machine when it has been compromised. From a technical point of view, I would totally agree and will do it with my own machines. But in the real world with real people, that's not always the ideal solution for them. So I am glad ComboFix and Windows Repair AIO has enabled me to help some people along the way.

Comments

Popular posts from this blog

Adding "Stereo Mixer" to Windows 7 with Conexant sound card

This procedure worked for my laptop (Thinkpad E530) with a Conexant 20671 sound card, but I suspect it will work for other sound cards in the Conexant family. I was playing with CamStudio to do a video capture of a Flash-based cartoon so that I can put it on the WDTV media player and play it on the big screen in the living room for my kids. The video capture worked brilliantly, but to do a sound capture, I needed to do some hacking. Apparently, there was this recording device called "Stereo Mixer" that was pretty standard in the Windows XP days. This allowed you to capture whatever was played to the speaker in all its digital glory. Then under pressure from various organizations on the dark side of the force, Microsoft and soundcard makers starting disabling this wonderful feature from Windows Vista onwards. So after much Googling around, I found out that for most sound cards, the hardware feature is still there, just not enabled on the software side. Unfortunately, to

Hacking a USB-C to slim tip adapter cable to charge the Thinkpad T450s

This hack is inspired by this post . A year ago, I bought an adapter cable for my wife's Thinkpad X1 Carbon (2nd Gen) that allows her to power her laptop with a 60W-capable portable battery (20V x 3A). A USB-C cable goes from the battery into the adapter, which converts it to the slim tip output required by the laptop. Everything works out of the box, so I didn't give much thought about it. Recently, I decided to buy a similar cable for my Thinkpad T450s. I know technically it should work because the T450s can go as low as 45W (20V x 2.25A) in terms of charging (though I have the 65W charger - 20V x 3.25A).  I went with another adapter cable because it was cheaper and also I prefer the single cable design. So imagine my surprise when the cable came and I plugged it into my laptop and it didn't work! The power manager just cycle in and out of charging mode before giving up with an error message saying there is not enough power. After much research and reading the Thinkwiki

Using Google Dashboard to manage your Android device backup

I used to use AppBrain/Fast Web Install to keep track of which apps I have installed on my phone, and to make it easier to reinstall those apps when the phone gets wiped or replaced. But AppBrain had been going down the tubes, and Fast Web Install had always been a hit-and-miss affair. Android's own "backup to the cloud" system had previously been even more unusable. There isn't a place where you can see what has been backed up. And when you setup a new phone with your Google account, you just have to wait and pray that your favorite apps will be restored to the phone. Typically all the stars have to be aligned just right for this to happen. More often than not, after waiting for an hour or so and nothing happens, you just curse under your breath and proceed to install your favorites apps manually via the Play Store. But I just looked again recently and was pleasantly surprised that things are much more civilized now. Firstly there is a place now where you can loo