<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: ComboFix &#8211; last resort against malware</title>
	<atom:link href="http://www.rarst.net/software/combofix/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.rarst.net/software/combofix/</link>
	<description>cynical thoughts on software and web</description>
	<lastBuildDate>Tue, 22 May 2012 09:35:35 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.2</generator>
	<item>
		<title>By: Rarst</title>
		<link>http://www.rarst.net/software/combofix/#comment-196913</link>
		<dc:creator>Rarst</dc:creator>
		<pubDate>Sat, 24 Mar 2012 15:47:01 +0000</pubDate>
		<guid isPermaLink="false">http://www.rarst.net/?p=444#comment-196913</guid>
		<description>&lt;a href=&quot;#comment-196716&quot;&gt;&lt;strong&gt;@gabriel&lt;/strong&gt;&lt;/a&gt;

If command line was perfect interface we would never move on from it.

&lt;blockquote&gt;Anyways, why should we care about people who can´t use it?&lt;/blockquote&gt;

I don&#039;t see anyone forcing or suggesting you to do so. :)</description>
		<content:encoded><![CDATA[<p><a href="#comment-196716"><strong>@gabriel</strong></a></p>
<p>If command line was perfect interface we would never move on from it.</p>
<blockquote><p>Anyways, why should we care about people who can´t use it?</p></blockquote>
<p>I don&#8217;t see anyone forcing or suggesting you to do so. :)</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: gabriel</title>
		<link>http://www.rarst.net/software/combofix/#comment-196716</link>
		<dc:creator>gabriel</dc:creator>
		<pubDate>Fri, 23 Mar 2012 18:07:24 +0000</pubDate>
		<guid isPermaLink="false">http://www.rarst.net/?p=444#comment-196716</guid>
		<description>&lt;a href=&quot;#comment-60181&quot;&gt;&lt;strong&gt;@Rarst&lt;/strong&gt;&lt;/a&gt;
&lt;blockquote&gt;@Rudolph
I think the “danger” of ComboFix is in usability rather than techniques.
Generic AV products try to play nice with user – GUI, quarantine, etc. ComboFix doesn’t really bother.&lt;/blockquote&gt;

Wait wait wait... are we saying this AV is the last resort because it is ugly? Really? And it´s hard to use for the &quot;average user&quot;? Man, i ran it and it worked all by itself in a few minutes (oh, and it easily solved a nasty problem i couldn´t solve without avira and malwarebits). I am starting the average pc user is somewhat like a retarded monkey. Anyways, why should we care about people who can´t use it? And back to the beggining, since when simple plain text is &quot;dangerous&quot;???</description>
		<content:encoded><![CDATA[<p><a href="#comment-60181"><strong>@Rarst</strong></a></p>
<blockquote><p>@Rudolph<br />
I think the “danger” of ComboFix is in usability rather than techniques.<br />
Generic AV products try to play nice with user – GUI, quarantine, etc. ComboFix doesn’t really bother.</p></blockquote>
<p>Wait wait wait&#8230; are we saying this AV is the last resort because it is ugly? Really? And it´s hard to use for the &#8220;average user&#8221;? Man, i ran it and it worked all by itself in a few minutes (oh, and it easily solved a nasty problem i couldn´t solve without avira and malwarebits). I am starting the average pc user is somewhat like a retarded monkey. Anyways, why should we care about people who can´t use it? And back to the beggining, since when simple plain text is &#8220;dangerous&#8221;???</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Rarst</title>
		<link>http://www.rarst.net/software/combofix/#comment-192105</link>
		<dc:creator>Rarst</dc:creator>
		<pubDate>Sun, 26 Feb 2012 19:26:23 +0000</pubDate>
		<guid isPermaLink="false">http://www.rarst.net/?p=444#comment-192105</guid>
		<description>&lt;a href=&quot;#comment-191664&quot;&gt;&lt;strong&gt;@williambuell&lt;/strong&gt;&lt;/a&gt;

Hours definitely sounds like too long. I am not sure those blue screens come from Combofix, boot issues after malware cleanup are usually caused by removal of infected files that were involved in boot process.</description>
		<content:encoded><![CDATA[<p><a href="#comment-191664"><strong>@williambuell</strong></a></p>
<p>Hours definitely sounds like too long. I am not sure those blue screens come from Combofix, boot issues after malware cleanup are usually caused by removal of infected files that were involved in boot process.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: williambuell</title>
		<link>http://www.rarst.net/software/combofix/#comment-191664</link>
		<dc:creator>williambuell</dc:creator>
		<pubDate>Thu, 23 Feb 2012 23:15:11 +0000</pubDate>
		<guid isPermaLink="false">http://www.rarst.net/?p=444#comment-191664</guid>
		<description>A technician at bleepingcomputer advised me to run COMBOFIX on my Toshiba Laptop Windows 7.  It seemed to finish all its phases normally and then rebooted. Upon reboot, it has been running for several hours flashing blank blue screens at various positions. Is this NORMAL? How many hours should I let it run before I know that it is in a loop? I think this behavior should be documented or else some more meaningful information should be displayed during this reboot phase. I received quick initial response from Bleeping Computer instructing me what to run but now that it is in a loop for several hours, I have no response yet from bleeping computer. Thanks.</description>
		<content:encoded><![CDATA[<p>A technician at bleepingcomputer advised me to run COMBOFIX on my Toshiba Laptop Windows 7.  It seemed to finish all its phases normally and then rebooted. Upon reboot, it has been running for several hours flashing blank blue screens at various positions. Is this NORMAL? How many hours should I let it run before I know that it is in a loop? I think this behavior should be documented or else some more meaningful information should be displayed during this reboot phase. I received quick initial response from Bleeping Computer instructing me what to run but now that it is in a loop for several hours, I have no response yet from bleeping computer. Thanks.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Nick</title>
		<link>http://www.rarst.net/software/combofix/#comment-132733</link>
		<dc:creator>Nick</dc:creator>
		<pubDate>Fri, 19 Aug 2011 23:04:15 +0000</pubDate>
		<guid isPermaLink="false">http://www.rarst.net/?p=444#comment-132733</guid>
		<description>Hi all, this all depends on your ability. You are either quite happy with writing your own registry values and running bootfix/mbr repairs or you are not. This just depends on your confidence! You can see how to perform these operations with a quick Google. Sure; I admit to really screwing my first com, but after the reinstall, I realised that it was only my time and loss of files that hurt; the machine was not burnt out or anything. It worked faster with its new install, and that started to matter to me. This was win ME. A race horse that fell often. I also tried Mandrake Linux and quite quickly learnt that it is NOT advisable to run as &#039;Administrator&#039;. I had thousands of dangling symbiotic links, WTF? Yes, we all start and fall at the first fences, but it does get better, especially with good software like ComboFix. I have used ComboFix for years, never, ever had a single problem with it. Remember, a computer may be infected with several different types of &#039;bug&#039; at the same time. To be sure to remove ALL, you need to get a strategy together. Which type to attack first, to enable continuing without crashing. For some very good sound advice; try visiting MAJORGEEKS.COM Chaslang has a really good set of web pages,  that give a priority lesson for your attack mode. Save the pages (4?) to your desktop and download all the apps suggested to the desktop. Read the pages and simply follow the instructions for a CLEAN computer :-)
IMO the Windows firewall is about as useful as a chocolate fireguard. I use COMODO. Try the free version.
kind regards and happy harvesting   Nick</description>
		<content:encoded><![CDATA[<p>Hi all, this all depends on your ability. You are either quite happy with writing your own registry values and running bootfix/mbr repairs or you are not. This just depends on your confidence! You can see how to perform these operations with a quick Google. Sure; I admit to really screwing my first com, but after the reinstall, I realised that it was only my time and loss of files that hurt; the machine was not burnt out or anything. It worked faster with its new install, and that started to matter to me. This was win ME. A race horse that fell often. I also tried Mandrake Linux and quite quickly learnt that it is NOT advisable to run as &#8216;Administrator&#8217;. I had thousands of dangling symbiotic links, WTF? Yes, we all start and fall at the first fences, but it does get better, especially with good software like ComboFix. I have used ComboFix for years, never, ever had a single problem with it. Remember, a computer may be infected with several different types of &#8216;bug&#8217; at the same time. To be sure to remove ALL, you need to get a strategy together. Which type to attack first, to enable continuing without crashing. For some very good sound advice; try visiting MAJORGEEKS.COM Chaslang has a really good set of web pages,  that give a priority lesson for your attack mode. Save the pages (4?) to your desktop and download all the apps suggested to the desktop. Read the pages and simply follow the instructions for a CLEAN computer :-)<br />
IMO the Windows firewall is about as useful as a chocolate fireguard. I use COMODO. Try the free version.<br />
kind regards and happy harvesting   Nick</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Rudolph</title>
		<link>http://www.rarst.net/software/combofix/#comment-108812</link>
		<dc:creator>Rudolph</dc:creator>
		<pubDate>Sat, 11 Jun 2011 19:06:26 +0000</pubDate>
		<guid isPermaLink="false">http://www.rarst.net/?p=444#comment-108812</guid>
		<description>Running ComboFix by yourself is like performing open heart surgery on yourself--the scalpel and other surgical tools that is ComboFix is meant to be wielded by a highly trained surgeon only in emergencies or dire circumstances. When the surgeon is thru s/he leaves the room. So combofix should be removed from a system once it has accomplished its job, unlike an AV that is there to protect you from future infections.

 . . . CF does make some alterations to your system if you run it. Even if you had no malware removed and run the uninstall command, some things may be different now on your system. I can tell you that one thing is that all your restore points will be flushed out and a new one created. There is a good reason to do that when you have a severe infection--but if you aren&#039;t infected you might need those restore points.

 Read and abide by the disclaimer people. It&#039;s there for a reason. Stick to running and protecting yourself with a good AV and firewall and an anti-malware scanner or two. If you feel you need a second opinion, try running online scans. If you feel you might need surgery, come here to BC and ask for help--that is what we&#039;re here for.

BS! -----&gt; I can tell you that one thing is that all your restore points will be flushed out and a new one created. There is a good reason to do that when you have a severe infection--but if you aren&#039;t infected you might need those restore points.

BS!Combofix backs up the registry and create a restore point before it starts. If you go over to these malware forums its basically one tune they play. Malwarebytes superantispyware tdsskiler and combofix. It hunts down names of known malware. It doesnt use signatures so how can it have a false positive?

tools are susceptible to glitches, bugs and false positive detections and removal of critical files from time to time resulting in computers that become unbootable or get stuck in an endless reboot loop. Even major anti-virus vendors are not immune to such issues either and here are just a few reported examples.
McAfee false-positive deletes critical svchost.exe causing system crashes and reboot loops
McAfee false-positive glitch on crucial system files fells PCs worldwide
Symantec false positive on system files cripples thousands of Chinese PCs
Kaspersky False Positives Quarantine or Kill Windows Explorer in Windows Vista
AVG virus scanner removes critical Windows file and renders machines unbootable
Malwarebytes Atapi.sys and Registry False Positives

Wheres Combofix? If combofix makes your OS unbootable then any antivirus would as well. It uses Gmner catch me. All the scanners use it.  Combofix can delete the wrong things if you make your own scripts to delete files. But that you cant do by accident</description>
		<content:encoded><![CDATA[<p>Running ComboFix by yourself is like performing open heart surgery on yourself&#8211;the scalpel and other surgical tools that is ComboFix is meant to be wielded by a highly trained surgeon only in emergencies or dire circumstances. When the surgeon is thru s/he leaves the room. So combofix should be removed from a system once it has accomplished its job, unlike an AV that is there to protect you from future infections.</p>
<p> . . . CF does make some alterations to your system if you run it. Even if you had no malware removed and run the uninstall command, some things may be different now on your system. I can tell you that one thing is that all your restore points will be flushed out and a new one created. There is a good reason to do that when you have a severe infection&#8211;but if you aren&#8217;t infected you might need those restore points.</p>
<p> Read and abide by the disclaimer people. It&#8217;s there for a reason. Stick to running and protecting yourself with a good AV and firewall and an anti-malware scanner or two. If you feel you need a second opinion, try running online scans. If you feel you might need surgery, come here to BC and ask for help&#8211;that is what we&#8217;re here for.</p>
<p>BS! &#8212;&#8211;&gt; I can tell you that one thing is that all your restore points will be flushed out and a new one created. There is a good reason to do that when you have a severe infection&#8211;but if you aren&#8217;t infected you might need those restore points.</p>
<p>BS!Combofix backs up the registry and create a restore point before it starts. If you go over to these malware forums its basically one tune they play. Malwarebytes superantispyware tdsskiler and combofix. It hunts down names of known malware. It doesnt use signatures so how can it have a false positive?</p>
<p>tools are susceptible to glitches, bugs and false positive detections and removal of critical files from time to time resulting in computers that become unbootable or get stuck in an endless reboot loop. Even major anti-virus vendors are not immune to such issues either and here are just a few reported examples.<br />
McAfee false-positive deletes critical svchost.exe causing system crashes and reboot loops<br />
McAfee false-positive glitch on crucial system files fells PCs worldwide<br />
Symantec false positive on system files cripples thousands of Chinese PCs<br />
Kaspersky False Positives Quarantine or Kill Windows Explorer in Windows Vista<br />
AVG virus scanner removes critical Windows file and renders machines unbootable<br />
Malwarebytes Atapi.sys and Registry False Positives</p>
<p>Wheres Combofix? If combofix makes your OS unbootable then any antivirus would as well. It uses Gmner catch me. All the scanners use it.  Combofix can delete the wrong things if you make your own scripts to delete files. But that you cant do by accident</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: PC Services Surrey</title>
		<link>http://www.rarst.net/software/combofix/#comment-80563</link>
		<dc:creator>PC Services Surrey</dc:creator>
		<pubDate>Wed, 02 Mar 2011 14:55:27 +0000</pubDate>
		<guid isPermaLink="false">http://www.rarst.net/?p=444#comment-80563</guid>
		<description>Another good command line tool is norman malware cleaner.  It can be started from the command line and is alot easier to use than combofix</description>
		<content:encoded><![CDATA[<p>Another good command line tool is norman malware cleaner.  It can be started from the command line and is alot easier to use than combofix</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Rarst</title>
		<link>http://www.rarst.net/software/combofix/#comment-67887</link>
		<dc:creator>Rarst</dc:creator>
		<pubDate>Sun, 26 Dec 2010 08:57:41 +0000</pubDate>
		<guid isPermaLink="false">http://www.rarst.net/?p=444#comment-67887</guid>
		<description>&lt;a href=&quot;#comment-67866&quot;&gt;&lt;strong&gt;@Russ&lt;/strong&gt;&lt;/a&gt;

It is rising (and nasty as usual) trend in malware to block anti-malware tools from running. Most of the time it is easy to circumvent by renaming executable.

And naturally the more known apps are more likely to get blocked, so ComboFix flies under radar as less mainstream tool.</description>
		<content:encoded><![CDATA[<p><a href="#comment-67866"><strong>@Russ</strong></a></p>
<p>It is rising (and nasty as usual) trend in malware to block anti-malware tools from running. Most of the time it is easy to circumvent by renaming executable.</p>
<p>And naturally the more known apps are more likely to get blocked, so ComboFix flies under radar as less mainstream tool.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Russ</title>
		<link>http://www.rarst.net/software/combofix/#comment-67866</link>
		<dc:creator>Russ</dc:creator>
		<pubDate>Sun, 26 Dec 2010 05:36:20 +0000</pubDate>
		<guid isPermaLink="false">http://www.rarst.net/?p=444#comment-67866</guid>
		<description>Like other have commented, ComboFix is my last resort. I&#039;ve had viruses that would not even let me start malwarebytes even in safe mode. ComboFix to the rescue! Combo Fix does not even blink
when executing within a badly infected system. Read the tutorial first! If you are not very techish, best to let a pro remove it.</description>
		<content:encoded><![CDATA[<p>Like other have commented, ComboFix is my last resort. I&#8217;ve had viruses that would not even let me start malwarebytes even in safe mode. ComboFix to the rescue! Combo Fix does not even blink<br />
when executing within a badly infected system. Read the tutorial first! If you are not very techish, best to let a pro remove it.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Rarst</title>
		<link>http://www.rarst.net/software/combofix/#comment-60181</link>
		<dc:creator>Rarst</dc:creator>
		<pubDate>Sat, 27 Nov 2010 08:21:28 +0000</pubDate>
		<guid isPermaLink="false">http://www.rarst.net/?p=444#comment-60181</guid>
		<description>&lt;a href=&quot;#comment-60091&quot;&gt;&lt;strong&gt;@Rudolph&lt;/strong&gt;&lt;/a&gt;

I think the &quot;danger&quot; of ComboFix is in usability rather than techniques.

Generic AV products try to play nice with user - GUI, quarantine, etc. ComboFix doesn&#039;t really bother.</description>
		<content:encoded><![CDATA[<p><a href="#comment-60091"><strong>@Rudolph</strong></a></p>
<p>I think the &#8220;danger&#8221; of ComboFix is in usability rather than techniques.</p>
<p>Generic AV products try to play nice with user &#8211; GUI, quarantine, etc. ComboFix doesn&#8217;t really bother.</p>
]]></content:encoded>
	</item>
</channel>
</rss>

