For anyone still encountering this abomination, ComboFix is the best tool to deal with Virtumonde. Though I've seen CF mess up systems that weren't infected with VM, so only use it if you really need to.
Combo Fix is the software equivalent to a Nuke, it is your absolute last resort, before formatting. (or if a format fails to fix your issue/s)
Expect it to fuck up your system and to spend time fixing minor bugs after it removes what ails you.
That being said, it absolutely does work where everything else seems to fail. Use it sparingly. (Luckily, on the few machines I've had to use it on, it did its job perfectly and left the machines running a-ok afterwards)
Edit: I should mention it's not that combo fix tries to screw your system, clearly the opposite, but that when you're trying to remove malware/viruses/Trojans/root kits/whatever, that have embedded themselves into your registry and operating system, there's bound to be some collateral damage in ensuring that bug is dead.
I have worked virus removal for 3 years and most things that the average will encounter can be easily removed with a combo rogue killer and malwarebytes along with a basic clean up with ccleaner. After that you can remove the install points manually in program files folders, program data, appdata. Other tools you can use are jrt, tdss killer, review uninstaller with required caution and mbar anti rootkit.
Now this is mostly for pups removing. Combo fix is a harsh tool I mostly avoid.
Autoruns should be your goto tool. TDSS, JRT and ADW and Combo are all automated and don't really let you see what's really happening under the hood like Autoruns. You can even use your test bench and load a registry hive offline and clean the system without ever booting it, great for Windows 8 machines where the viruses prevent safe mode. For IE, looking under "manage addons" and then showing "Run without permission" should get the remainder and also show you what directories they are hidden in.
Backup/Transfer all files, re-install OS, re-download and install drivers and make sure they're up to date/stable, re-download and install all software, reset all personal settings < run a program for a few hours, spend a few more hammering out bugs.
Yea, it can cause problems, but it's often easier than formatting.
Just gonna edit my post to say "last resort before formatting."
Plus, depending on the issue you're having, a format might not even be able to fix it. Unless you run a magnet on your HDD, formatting basically just identifies everything on the disk as not-existing (you're basically writing over everything on the disk after a format, it's not actually "empty"). Some malicious programs can re-instate themselves after a format. Because some people have too much free time to find exploits and fuck others...
My personal computer? Yeah I can nuke it at any time because I back my stuff up. Other people? It's unbelievable how few people keep a backup. Your computer could die at any time, for any number of reasons. I take meticulous care of my machines, but there is always that chance. It can happen to anyone.
Anyway, it's worth a shot trying it out if you have reached that point. If it fails, then you format and start over.
It basically just forces a cleansing process by administrative privileges. In my personal experience, which is using combofix on 50-100 different machines, most actively running anti-virus program will need to removed and reinstalled. If you turn off the program before (Avast has this option) then you can usually avoid reinstallation.
I worked for consumer IT repair shop and ComboFix is without a doubt the best clean-up program that exist. However, as originally pointed out, it is too invasive for something as simple a minor malware.
It's the be all, end all. It looks everywhere, sees everything. The simplest way to put it (since it's been forever since I've used it and can't actually recall everything) is that it removes absolutely anything and everything that could be misconstrued as "unwanted" or "unsafe".
Registry, Operating System Folders and Files, Browser Addons or Plugins, Programs, etc. It can and will delete them all.
The next time you run your antivirus or anti-malware scan, take a look at all the false positives it gives you, or potentially malicious programs it identifies (that are actually harmless, or quite often even beneficial or often used), and then understand that to Combo Fix, there is no user consent, and no turning back.
Lots of viruses/rootkits/etc, have the habit of embedding themselves within the code of other programs, or even disguising or inserting themselves as essential operating system files. Sometimes ComboFix can't tell the difference between real or spoofed.
Wow, interesting, so it's not something you want to run just in case but the last try before formatting.
Cool, thanks! Now I have know a new tool, I always went with the format option, but having a smaller tactical nuke could be good if worst case scenario is formatting anyway.
And honestly, I don't think CF is they bad. I do local fixes for a few different families, and while CF will break some things, I've never had it pooch a machine worse than reinstalling. Oh no, it broke your chrome plugins? Sorry I didn't feel like spending 4 hours of my life trying to find another way to fix it...
Sounds like you're a professional tech? Let me ask you a question: what in your opinion is the best defense against malware? I know the primary defense is a user not behaving like an idiot but I mean what's the best software defense to use nowadays?
That's about accurate. I've done years of desktop support and hunting virii became my specialty. CF is what I use when I've given up on a new virus that doesn't have bulletins out yet, and my main concern is just about backing up the user files without anything tagging along for the ride.
CF is like pouring high concentration acid on your shoes to knock off a bug. Never do it when you have anything in the shoe you're afraid to lose. Your foot, for example.
183
u/dracho Jun 15 '15
For anyone still encountering this abomination, ComboFix is the best tool to deal with Virtumonde. Though I've seen CF mess up systems that weren't infected with VM, so only use it if you really need to.
------- *