View Single Post
Old 09-01-2008, 03:11 AM   #43 (permalink)
amateur
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
 
amateur's Avatar
 
Join Date: Jun 2006
Location: USA
Posts: 7,420
OS: XP SP3


Re: heur trojan mess - Cannot Update OS - SP3 cannot find CLBCATQ dll's

Hi,

Quote:
I seemed to have uninstalled combfix, however I still get the comboFix related error on bootup: "Windows cannot find 'c:\combo-fix\combofix.bat'...."
It sounds like an old registry entry that may be causing it but I cannot see it in your logs. Are there any other user accounts?

Quote:
During the run of combofix /u I had an error:

cannot remove combofix.....

but it seems to be gone
Do you remember the end of that sentence? What was the reason it gave for not being able to remove combofix?

Also, an old copy of combofix may not have been properly uninstalled. C:\327882R2FWJFW belongs to Combofix, not a harmful item but AVG cannot differentiate the good use of hidec.exe from the bad use. The AVG report indicates that Combofix was not perhaps properly uninstalled, not necessarily now, perhaps at an earlier time. I suspected that and that's why I was asking if you had an older copy still installed.

Delete the Combofix and Combo-fix from your desktop if still present. Create a fresh Restore point (instructions below) just to be on the safe side, and then delete C:\327882R2FWJFW. Also delete these folders, if present: c:\combo-fix and C:\Combofix

Click Start Menu > Run > type (or copy and paste)

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it ( something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.

==============================

Restart the computer and if you're still getting the Combofix.bat error, post a fresh HijackThis log from every user account in the system.
__________________
My services are free. However, you can donate to TSF to help keep it running.




Member of ASAP since 2005
Member of UNITE since 2006
amateur is offline