ok i was on combfix's info site http://www.bleepingcomputer.com/combofix/how-to-use-combofix and it gave a list of forums to ask for help and this was the random forum i clicked on , i just have a simple question which doesn't seem to have any mention anywhere which is how can i configure this program to scan certain things other than just the pc itself? it was already fixed by having a rootkit and other stuff removed with this program i believe and now i want it to scan my external hdd but there doesn't seem to be any option to do that?…..
You should have read the whole introduction and you would have seen this:
You should not run ComboFix unless you are specifically asked to by a helper. Also, due to the power of this tool it is strongly advised that you do not attempt to act upon any of the information displayed by ComboFix without supervision from someone who has been properly trained. If you do so, it may lead to problems with the normal functionality of your computer.
It is VERY silly to run this or any other diagnostic or "fixing" tool on your own.
If you want your computer checked for infections by the Malware Team, you should first read this and then start a topic here.
no i already said my com was already cleaned with the help of that program and i don't want to run it again for my com i want to know if i can run it to just check my external hdd , if not then i'll just have to end up formating it…….
Hi iamli3,
Satchfan has given you excellent advice.
We are not willing to provide any advice to you on running Combofix unless it is under the supervision of a malware removal expert operating in the Virus and Spyware removal forum.(links provided in Satchfan's post)
This is for the safety of your computer… Combofix is a powerful tool and should only be run under the direction/supervision of a person trained in its use.
Regards
paws
??
is there any data on the drive you want to keep?
if so then personally i think i'd connect the drive to the pc, don't open/access it, just use whatever anti-virus software your running to scan the drive.
then again without opening/accessing anything on it i'd do a 2nd opinion scan using the free version of mbam. :- http://www.malwarebytes.org/
if there is any malware on the external drive then that should find and clean it, ready to be accessed and used as normal.
if there's nothing on it you want to keep tho, then fair enough destroy what's on there, personally tho i wouldn't rely on a format only to ensure there's no malware left on it, i'd actually zero the drive first before formatting it.
i don't know if there's any data on it that i haven't copied over to my current com , that's why i'd like to clean iot to be able to look at it rather than format it , plus i don't want to be without a backup hdd at any time , not to mention transferring all that data takes a really long time -.-'…
thing is malewarebites and anti av programs wont be enough as they were unable to detect the rootkit that was infecting this com , so even if i use those programs i can't know for sure if it's safe to connect it
"i'd actually zero the drive first before formatting it."?…..
"excellent advice." , but didn't answer my question , guess i'll just have to end up formating my external then….
I believe I can answer your question…
It appears that your question is "How can I make ComboFix do what I want it to do and use it as I want?"
The answer is simple… you can't. Nothing that you have described is in line with what ComboFix was designed to do. As has been already stated… ComboFix can be dangerous to your system in untrained hands… I would add that the risk is amplified when put against a rootkit.
An analogy… what you are asking is something akin to "I'm installing a bolt. I'm going to use a hammer to do it. Someone please tell me how."
sorry don't know enough about malware to know if running those scans will find any rootkits on the hard drive or not, but from my understanding they should, it's when a rootkit has installed itself that it's able to hide from any scans, but i may be totally wrong because it's not my area of expertise.
not even sure if you need to make sure windows auto run or something is off before even connecting the drive to ensure no rootkit can re-infect your pc.
so maybe one of the malware experts will offer their opinion about that.
"zero a drive" means exactly that, you write 0's to the hard drive to overwrite any and all data on it, also known as wiping a drive.
just formatting a drive doesn't actually destroy or over write any data on a drive, it just removes the information that tells the operating system where all data is stored on the hard drive, thereby leaving all data including any malware still there.
yes i do have to make sure auto run is off so the com doesn't try to open up the external when i will connect it
and i see , thanks for that info , so it's saying since im using windows 7 doing a format through this os will wipe the whole drive as long as i make sure there aren't other partitions on it left unformatted right?…..
well according to that link, i either didn't know or had forgotten that since vista doing a full format in windows will automatically write the partition/drive with zero's which is exactly the same as what i always do manually to a drive before formatting it. note. a quick format and full format are not the same tho and only the full format zero's the drive.
so yes if that link is correct with win7 a format of all partitions will zero the drive and is good enough protection against any malware that may be left behind in my humble opinion.
