Apex Logic

Have you ever been in a situation where you are unsure if your Anti-Spyware tool did anyting to actualy remove malicious code? Or worse yet, the very thin you wanted it to remove is NOT removed?

Well before you body slam your PC like a WWF wrestler, you may wat to utilize ComboFix, a handy little tool from our friends at bleepincomputer.com.

Their tool removes such die hards as: SurfSideKick, QooLogic, Look2Me or any combination of that group. It also does a nice job of removing those pesky Vundo infections.

One of its advanced capabilities is to identify and list recently created files which can give you clues to other infections. You can use it to unhook any dll in the system32 folder as well as delete up to 8 files using its command line functions.

Also it deletes a bunch of files related to the infections above automatically and stays updated fairly regularly (as a matter of fact, it even expires itself to ensure you have the latest version).

To use combofix, download the executable from bleepingcomputer.com to your system. There are detaled instruction located in the forums, but the simple way to run it is: to double click combofix.exe and follow the prompts.

When finished, it shall produce a log for you which you can review.

(Note: Do not mouseclick combofix’s window while its running as it can cause the tool to lock up.)

Lastly, this is a serious tool so if you do not have a serious need for a tool like this then DO NOT USE IT! Consider it a “last resort” tool in your arsenal, as it is not discriminatory in what it will remove.

Utilize your existing tools first as they are more “user friendly” and tend to fall on themore cautious side.

As the developer himself states - “It is best deployed by those who are trained in what its findings reveal and different computers will have different infections and require different ways to remove some infections.”

This entry was posted on Tuesday, April 22nd, 2008 at 1:36 pm and is filed under Application, Technology. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.