do you use combofix remotely?

[marcink99]

I did couple times. But I dont like the idea that something can go wrong and Iam not seeing screen.

 

[Xander]

I've done it a few times but only when I've had unattended access and knew that I could reconnect.

I've done it more, for practice's sake, by remoting into a machine on my workbench behind me. Let's me stay at my desk -and- build confidence in my remote skills.

 

[Slaters Kustum Machines]

Yes. I have the customer call me when the text file is displayed and if I have not had a response in 30 mins. I call to check in.

 

[marcink99]

when you run it do you tell costumers that things could go wrong?

Also has anybody heard of malware removal school at www.bleepingcomputer.com/ ? I tried looking for some info on it but no luck. My gues is that teach you more on combofix but I may be wrong.

 

[Slaters Kustum Machines]

I only use Combofix as a last resort before an NDR/FDR so the customer is aware of what could happen.

 

[xxsilk109xx]

I have not had combofix give me any problems any time that I have ran it, nothing that usually cant be solved by a restart. But I tell all my customers that in reality almost anything can happen during virus removal..

 

[YeOldeStonecat]

I have used it remotely many times...yes. No problems doing so.

 

[Marius]

I have not had combofix give me any problems any time that I have ran it, nothing that usually cant be solved by a restart. But I tell all my customers that in reality almost anything can happen during virus removal..

I totally agree...NEVER had probs with Combofix...there is ONE snag though...Just remember to ALWAYS delete the autorun.inf that Combofix leaves in your registry, otherwise the PC won't Autorun...

 

[hondablaster]

Running it on an encrypted drive may keep it from booting on restart. In these cases running a decryption task with the emergency disk allowed the computer to boot up and the malware was removed. Then we simply encrypted the disk again.

There is a part the encrypted drive that needs to stay in tact in order to boot the drive properly and Combofix removes that part for certain infections for whatever reason(s). Bootsector rebuild/MBR etc.

A good idea may be to decrypt first if running combofix remotely.

 

[Mr.Mike]

I've done it more, for practice's sake, by remoting into a machine on my workbench behind me. Let's me stay at my desk -and- build confidence in my remote skills.

++1 to this as it's one of the best ways to teach yourself w/o serious risk.

 

[DCGPX]

I've done it a few times but only when I've had unattended access and knew that I could reconnect.

I've done it more, for practice's sake, by remoting into a machine on my workbench behind me. Let's me stay at my desk -and- build confidence in my remote skills.

TBH never thought of this! I use Techinline so would cost me a few session credits but would be worthwhile to see how its goes from a client viewpoint.

Good idea eHousecalls!

 

[Larry Sabo]

TBH never thought of this! I use Techinline so would cost me a few session credits but would be worthwhile to see how its goes from a client viewpoint...

Only costs you one session if multiple connects are within a 12 hr window. Contact them if the connections are not consolidated automatically, which sometimes happens.

 

[IT_girlpower]

combofix

our service desk uses it all the time, remotely. In fact i hate how much they use it but it never has caused issues. the only reason i hate them using it is they do not try other resolutions first. and i have learned once you stick yourself on one path, it is easy to get stuck there.

 

[Marius]

i have not had combofix give me any problems any time that i have ran it, nothing that usually cant be solved by a restart. But i tell all my customers that in reality almost anything can happen during virus removal..

.....................
+1