Policy question...

May 11, 2011 at 19:28:04
Specs: Windows XP
Hi folks!!

Have a User that wants to use ComboFix. As you probably all know, this is not the tool for the 'average User'. It requires trained analysis, the use of scripts, etc. If not used properly, it can hose a computer so fast it can make your head spin.

What is the policy in this forum about referring a User to another forum where there are trained individuals providing guidance on the use of ComboFix? Would this be against any forum rules?

Thanks for your help.

See More: Policy question...

Report •

May 11, 2011 at 19:31:24

If that is the best way to fix the problem, I think that is OK. We want the user to get the best possible support.


Report •

May 11, 2011 at 20:09:05
Thanks for the quick reply, Justin!!

ComboFix is not a Malwarebytes Anti-Malware type of tool. I used to work with it, but it has been over two years, and no longer feel comfortable using it.

Much rather send the User to the Pros.

Have a great week!!

Report •

May 15, 2011 at 11:23:36
Just an FYI...

I often provide links to other forums when I know that a complete and concise answer to a question is available there.

Sometimes I'll see a question in the Office forum that I have general idea how to answer but need some help with the specifics. I'll go Googling around and check out other forums for ideas.

Most times I'll just adapt what I find at those forums to fit the specific question, but sometimes the discussion and/or explanation would be a worthwhile read for the OP, so I'll include the link.

I look at it this way:

We're here to help. Sometimes help can be provided in the form of a direct answer and sometimes help can be provided by pointing the person to a better source for the answer.

I follow the same rule in my life. I know I can't answer every question put to me at work or at home, but I tend to know where to send someone to find the answer.

My ego is not so big that I need to answer the question myself, I'm satisfied when I can help out by helping the person find the answer.

It's kind of funny, because even if I "send someone away" to find their own answer, they come back again and again because they remember that they started with me and in the end they got their answer.

That's good enough for my ego. ;-)

Click Here Before Posting Data or VBA Code ---> How To Post Data or Code.

Report •

Related Solutions

May 15, 2011 at 11:36:34
Excellent, DerbyDad03!!

My thoughts, exactly: "We're here to help. Sometimes help can be provided in the form of a direct answer and sometimes help can be provided by pointing the person to a better source for the answer."

Report •

May 15, 2011 at 11:51:33
Really no different than linking to a MSKB article or a manufacturers site for FAQ or drivers.

Report •

May 15, 2011 at 12:04:51
OTH: One could argue that there is difference.

The MSKB and/or a manufacturer's site is not necessarily a profit-making entity supported by the ad revenues and click-throughs like most forums are.

If I send a poster to the MSKB for an answer, odds are that they are going to come back here the next time they need help.

However, if I send them to another forum they may like that forum better and never come back here.

That could be a loss of revenue for Justin's bosses.

Click Here Before Posting Data or VBA Code ---> How To Post Data or Code.

Report •

May 15, 2011 at 12:09:48
I guess you may be correct. That said, I have on occasion sent folks to other forums. generally they are specialty forums.

Report •

May 16, 2011 at 22:35:50
Personally I have never thought about all of this. If I see a question that I actually know the answer to and it doesn't require me typing out a step by step statement that takes an hour to type then I just give it to them. If it is one of those that has many steps I give a link to where I find them and have never given thought to it being another forum. I guess for this I need to apologize at least to a certain point. My intent was never to send business elswhere but to help the poster. This has given me something to think about.


Report •

May 17, 2011 at 08:14:29
We may be talking about two different issues here.

One is providing a link to another forum, or to an information source, for the User to look at and apply as indicated, on their own.

The other is providing a link to another forum, and referring the User to that forum, so that the experts there can work with the User in resolving a complex infection, like Virut, certain TDSS variants, etc.

The initial post addressed the use of ComboFix. Some individuals are under the misconception that CF is another scanning tool. In reality, CF is a very complex tool that eliminates some malware, and provides reports of system files, drivers, etc., for trained eyes to determine what type of malware is still present, and whether further action is necessary.

One run of CF does not do the trick in many situations. Log analysis determines the type of scripts that follow, whether additional tool are needed, whether critical files need replaced, etc.

Having a User run CF as if it were Malwarebytes’ or a similar scanner is a dangerous business. If someone were looking at a CF report run on my computer, I would want the people that work with and analyze my CF report specifically trained to do so.

Report •

May 17, 2011 at 16:58:21

Perhaps you inferred something from my response to OTH that I didn't mean.

I was simply pointing out to OTH that there is a difference between providing a link to the MSKB vs. another forum because one involves a potential loss of income to this site while the other doesn't.

That did not mean that you or I or OTH or anybody else shouldn't provide a link to an answer if it's already been posted in another forum. I do it quite often, especially if the answer is so much better than I could ever provide without complete plagiarism.

Sometimes the discussion related to a question is just as important as the answer itself, and there is no easy way to duplicate that discussion in this forum.

I mean no harm to Justin or his bosses when I send someone elsewhere, but I also don't feel (too) guilty about it. Besides, if I don't have to spend 30 minutes typing a long drawn out answer to a question when that answer already exists someplace else, that's 30 minutes more I can spend helping more than one person here.

I think the net result favors

Click Here Before Posting Data or VBA Code ---> How To Post Data or Code.

Report •

May 17, 2011 at 21:26:45
Oh no I didn't take it the wrong way Derby I understood you rather well. It is not something I will be spending sleepless nights over it's just I had never given any thought that I could possibly be doing something wrong. I think maybe I am wording this all wrong. I am not saying that I feel any of us are trying to push people to other forums thereby limiting business here but after giving it some thought I could see how someone may see it that way if one of us posts a link to a different forum. I am sure none of the regulars here would feel that way as I am almost sure we have all done it one way or another.

I do agree that it may favor after all this is where the poster came and was at the very least given a direction to the answer. I have followed others links posted to find answers myself and I always come back here. In the end my statement was ment to say that I had never thought I could be perceived as doing harm to this site when I posted a link elswhere.


Report •

Ask Question