Windows 7 virus win32/small.CA trojan Solved/Closed

Question

Hello, 

Windows action center has told me to "remove the Win32/Small.CA virus from your computer".

Since then my computer has blue screened many times, usually about 2 minutes after boot.

When I try to run scans with Kaspersky 2011 and MRT they are stopped for some reason (guessing the virus).

I have used scanned with , tdsskiller, ComboFix, Malwarebytes, ESET, windows defender, HitmanPro and SuperAntiSpyware. All of these find nothing.

Seems I'm a late catcher of this virus with a few posts on this around December 2011, but  haven't seen any solutions. Some talk about this being a false positive but with the amount of crashes that I'm getting.... bit dubious? 
 
Any help/tips would be much appreciated.
Cheers

Ambucias · Answer

Hi

First, I would like to know what is your operating system.

Second, I would like to know the complete error message you are getting on the blue screen.

Third, To help you and precribe the remedy, I must make a diagnostic and to do so, I require a system log. 
.

1. Open this link and download ZHPDiag2 : 

https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html 

(Don't be alarmed is the site is in French, it sometimes happens, the tool will take your system language and allow the download if you get a warning message. Once installed, click on the "hardhat" icon allows to change the language.)

2. Save the file on your Desktop. 

3. Double click on ZHPDiag.exe and follow the installation instructions. 

the tool creates three icons ZHPDiag, MRB, and ZHPFix (If necessary,we will use ZHPFix at the next step). 

4. Double click on the short cut ZHPDiag on your Destktop. 

5. Click on the screwdriver icon and ensure all of the items are checked.

6. Click on the Magnifying glass and run the analysys. 

Wait for the tool to finished (maybe a long time) 

7. Close ZHPDiag. 

8. To transmit the report, click on this link : 

https://authentification.site 

9. Click on Parcourir and search the directory where you installed ZHPDiag (usually C:\desktop\zhpdiag.txt). 

10. Select the file ZHPDiag.txt. 

11. Click on "upload » 

12. Copy the url and post it here.

Best regards

Ambucias
Security Contributor

Ambucias · Answer

Hi,

I have not yet looked at your log but the error code: 0x0000001e indicates that Windows has detected that the processor is attempting to process an unkown or invalid instruction.  This is most often due to a hardware driver.  The driver must eitheir be reinstalled or updated.  It causes a memory dump.

In your case, you should check video card, sound card, and printer driver as well as any other hardware you may have connected.

Please remember that all of your drivers should be compatible with your OS.

Catch you later with more

Ambucias · Answer

Hello Ross,

My first study of the log does not show obvious malware but there is a possible W32/Heuristic-210!Eldorado trojan.  I wish however to go about this with prudence.

1. I would like you to go to search for this file: pev.exe and tell me what the properties are.

2. I would like you to delete all of the antivirus applications you have recently downloaded except the one you have paid for.  More than one antivirus application will cause conflicts, not detect malware or cause false alerts.

3. On your desktop, ZHP Diag created ZHP Fix. Launch ZHP Fix and click on the large X.

4. Copy and paste the following lines which are redundant and obsolete processes or orphean keys:

O4 - HKCU\..\Run: [Mobile Partner] Orphean Key   
O4 - HKUS\S-1-5-21-185997528-2593348611-818886502-1003-185997528-2593348611-818886502-1000\..\Run: [Mobile Partner] Orphean Key  
O4 - Global Startup: C:\Users\Ross\Desktop\Uni Documents.lnk . (...)  -- \samba.soton.ac.uklh6g10 (.not file.) [MD5.00000000000000000000000000000000] [APT] [{13B1C6CA-32C5-41B4-8DCD-DC7610E9CD8D}] (...) -- C:\Users\Ross\Documents\Computer\Drivers\Intel_Chipset_V9301019_XPWin7\Driver\Chipset\setup.exe (.not file.) 
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\55334416.sys . (...) -- C:\Windows\System32\Drivers\55334416.sys (.not file.) 
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\55334416.sys . (...) -- C:\Windows\System32\Drivers\55334416.sys (.not file.) 
O87 - FAEL: "TCP Query User{8028B400-2AD1-4C0C-BF7F-FD5565809251}D:\easysetupassistant\wr941n\easysetupassistant.exe" |In - Private - P6 - TRUE | .(...) -- D:\easysetupassistant\wr941n\easysetupassistant.exe (.not file.)O87 - FAEL: "UDP Query User{5692377F-EC23-4C44-95FC-0DA3AAABC78F}D:\easysetupassistant\wr941n\easysetupassistant.exe" |In - Private - P17 - TRUE | .(...) -- D:\easysetupassistant\wr941n\easysetupassistant.exe (.not file.)

5. Click on GO

6. See if you got any improvement.  If not, launch ZHP Fix again, copy and paste the following lines:

O44 - LFC:[MD5.FE52E3AB6381CF6CC34D57BD28A6B2E0] - 26/06/2011 - 06:45:56 ---A- . (...) -- C:\Windows\PEV.exe   [256000]
O44 - LFC:[MD5.233566D0EE963948D3C4B6C31FD5D64F] - 07/11/2010 - 17:20:24 ---A- . (...) -- C:\Windows\MBR.exe   [208896]
O64 - Services: CurCS - 25/06/2010 - C:\Windows\System32\drivers
pf.sys (NPF)  .(.CACE Technologies, Inc. - npf.sys (NT5/6 AMD64) Kernel Driver.) - LEGACY

Click on GO

7. Give me feed back

Ambucias · Answer

I may be repeating myself but when you installed ZHP Diag, three icons were created on your desktop: ZHP Diag, ZHP Fix and MRB Check.

I meant to use ZHP Fix.  Double click it, at the top you will see a large H which stands for helper or hospital or hip hip hip hurrah.

The pev.exe in C:\combofix is probably in a quarantine file.
The pev.exe in C:\windows is the one I am interested in and which is 80% chance of malware.  I would like to know everything that is said under the tab "version".

After you have run ZHP Fix, I would like to know if the state of your machine is healthy.  Delete the previous ZHP Diag log from your machine and send me a new one for verification and further instructions.

Regards

P.S. Please, don't ha ha, this is serious stuff and I'm driving...entering a tunnel... catch you later

Ambucias · Answer

There is a bug!

Will get back to you tomorrow morning!

Sorry for the delay.

Ambucias · Answer

Please download and install this most recent version of ZHP Diag and tell me if you get the H in ZHP Fix

https://www.commentcamarche.net/download/telecharger-34066799-zhpdiag

Ambucias · Answer

The H was removed.

Just paste the lines and click on Go

Ambucias · Answer

Looks like you sent me the very same log as before.  Ensure that all the logs are deleted from the machine before generating a new one.

Sorry

Ambucias · Answer

Greetings Ross,

Well I'm happy to report that your system is virus free, as clean as a whistle.

There are however some redundant processes that are running which you can delete or stop using ZHP Fix.  They are:

[MD5.00000000000000000000000000000000] [APT] [{13B1C6CA-32C5-41B4-8DCD-DC7610E9CD8D}] (...) -- C:\Users\Ross\Documents\Computer\Drivers\Intel_Chipset_V9301019_XPWin7\Driver\Chipset\setup.exe (.not file.)   
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\55334416.sys . (...) -- C:\Windows\System32\Drivers\55334416.sys (.not file.)   
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\55334416.sys . (...) -- C:\Windows\System32\Drivers\55334416.sys (.not file.)   
O87 - FAEL: "TCP Query User{8028B400-2AD1-4C0C-BF7F-FD5565809251}D:\easysetupassistant\wr941n\easysetupassistant.exe" |In - Private - P6 - TRUE | .(...) -- D:\easysetupassistant\wr941n\easysetupassistant.exe (.not file.)   
O87 - FAEL: "UDP Query User{5692377F-EC23-4C44-95FC-0DA3AAABC78F}D:\easysetupassistant\wr941n\easysetupassistant.exe" |In - Private - P17 - TRUE | .(...) -- D:\easysetupassistant\wr941

Now, you mention that you do not have Internet.  I am not an Internet connection or configuration expert but a virus security contributor.

Nonetheless, I don't know what kind of Internet connection you priviledge. I have noted a few items which may ring bells to you or guide you to restore it.

1. You are using a proxy. (You can stop the use of a proxy in your Internet settings)
2. Seems that you have installed Wifi.
3. Google Chrome often creates connection problems
4. You Internet Explorer control panel has been deactivated.

Please delete Eset Online scanner as well as any other antivirus applications you may have installed except your Kaspersky which an excellent antivirus suite. (None are 100% proof)

Let me know about your internet connection.  I am keeping your log on file for 3 days, in case you need my help again.

Cherio! Chin up! See you in Tipperary!

Windows 7 virus win32/small.CA trojan

9 responses

Similar discussions

Subscribe To Our Newsletter!