Win32/Small.CA Where does this virus come from and how to i remove it?

Win32/Small.CA, How do i remove it? But at first, where does it come from i whant to know?

I downloaded trojan remover and i have Wat remover on my computer, and trojan remover alerted it.
I dont wanna tuch anything without knowing.

Can it be Wat remover that i have or is it something else?

/Thanks in advance for your replies

Hi UrAn,



My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

First off… it is unlikely that I will be able to tell you where this came from. Typically you would get it from something you downloaded.

Let's get some logs to see what we can see.

Download aswMBR.exe to your desktop.

Double click the aswMBR.exe to run it. If asked to download Avast's database please do so.

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]

There shall also be a file on your desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) folder. Please attach that zipped file in your next reply.



Please download DDS by sUBs from one of the following links and save it to your desktop.

• • DDS.scr
  • DDS.pif
• Disable any script blocking protection (How to Disable your Security Programs)
• Double click DDS icon to run the tool (may take up to 3 minutes to run)
• When done, DDS.txt will open.
• After a few moments, attach.txt will open in a second window.
• Save both reports to your desktop.

—————————————————

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

Hello! But i already have symantec endpoint. Anyway here is the report. aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-11-01 17:28:49 —————————– 17:28:49.150 OS Version: Windows x64 6.1.7601 Service Pack 1 17:28:49.150 Number of processors: 2 586 0xF0B 17:28:49.150 ComputerName: SUPERMAN886 UserName: BL4ck w0lf 17:28:51.930 Initialize success 17:29:00.404 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-2 17:29:00.414 Disk 0 Vendor: ST980813AS 3.AHE Size: 76319MB BusType: 11 17:29:00.444 Disk 0 MBR read successfully 17:29:00.454 Disk 0 MBR scan 17:29:00.454 Disk 0 Windows 7 default MBR code 17:29:00.474 Disk 0 Partition 1 00 07 HPFS/NTFS NTFS 155 MB offset 2048 17:29:00.494 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 76159 MB offset 321300 17:29:00.504 Disk 0 scanning C:\Windows\system32\drivers 17:29:19.668 Service scanning 17:29:44.166 Modules scanning 17:29:44.226 Disk 0 trace - called modules: 17:29:44.246 ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys >>UNKNOWN [0xfffffa80021942c0]< \Device\Harddisk0\DR0[0xfffffa80027a6790] 17:29:44.266 3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa80027a6040] 17:29:44.286 5 hpdskflt.sys[fffff88001b7d189] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-2[0xfffffa8002667680] 17:29:44.286 \Driver\atapi[0xfffffa800263ae70] -> IRP_MJ_CREATE -> 0xfffffa80021942c0 17:29:44.296 Scan finished successfully 17:32:53.444 Disk 0 MBR has been saved successfully to "C:\Users\BL4ck w0lf\Desktop\MBR.dat" 17:32:53.454 The log file has been saved successfully to "C:\Users\BL4ck w0lf\Desktop\aswMBR.txt"

how do i insert a image from my computer? I wanted to send you a screenshot.

Symantec Endpoint is your AV. The tools I had you download are not security programs. They are just scanners to give me a log that provides me with the information I need to try to help you solve your problem.

Have a look at this thread for some various ways to take a screen shot: http://forums.whatthetech.com/index.php?showtopic=100628

Don't forget to post your DDS logs. If what you want to post a screenshot of is your screen when you tried to run DDS…. the .scr version will not work if you have AutoCad installed. You will just get a bunch of gobbledygook . Use the .pif version.

Symantec Endpoint is your AV. The tools I had you download are not security programs. They are just scanners to give me a log that provides me with the information I need to try to help you solve your problem.

Have a look at this thread for some various ways to take a screen shot: http://forums.whatthetech.com/index.php?showtopic=100628

Don't forget to post your DDS logs. If what you want to post a screenshot of is your screen when you tried to run DDS…. the .scr version will not work if you have AutoCad installed. You will just get a bunch of gobbledygook . Use the .pif version.

Thx Tomk But i have fix it now thanks for all your help and i will post if i need some more help.

/Uran

I'm glad your fixed.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.