Virus: Win32/Small.ca [Closed]

Hi icyjin,

You have some entries in the RogueKiller log that I need some additional information on.

The DNS entries suggest you are in Hong Kong, is this correct?

= = = = = = = = = = = = = = = = = = = =

Chkdsk for Vista/7

You must run the command prompt as an administrator or in an "elevated mode".

• Start menu, in the search bar type "cmd"
• Right-click the cmd icon, select "run as administrator"
  
  • If you have user account control (UAC) set up it may prompt you to accept that action.
• Then type in "chkdsk /r" (make note of the space between chkdsk and /)

In your next post please provide the following:

• Answer to the DNS inquiry
• chkdsk results

Hi OCD, Yes, this is Hong Kong here. For the chkdsk result, it shows that my resource is being used, which i need to reschedule it for restart. However, after i restart my computer and scan it, I can not find the location of the scan result. Icyjin

Hi icyjin,

To view the chkdsk results log:

• Open the Start Menu, and type eventvwr.msc in the search box and press enter.
• If prompted by UAC, then click on Yes (Windows 7) or Continue (Vista).
• In the left pane of Event Viewer, double click on Windows Logs to expand it, then right click on Application and click on Find.
• Copy and paste Chkdsk into the line, and click on Find Next.
• You will now see the system log for the scan results of Check Disk (chkdsk).
• In the right had menu select copy, open notepad and paste the chkdsk results into notepad
• Post in your next reply.

hi OCD, i can't copy it, there is an error Icyjin

Hi icyjin,

• Navigate back to the chkdsk log in the Event Viewer.
• On the General tab where the results are located
• Highlight the report, press the Control key (CTRL) + C key at the same time
• Open notepad and paste the contents of the report into notepad
• Post the results here.

Hi OCD, Thanks for your guiding with patient. here it is Log Name: Application Source: Microsoft-Windows-Wininit Date: 1/4/2013 13:30:54 Event ID: 1001 Task Category: None Level: Information Keywords: Classic User: N/A Computer: VictorLo-PC Description: Checking file system on C: The type of the file system is NTFS. A disk check has been scheduled. Windows will now check the disk. CHKDSK is verifying files (stage 1 of 5)… 155136 file records processed. File verification completed. 312 large file records processed. 0 bad file records processed. 0 EA records processed. 43 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)… 196180 index entries processed. Index verification completed. 0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)… 155136 file SDs/SIDs processed. Cleaning up 28 unused index entries from index $SII of file 0x9. Cleaning up 28 unused index entries from index $SDH of file 0x9. Cleaning up 28 unused security descriptors. Security descriptor verification completed. 20523 data files processed. CHKDSK is verifying Usn Journal… 34041944 USN bytes processed. Usn Journal verification completed. CHKDSK is verifying file data (stage 4 of 5)… 155120 files processed. File data verification completed. CHKDSK is verifying free space (stage 5 of 5)… 13792060 free clusters processed. Free space verification is complete. Windows has checked the file system and found no problems. 125837113 KB total disk space. 70324344 KB in 126373 files. 84608 KB in 20524 indexes. 0 KB in bad sectors. 259921 KB in use by the system. 65536 KB occupied by the log file. 55168240 KB available on disk. 4096 bytes in each allocation unit. 31459278 total allocation units on disk. 13792060 allocation units available on disk. Internal Info: 00 5e 02 00 dd 3d 02 00 09 41 04 00 00 00 00 00 .^…=…A…… 7a 09 00 00 2b 00 00 00 00 00 00 00 00 00 00 00 z…+……….. 90 8e 35 00 50 01 34 00 b8 19 34 00 00 00 34 00 ..5.P.4…4…4. Windows has finished checking your disk. Please wait while your computer restarts. Event Xml: 1001 0 4 0 0 0x80000000000000 10292 Application VictorLo-PC Checking file system on C: The type of the file system is NTFS. A disk check has been scheduled. Windows will now check the disk. CHKDSK is verifying files (stage 1 of 5)… 155136 file records processed. File verification completed. 312 large file records processed. 0 bad file records processed. 0 EA records processed. 43 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)… 196180 index entries processed. Index verification completed. 0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)… 155136 file SDs/SIDs processed. Cleaning up 28 unused index entries from index $SII of file 0x9. Cleaning up 28 unused index entries from index $SDH of file 0x9. Cleaning up 28 unused security descriptors. Security descriptor verification completed. 20523 data files processed. CHKDSK is verifying Usn Journal… 34041944 USN bytes processed. Usn Journal verification completed. CHKDSK is verifying file data (stage 4 of 5)… 155120 files processed. File data verification completed. CHKDSK is verifying free space (stage 5 of 5)… 13792060 free clusters processed. Free space verification is complete. Windows has checked the file system and found no problems. 125837113 KB total disk space. 70324344 KB in 126373 files. 84608 KB in 20524 indexes. 0 KB in bad sectors. 259921 KB in use by the system. 65536 KB occupied by the log file. 55168240 KB available on disk. 4096 bytes in each allocation unit. 31459278 total allocation units on disk. 13792060 allocation units available on disk. Internal Info: 00 5e 02 00 dd 3d 02 00 09 41 04 00 00 00 00 00 .^…=…A…… 7a 09 00 00 2b 00 00 00 00 00 00 00 00 00 00 00 z…+……….. 90 8e 35 00 50 01 34 00 b8 19 34 00 00 00 34 00 ..5.P.4…4…4. Windows has finished checking your disk. Please wait while your computer restarts. —————– Icyjin

Hi icyjin,

System File Checker (SFC)

• Click on the Start button and in the Search programs and files box type the following:
  
  
  • command
• Don't press Enter, just let the search results populate above.
• In the search results, locate the Programs section.
• Locate the Command Prompt shortcut and right-click on it.
• Select Run as administrator.
• Click Yes on the User Account Control window that appears.
• Important: If you are see a User Account Control window but also a message that says To continue, type an administrator password, and then click Yes, then your user account must be a standard account, not an administrator account. Before you can click Yes and open an elevated command prompt, you'll need to type the password of another user on your Windows 7 computer that has administrator level privileges.
• Note: You will not see this window at all if your User Account Control settings are turned all the way down. See How To Disable User Account Control in Windows 7 for more information.
• An elevated Command Prompt window will appear.
  
  
  • Type: sfc /scannow (There's a space between sfc and /scannow.)
• Type: exit to close the command prompt window
• Include the findings in your next reply

- - - - - Next - - - - -

Please run Eset Online Scanner

Administrator rights are required to run ESET Online Scanner

• Place a check mark in the box YES, I accept the Terms Of Use
• Click the Start button.
• Now click the Install button.
• Click Start. The scanner engine will initialize and update.
• Do Not place a check mark in the box beside Remove found threats.
• Click the Scan button. The scan will now run, please be patient.
• When the scan finishes click the Details tab.
• Copy and paste the contents of the C:\Program Files\ESET\log.txt into your next reply.

In your next post please provide the following:

• SFC scan results
• ESET's log.txt
• How is the computer running, any remaining issues?

Hi icyjin, Just checking in to see if you still need help?

Hi OCD, My computer still have sudden shut down problem, which i showed you the blue screen in my first post. I am not sure if that is the hardware problem or it is the virus that caused it. The computer would sudden shut down more frequently if I have a lot of softwares running at the same time. Furthermore, a lot of my softwares are corrupted right now after I run all the inspections wondering if the software components are deleted by them. For examples are deamon, and Media player classic. When I open daemon there is something saying that this software needs a minimum requirement of SPTD 1.6 and windows 2000 or above. Core trouble shooting software must be stopped. For media player classic playing in full screen, it would return back to normal size and says lose focus because some .exe is missing. May i know what caused it please? After the eset scan finished there is no detail tab. ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=77ba89cca1141044be7ca3907f2c9d54 # engine=13553 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-04-05 06:00:10 # local_time=2013-04-05 02:00:10 (+0800, China Standard Time) # country="Hong Kong S.A.R." # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=5893 16776573 100 94 56814 116772801 0 0 # compatibility_mode=8209 16776701 100 97 1534453 114337360 0 0 # scanned=273944 # found=0 # cleaned=0 # scan_time=4339 # nod_component=V3 Build:0x30000000 ————- Icyjin

Hi icyjin,

All the scans we have done recently are not showing any malware, therefore it may be a hardware issue. Let's try a few steps to see if we can clear up some of the issues your encountering.

= = = = = = = = = = = = = = = = = = = =

• Did you install any new software or hardware preceeding the Blue Screen Error message?
• Is you computer running hot?
• Is the cooling fan turning, is it unobstructed by dust?

If there is heavy dust accumulated on the fan blades you might want to get a can of compressed air and clean the fan blades.

- - - - - Next - - - - -

To re-enable your Emulation drivers, double click DeFogger to run the tool.

• The application window will appear
• Click the Re-enable button to re-enable your CD Emulation drivers
• Click Yes to continue
• A 'Finished!' message will appear
• Click OK
• DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.

- - - - - Next - - - - -


Click 'Start > Control Panel > Programs and Features. Locate and select the following that are present on the list and click the Remove button:

• Media Player Classic

- - - - - Next - - - - -

REBOOT

- - - - - Next - - - - -

Re-install Media Player Classic

In your next post please provide the following:

• Answers to the questions posted above.
• How is the computer running at the moment?

Hi icyjin, Just checking in to see if you still need help?

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic