What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

win32/small.ca [Solved]

24 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Satchfan, I downloaded TDSSKiller from your link, ran the scan. It ran for about 20 seconds and, as usual, produced no log for me - just says that 0 objects were found. I went to the C drive to look at what it produced as a text and it's the same garbage as I sent you previously. What's going on??
Post #17
I don't know.

Try running it in safe mode.

Run RogueKiller

IMPORTANT: Please remove any usb or external drives from the computer before you run this scan!

Close all running programs.

Download RogueKiller to your desktop.
  • close all running programs
  • for Windows Vista/Seven, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
  • when the pre-scan is finished, click on Scan
  • click on Report and copy/paste the content in your next post
  • NOTE: DO NOT attempt to remove anything that the scan detects –everything that is reported is not necessarily bad
If the program is blocked, continue to try it several times. If it still doesn’t work, (it could happen), rename it to winlogon.exe.
Please post the contents of the RKreport.txt in your next reply.

Satchfan
Post #18
Yeah, I almost tried it in safe mode yesterday but wanted to wait for you to make sure it was OK. Will do both today. I have bills to pay online - any chance that it's safe to do that now or just wait? Thanks,
Post #19
Here is rogueKiller log. TDSSKiller gave me the same garbage in safe mode so not sending that to you.

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : kay [Admin rights]
Mode : Scan – Date : 03/31/2013 10:39:39
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤
[HJPOL] HKLM\[…]\System : DisableRegistryTools (0) -> FOUND
[HJPOL] HKLM\[…]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
–> C:\windows\system32\drivers\etc\hosts

127.0.0.1 localhost


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST9500325AS +++++
— User —
[MBR] 7a5b9f4bf1baa8c2dbe6511c9a05de24
[BSP] 66514568a4468af9bf19769806dfe6ec : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 200 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 411648 | Size: 431938 Mo
2 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 885020672 | Size: 29692 Mo
3 - [XXXXXX] COMPAQ (0x12) [VISIBLE] Offset (sectors): 945829888 | Size: 15109 Mo
User = LL1 … OK!
User = LL2 … OK!

Finished : << RKreport[1]_S_03312013_02d1039.txt >>
RKreport[1]_S_03312013_02d1039.txt
Post #20
Have you tried disabling BitDefender before running TDSSK?


I have bills to pay online - any chance that it's safe to do that now or just wait?

I would say that it is safe to do as nothing is pointing at there being a current bad infection present.


Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1
Download Mirror #2
  • double-click SystemLook.exe to run it.
  • copy the content of the following codebox into the main textfield - please make sure you include the colon, (:), at the beginning.:

    :filefind
*ssuhop*

:folderfind
*ssuhop*

:Regfind
ssuhop

  • click the Look button to start the scan.
  • when finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Satchfan
Post #21
I thought I had done TDSSKiller with Bitdefender disabled but I did it again to be sure and got the same stupid symbols. SystemLook log attached: SystemLook 30.07.11 by jpshortstuff Log created at 11:23 on 31/03/2013 by kay Administrator - Elevation successful WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results. ========== filefind ========== Searching for "*ssuhop*" No files found. ========== folderfind ========== Searching for "*ssuhop*" No folders found. ========== Regfind ========== Searching for "ssuhop" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SSUHOP] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SSUHOP\0000] "Service"="ssuhop" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SSUHOP\0000] "DeviceDesc"="ssuhop" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ssuhop] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ssuhop\Enum] "0"="Root\LEGACY_SSUHOP\0000" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SSUHOP] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SSUHOP\0000] "Service"="ssuhop" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SSUHOP\0000] "DeviceDesc"="ssuhop" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\ssuhop] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSUHOP] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSUHOP\0000] "Service"="ssuhop" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSUHOP\0000] "DeviceDesc"="ssuhop" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ssuhop] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ssuhop\Enum] "0"="Root\LEGACY_SSUHOP\0000" -= EOF =-
Post #22
Open ComboFix

Please do the following:
  • close any open browsers.
  • close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
  • open notepad and copy/paste the text in the codebox below into it:
Driver::
SSUHOP

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it produces a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.

Thanks

Satchfan
Post #23
I think I am really screwed. The program, Combofix, as I remembered would only run in safe mode. It still didn't go past the 4th stage in regular mode and \i let it work for over an hour. So this moring \i went into safe mode and did as requested. When \i went back to send the log to you, it said \i couldn't log on with either Chrome or Explorer because the registry keys were scheduled for deletion. \i didn't do anything to ask for any program to delete anything since yesterday. \i am on my husband's computer now. \i am totally sick - what has happened.
Post #24 last edited
Let's take a step back.
• restart your computer and hit the F8 key constantly until a menu shows up
• use the arrow keys to navigate to Last Known Good Configuration
• press Enter
Let me know how it goes.
Post #25
That seems to have gotten me back. Sorry, I freaked out - went out and had a few last night. OK - thanks. So, did a virus cause this to happen or something I did wrong or…….
Post #26

did a virus cause this to happen or something I did wrong or…….

I don’t know what happened but it disturbs me that TDSSKiller won’t run and ComboFix didn’t run in normal mode so I’d like another scan to see what else shows up.

Run DDS

Please download DDS by sUBs from one of the following links and save it to your desktop.

DDS.pif
DDS.com

  • disable any script blocking protection (How to Disable your Security Programs)
  • double click DDS icon to run the tool (may take up to 3 minutes to run)
  • when done, DDS.txt will open.
  • after a few moments, attach.txt will open in a second window.
  • save both reports to your desktop.
  • Post the contents of the DDS.txt and Attach.txt reports in your next reply
Please include the following in your next post :

DDS.txt
Attach.txt

Thanks

Satchfan
Post #30
You need to disable BitDefender antivirus and Windows firewall - the others are not real-time protection

This is probably why we had problems with the other programs.

If necessary, click here for information on how to disable them.

Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI