How can I be sure if I am still infected with "Win32/Small.CA" virus".

shiphen · 16 Nov 2012

(On Win7 x64 computer)
Yes, Windows Defender was already off.
So I rebooted.
Yes, MSE is running - goes straight to a green icon.
Yes, Windows Defender is now still already off.
Yes, Windows Update is now set at "Check for updates but let me choose whether to download and install them"
BUT MSE wont run an update and TrustedInstaller.exe is back to running 25% of my CPU... indefinitely it seems.

On my WinXP PC there is no sign of trustedinstaller.exe
AVG has an "!", but when I run update on it, it does appear to update. It may have been unhappy about linkscanner being switched off so I switched that back on. Even so the "!" was still there. So I rebooted. Unfortunately the "!" is still there. It is saying "You are not fully protected". Looking more closely I think it may need to be connected to my place of work. So I opened up a VPN to work. But that didnt seem to solve the problem so I'm not going to worry about that "!".

Jacee · 16 Nov 2012

Please don't run both MSE and AVG!! They are both resource hogs and will compete for your system's resources. They may also fight each other's virus definitions.

Uninstall AVG with remover Comprehensive List of Uninstallers or Removal Tools for Antivirus Software

Tell me if "Trusted Installer" is still taking up the CPU

shiphen · 16 Nov 2012

No! AVG is on my WinXP laptop, MSE is on my Win7 (x64) home computer.

YES, effing Trusted Installer is still on my home PC.
It is still running my CPU at 25%.
It is still stopping MSE from updating too.
The only way I can update MSE seems to be to kill the trustedinstaller.exe process in either task manager or in Services.

Fwiw, my work PC is using Win 7x64 and AVG and does not have a Trusted Installer problem. There again our office network management company have stopped us updating our PCs...

J (Getting increasingly desperate)

Jacee · 16 Nov 2012

Read this and see if it helps: Service TrustedInstaller.EXE prevent updates in my Win 7 32 PC - Microsoft Community

shiphen · 16 Nov 2012

I had already set the Window Update to the settings suggested.

This bit is deeply frustrating because there is no such menu item on my Control Panel:
i.e. "System and Security" does not exist. WTF?
On this page: How do I clear the problem report history from my computer?

>>>
Open Action Center by clicking the Start button , clicking Control Panel, and then, under System and Security, clicking Review your computer's status.
2.
Click Maintenance, and then, under Check for solutions to problem reports, click View reliability history.
3.
Click View all problem reports.
4.
At the bottom of the Review problem reports page, click Clear all problem reports.
>>>

Meanwhile I searched for "Mainenance" on my PC and found something called "System Maintenance / Clean up unused files and shortcuts and perform other mainenance tasks"
It then cleared some space in the error logs or something similar...

I then searched for Reliability
and it took me to a place called:
"Control Panel\All Control Panel Items\Action Center\Problem Reports"

I then tried to delete everything but I can see that I am getting a vast number of "WindowsWcpOtherFailure3" problems - they are coming in every couple of seconds in fact.

Here is one of these problems in more detail:

Problem signature
Problem Event Name: WindowsWcpOtherFailure3
OsVersion: 6.1.7601
File: base\lstring\lblob.cpp
Function: RtlTranscodeLBlobs
Line: 2221
Status: c0000161
StackHash: 0xe2a94a52
OS Version: 6.1.7601.2.1.0.256.48
Locale ID: 2057
Extra information about the problem
Bucket ID: 1947205397

However if I kill that goddamned TrustedInstaller.exe using TaskManager to kill the thread, then these errors stop arriving every 3 seconds. The only problem is that if I dont kill the entire thread tree then effing TrustedInstaller.exe re-appears in TaskManager, and sure enough these Problems (i.e. called "WindowsWcpOtherFailure3") immediately start to re-occur too.

Update:
No, it's worse than that. Killing TrustedInstaller.exe in TaskManager only kills it for half a minute and then it comes back. I need to "stop" Windows Update in services.

WTF? Why is this so hard...

Jacee · 16 Nov 2012

This bit is deeply frustrating because there is no such menu item on my Control Panel:
i.e. "System and Security" does not exist. WTF?
On this page:

This is listed on the "White flag" (in the task bar) if you mouse over it... not a problem!! You Have Win7 Pro 64 bit, I have Win7 Ultimate 32 bit. You may not see the same things I do.

I am experienced in Security issuses, Malware/Trojans/Viruses/Spyware/ etc ... I have very little experience in helping you with Event Name: WindowsWcpOtherFailure3, and the cause of Windows 7 update failures.

You may want to Perform a clean startup to determine whether background programs are interfering
http://support.microsoft.com/kb/331796

shiphen · 16 Nov 2012

Jacee said:

This bit is deeply frustrating because there is no such menu item on my Control Panel:
i.e. "System and Security" does not exist. WTF?
On this page:

You may want to Perform a clean startup to determine whether background programs are interfering
http://support.microsoft.com/kb/331796

I have just tried that. Mr Fixit found a problem, said he had fixed it, but in fact failed to fixe the bloody thing. Honestly Microsoft has SUCH deep problems. All manner of semi-automated tools to fix all manner of complex problems... but they dont actually work. Damn it.

Out of pure desperation I also tried uninstalling every program that I dont definitely need. I was going to uninstall Explorer version 9, except Windows is refushing to show me any updates at all...

It's beginning to look like a re-installation of Window 7 would have been quicker - but very very VERY painful because Outlook to months to get right.

GODDDDDDD !

Jacee · 17 Nov 2012

I see your Windows 7 is a "Custom build". Did you upgrade from Vista Business to Windows 7 Pro?

Jacee · 17 Nov 2012

Download HijackThis! (free)
http://www.bleepingcomputer.com/download/hijackthis/
Right click to run as Administrator ... Click 'Do a System Scan and Save logfile'.
The HJT log will open in notepad.
Copy and paste the HJT log from notepad.

Gott'a see what else is running for my own piece of mind

shiphen · 17 Nov 2012

Jacee said:

I see your Windows 7 is a "Custom build". Did you upgrade from Vista Business to Windows 7 Pro?

I'm not sure what a Custom Build is exactly. I bought the PC from a formal company who I suppose put it together on a custom basis, I'm not too sure. The hard disk crashed so I bought a SSD and re-installed Windows 7 on that from scratch. So, no it was not an upgrade.