How can I be sure if I am still infected with "Win32/Small.CA" virus".

[Jacee]

It's really important, if you value your PC at all, to stay away from P2P file sharing programs, like utorrent, Bittorrent, Azureus, Limewire, Vuze.
Criminals have "planted" thousands upon thousands of infections in the "free" shared files.
Some of these infections can turn your machine into a doorstop.

It's also very important to avoid any "cracks" or "Keygens" that allow unauthorized use of programs.
Besides being illegal, these files also are loaded with "planted" malware.

Pirated program: c:\program files (x86)\adobe\adobe dreamweaver cs5.5\configuration\taglibraries\html\keygen.vtm
Please remove this program!

 

[shiphen]

Yikes - I'm genuinely not sure how that keygen thing got there. I paid good money for my Dreamweaver!

Anyhow I've deleted Dreamweaver off my laptop.

Btw, there is also a file called KEYGEN.html (in C:\Program Files (x86)\Macromedia\Dreamweaver MX 2004\Configuration\Content\Reference\HTML) on my Windows 7 machine. Do I need to uninstall dreamweaver (MX 2004) from that machine too?

Meanwhile, how bad do the rest of my systems look?

With thanks
J

 

[shiphen]

@vincenso - yes I like your disk imaging ideas. Definitely something worth considering for next time. Right now as @Golden has spotted, I am concerned that all my data could be unsafe/infected too!

Btw, one thing that puzzles me is how come AVG and/or MSE anti-virus software applications have failed to spot/kill viruses as they arrive. I mean everything that opens is apparently being scanned (which, btw, is something of a pain as it seems to me that they tend to slow things up big-time...)

J

 

[shiphen]

Do I need to re-run anything now?
Many thanks
J

 

[Jacee]

Run CKScanner again and post the text results. Also, let me know how your computers are running now.

 

[shiphen]

Hi

A) On my WinXP laptop, ckscanner.exe gives:

CKScanner 2.1 - Additional Security Risks - These are not necessarily bad
scanner sequence 3.MN.11.BBAPXH
----- EOF -----

I've not been using it much but the laptop seems fairly unresponsive and slugging, but not excessively so(?)


B) On my Win7 x64 Home PC skscanner.exe gives:

CKScanner 2.1 - Additional Security Risks - These are not necessarily bad
scanner sequence 3.RP.11.ABAALO
----- EOF -----

This machine has suddenly started to run very fast in the last 2 or 3 days

J

 

[shiphen]

ALSO
I desperately need to sync data with my work PC (Win7 x64).
What should I run on my work PC, (in what order) to look for bad stuff?

J

 

[Jacee]

Uninstall Combofix .....

Click on the Start button and then select Run from the menu. This will open up the Run box.
Copy/Paste combofix /uninstall (Please note that there is a space between combofix and /uninstall), click on the OK button or Enter on your keyboard.
You can now delete the ComboFix.exe program from your computers.

Next, download TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

 

[shiphen]

==> On my Home PC (Win7 x64):
I managed to uninstall Combofix. It moaned about MSE still running but seemed to proceed okay. I also ran TFC successfully and it then re-booted. When I logged back in I discovered MSE had stopped realtime scanning, so turned it on again.

==> On my laptop (WinXP)
Combofix did not appear to still be loaded. I searched for with Everything desktop search but no sign of the Combofix.exe file itself. Anyhow so then I rans TFC.

Now what?

==> And what precautions do I need to take on my work PC (Win7 x64) - with whom I have been sharing my documents until recently?

With many thanks

J

 

[shiphen]

Any more thoughts?

J

 

[shiphen]

Jacee - Help!

OK out of desperation I have now attemped to install the Microsoft patches. Windows did install some of them but keeps failing to install the last 7 patches.
What should I do now. But Jacee now seems to have gone cold... Can anyone else please help??

 

[Jacee]

Oooo, sorry I'm late

If you're trying to install more than one or two patchs at a time ... don't. Just stick with a couple.

Tell what won't install and for which computer.

 

[Jacee]

On your WinXP ... Combofix was running from this location:
c:\documents and settings\alec\Desktop\ComboFix.exe

 

[shiphen]

Jacee - my saviour! Welcome back

On my Window 7 home PC the following wont install:
- Cumulative Security Update for Internet Explorer 9 for Windows 7 for x64-based Systems (KB2761451)
- Security Update for Microsoft .NET Framework 3.5.1 on Windows 7 and Windows Server 2008 R2 SP1 for x64-based Systems (KB2729452)
- Security Update for Windows 7 for x64-based Systems (KB2727528)
- Update for User-Mode Driver Framework version 1.11 for Windows 7 for x64-based Systems (KB2685813)
- Update for Windows 7 for x64-based Systems (KB2750841)
- Update for Windows 7 for x64-based Systems (KB2761217)
- Update for Windows 7 for x64-based Systems (KB2763523)

What should I do on my laptop? Should I run ComboFix again?

P.S. I seem to have deleted ComboFix.exe (I cant find on either machine) - should I download it again?

J

 

[Jacee]

No, don't download Combofix again.

This patch (KB2761451) is most likely the only one you need right now. Also read here: KB2761451 — Krebs on Security

What I DO want to see right now is a scan with ESET from both XP and Win7 computers. Instructions, once again:

1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
   ESET OnlineScan
2. Click the
   
   button.
3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
   1. Click on
      
      to download the ESET Smart Installer. Save it to your desktop.
   2. Double click on the
      
      icon on your desktop.
4. Check
   
5. Click the
   
   button.
6. Accept any security warnings from your browser.
7. Check
   
8. Push the Start button.
9. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
10. When the scan completes, push
    
11. Push
    
    , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
12. Push the
    
    button.
13. Push
    

 

[shiphen]

I just panicked and re-ran Malwarebytes AntiMalware (Free) on My Windows 7 computer.

And it found something:
Item: C:\Users\Alec\AppData\Local\Google\Chrome\Application\21.0.1180.83\chrome_frame_helper.exe
Vendor: Trojan.Agent
Result: "Quarantined and deleted successfully."

YIKES!
And my WinXP laptop has got the same problem!
I just ran Malwarebytes on it

C:\Documents and Settings\alec\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.83\chrome_frame_helper.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Should I uninstall Google Chrome on both computers?

J

PS On my both my Win7 PC and my WinXP laptop it says: "No threats found" - (although I have to tell you that the WinXP scan too over 5 hours!)


PPS Please excuse me for jumping ahead but I need to push ahead as my livelihood cant wait.
So I have just run CCleaner and then SUPERAntiSpyware.
Bizarrely SuperAntiSpyware seems to have found a cookie (despite me asking it to delete cookies in all 3 of my browsers) called
> Adware.Tracking Cookie
> C:\Users\Alec\AppData\Roaming\Microsft\Windows\Cookies\5YC1YS3L.txt [/accounts.google.com]

Also it found:
> (x86) HKML\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EHSHELL.EXE
> (x86) HKML\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EHSHELL.EXE#Debugger

More news as I get it...

 

[Jacee]

Yes, go ahead and uninstall Google Chrome. Once everything is cleaned up, you can reinstall it again. At that point you will want to set a Clean System Restore point!

 

[shiphen]

1. Okay I have uninstalled Google Chrome from all 3 PCs (Home -Win7, Work - Win7, and laptop).

2. I just ran SUPERantispyware all 3 computers. The others where clean but my Home PC found this:

>>>
SUPERAntiSpyware Scan Log
SUPERAntiSpyware | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!
Generated 11/14/2012 at 06:00 PM
Application Version : 5.6.1014
Core Rules Database Version : 9582
Trace Rules Database Version: 7394
Scan type : Complete Scan
Total Scan Time : 00:13:50
Operating System Information
Windows 7 Professional 64-bit, Service Pack 1 (Build 6.01.7601)
UAC Off - Administrator
Memory items scanned : 842
Memory threats detected : 0
Registry items scanned : 73123
Registry threats detected : 2
File items scanned : 84553
File threats detected : 0
Security.HiJack[ImageFileExecutionOptions]
(x86) HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EHSHELL.EXE
(x86) HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EHSHELL.EXE#Debugger
>>>

I asked it to (delete?) the items and have just rebooted it.
Unless you stop me I shall get it to run SUPERAntispyware.

Btw, please can you give my more instructions to do at once. Sorry but all this is simply taking too
long. e.g. please can you give me a number of scans to run in sequence or WHATEVER IT TAKES !
Which reminds me - do I need to change my windows password in case I had a trojan that could use the old one to get in???

Or so I need to cut my losses and format some or all of the disks of my PCs?
And if so how the heck can I make sure that my data is clean?

Many thanks

J

 

[Jacee]

I believe this is a false/positive on SAS's part ... These items have something to do with Log Me In. See this article: SAS False Positive with LogMeIn :: KW Support & Consulting LLC

Security.HiJack[ImageFileExecutionOptions]
(x86) HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EHSHELL.EXE
(x86) HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EHSHELL.EXE#Debugger

The only thing you haven't done for me is a scan and report from ESET!! I need to see this from both XP and Win7, before I have you set a clean restore point.

 

[shiphen]

Eset produced no errors on any of my computers. But I'll run it again just to make sure.

UPDATE: On my Home PC (Win7) I was getting an error saying "Can not get update. Is proxy configured?" I dont really understand proxy's... I am using an ordinary ADSL from home. I dont think I'm using a Proxy. But I turned off the VPN that I use to pick up work emails from msExchange, and it seemed to download the virus definitions no problem. Scan is now running...

Many thanks

J