Why Can not Repair the virus "Win32:small -CFQ [Trj]"

[NewTaMax]

  The computer of my friend has a virus called "Win32:small -CFQ [trj]" ,he use Avast Home Edtion, and it found this viurs, but it cannot repaired it , only I can do is move it to chest , but many files is useful for me , move it to chest cause many software can not run ,How can I do ? Otherwise, I instead with Kaspersky 6, and it can repair for me , Why?

[oldman]

What is the name and path of the file detected?

You can check the file at virustotal.com  It's a multi scanner on liine scan. If no other avs detect the file, then it is a false positve and can be excluded from scanning. You can't upload the file from the chest. If it's in the chest, you will have to move it to a temp folder first.

[NewTaMax]

Thank you , I notice many exe files infected with this virus.and avast can not repaired it. I try Antivir , also can not repared , but kaspersky 6 can repared. kaspersky 6 named it with "Virus.Win32.Small.l"

[NewTaMax]

Thank you , I notice many exe files infected with this virus. So I can not move them to chest.and avast can not repaired it. I try Antivir , also can not repared , but kaspersky 6 can repared. kaspersky 6 named it with "Virus.Win32.Small.l"

[oldman]

Do you get an error message when trying to move to chest? did you try the online scan?

[DavidR]

Thank you , I notice many exe files infected with this virus.and avast can not repaired it. I try Antivir , also can not repared , but kaspersky 6 can repared. kaspersky 6 named it with "Virus.Win32.Small.l"

I honestly can't see how Kaspersky can 'repair' this it isn't a virus but a trojan and a trojan file the content is completely malicious, which is why avast and antivir can't repair it. So there is nothing to repair other than quarantine or delete the file.

A virus infects a file by inserting a small piece of code into a normal/legitimate .exe file, etc. a repair if it can be effected will remove only that part, leaving the .exe file as it was before the infection. A trojan on the other hand has only malicious content, so if you remove that you have an empty file as there was no original content.

I think this may be more of a slight of hand as the repair is effectively deletion.

The results of a google search for the win32:small family http://www.google.com/search?q=Win32%3Asmall, clearly shows this as a trojan infection which as I said can't be repaired.

[YoKenny]

Trojans can be eliminated but it requires a complete FORMAT of the hard drive ( HD ) after backing up needed information files to a CD or Flash memory card but it is best done by removing the infected HD and performing the FORMAT on a non-infected system.

Trojans get really imbeded in the system so FORMATTING is the only way to insure that the insidious infection is removed totally.

[mauserme]

YoKenny - please stop telling people to reformat.  It's rarely the answer.

@NewTaMax

I'm away from home right now and have very limited internet access - every time the wind blows its gone. 

 If you post HijackThis and ComboFix logs somebody will have a look. 

Click here to download HJTsetup.exe

• Save HJTsetup.exe to your desktop.
• Doubleclick on the HJTsetup.exe icon on your desktop.
• By default it will install to C:\Program Files\Hijack This.
• Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
  
• Put a check by Create a desktop icon then click Next again.
  
• Continue to follow the rest of the prompts from there.
• At the final dialogue box click Finish and it will launch Hijack This.
  
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
  
• Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
• Come back here to this thread and Paste the log in your next reply.
• DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
  

Download ComboFix from Here or Here to your Desktop.
 
Double click combofix.exe and follow the prompts.
 
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
 
Note: Do not mouseclick combofix's window while its running. That may cause it to stall.


Click here to download HJTsetup.exe

• Save HJTsetup.exe to your desktop.
• Doubleclick on the HJTsetup.exe icon on your desktop.
• By default it will install to C:\Program Files\Hijack This.
• Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
  
• Put a check by Create a desktop icon then click Next again.
  
• Continue to follow the rest of the prompts from there.
• At the final dialogue box click Finish and it will launch Hijack This.
  
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
  
• Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
• Come back here to this thread and Paste the log in your next reply.
• DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
  

.


I'll be back to my normal connection let on.

[DavidR]

Trojans get really imbeded in the system so FORMATTING is the only way to insure that the insidious infection is removed totally.

Trojans rarely require anything as severe as a format to resolve the problem and should 'never' be an early option but one of last resort.

Trojans are no more embedded than a lot of other malware so if you are going to format tor this type of thing then I would suggest selling the PC.

Some trojans might well be hidden or have hidden elements it is that which makes some difficult to remove, but even then formatting is rarely an option.

So please don't offer this up an an option without first having fully explored 'all' other options first.

[NewTaMax]

Thank all for you answers, I understand what you say, I think regard this as a trojan, So it can not repired it , But kaspersdy 6 regards it as a virus, So It can repired it. I think it is a virus not a trojan or a rootkit. I use autoruns to discover rookit. Sometimes I can go to DOS mode to remove some trojan, So thank you all , and sorry for my poor English, I'm from China.

[RejZoR]

Thank you , I notice many exe files infected with this virus.and avast can not repaired it. I try Antivir , also can not repared , but kaspersky 6 can repared. kaspersky 6 named it with "Virus.Win32.Small.l"

I honestly can't see how Kaspersky can 'repair' this it isn't a virus but a trojan and a trojan file the content is completely malicious, which is why avast and antivir can't repair it. So there is nothing to repair other than quarantine or delete the file.

A virus infects a file by inserting a small piece of code into a normal/legitimate .exe file, etc. a repair if it can be effected will remove only that part, leaving the .exe file as it was before the infection. A trojan on the other hand has only malicious content, so if you remove that you have an empty file as there was no original content.

I think this may be more of a slight of hand as the repair is effectively deletion.

The results of a google search for the win32:small family http://www.google.com/search?q=Win32%3Asmall, clearly shows this as a trojan infection which as I said can't be repaired.

Actually that's not entirely true. There are Small variants that pre- or append the data to existing files (even though they act like trojan).

[DavidR]

Thanks for the clarification.
If that is the case and this is a Trojan Small infecter variant then avast too should be able to repair it, if the original file had been included in the VRDB generation, so I can only think that it hadn't.

[NewTaMax]

I know that, Thank you all.