36 replies to this topic

[_GRN_]

Hi,

I have had this Braviax Virus for quite sometime now (4 to be exact)
And for some reason everything I try to scan something with HijackThis or Malwarebytes it stops and when I try to open in again it says "Windows cannot access the specified device, path or file (etc.)"
So. I tried installing both these programs (Including SDfix and SuperantiSpyware) inside a Flash usb.
The programs work inside the usb when I install and load them, but when I start to scan it just stops and closes out, really frustrating.
I even tried downloading fr33.exe and placing the scanners there. Not even that work.


Also I am using my brother's computer since the internet on my infected computer does not work at all. And I can't use Normal boot because everytime I log into an account I just get nothing except the wallpaper desktop showing. So safe mode is the only way to go for me.

Please help me someone.

[JSntgRvr]

Hi, _GRN_

Welcome.

Please save this file to your desktop. Double-click on it to run a scan. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here.

[_GRN_]

Alright got the log
It's saying I don't have backup privileges for C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll

Log file is located at: C:\Documents and Settings\DoMorrison\Desktop\Win32kDiag.txtWARNING: Could not get backup privileges!Searching 'C:\WINDOWS'...Cannot access: C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll[1] 2005-07-26 00:20:23 225792 C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\catsrv.dll (Microsoft Corporation)[1] 2001-08-23 08:00:00 215040 C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll ()[1] 2004-03-05 22:16:10 225280 C:\WINDOWS\$xpsp1hfm$\KB828741\catsrv.dll (Microsoft Corporation)[1] 2004-08-04 00:56:42 229888 C:\WINDOWS\ServicePackFiles\i386\catsrv.dll (Microsoft Corporation)
[/quote]

[_GRN_]

Spoke too soon There was another log here it is
(click on attachment)

Attached Files

•  Win32kDiag.txt   130.67K   13 downloads

[JSntgRvr]

Hi, _GRN_

Please follow these steps:

Step 1

Open a command prompt. (Start->Run, type CMD and click OK) At the prompt copy and paste the following and press Enter after each line:

Copy C:\WINDOWS\ServicePackFiles\i386\eventlog.dll C:\
Exit

Step 2

Click on Start->Run, copy and paste the following command into the "Run" box (including the quotation marks), and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here in your next reply.

"%userprofile%\desktop\win32kdiag.exe" -f -r

Step 3

1. Please download The Avenger by Swandog46 to your Desktop.

• Right click on the Avenger.zip folder and select "Extract All..."
  
• Follow the prompts and extract the avenger folder to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Begin copying here:
Files to move:
C:\eventlog.dll | C:\WINDOWS\system32\eventlog.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

• Right click on the window under Input script here:, and select Paste.
  
• You can also click on this window and press (Ctrl+V) to paste the contents of the clipboard.
  
• Click on Execute
  
• Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

• It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete", The Avenger will actually restart your system twice.)
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please copy/paste the content of c:\avenger.txt into your reply.

Step 4

Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.

Step 5

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

• If you are using Firefox, make sure that your download settings are as follows:
  • Tools->Options->Main tab
    
  • Set to "Always ask me where to Save the files".
• During the download, rename Combofix to Combo-Fix as follows:
  
  
  
  
  
  
  
• It is important you rename Combofix during the download, but not after.
  
• Please do not rename Combofix to other names, but only to the one indicated.
  
• Close any open browsers.
  
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  

  -----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    

    -----------------------------------------------------------

  • Close any open browsers.
    
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

  -----------------------------------------------------------

• Double click on combo-Fix.exe & follow the prompts.
  
• When finished, it will produce a report for you.
  
• Please post the "C:\Combo-Fix.txt" .

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**


Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.

Please do not install any new programs or update anything unless told to do so while we are fixing your problem.

[_GRN_]

Your the best man, My computer is almost there in getting fully fixed.



Just a few problems that came up:

-Couldn't get the new Win32kDiag.txt log when I typed: "%userprofile%\desktop\win32kdiag.exe" -f -r into the "Run" box. It said it couldn't locate the file

-I ran Combo-Fix in safe mode and there was no internet. Which means I didn't get to install the Windows recovery thing, not sure if that is necessary. (hope I don't have to go through the whole combo fix scan process again lol)

-When I go into Normal boot and login it's still only showing the wallpaper and not the rest of the desktop menus/buttons. And it is kinda loads slow when click on a username to sign in.


All logs except the first of course are inside the attachment. I really appreciate your service, man.

Attached Files

•  avenger.txt   1.05K   10 downloads
•  mbam_log_2009_09_05__23_56_22_.txt   1.43K   11 downloads
•  _COMBO_FIX_log.txt   19.67K   18 downloads

[JSntgRvr]

Hi, _GRN_

win32kdiag.exe must be saved on your desktop. Anywhere else, it will return an error message. Copy the win32kdiag.exe file to your desktop and repeat the command:

"%userprofile%\desktop\win32kdiag.exe" -f -r

It should take a while to finish. Post the resulting report. (Win32kDiag.txt on your desktop)

Lets also scan for remnants:

Please do an online scan with Kaspersky WebScanner

Kaspersky online scanner uses JAVA tecnology to perform the scan. If you do not have the latest JAVA version, follow the instrutions below under Upgrading Java, to download and install the latest vesion.

• Read through the requirements and privacy statement and click on Accept button.
  
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  
• When the downloads have finished, click on Settings.
  
• Make sure the following is checked.
  
  Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
• Click on My Computer under Scan.
  
• Once the scan is complete, it will display the results. Click on View Scan Report.
  
• You will see a list of infected items there. Click on Save Report As....
  
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  
• Please post this log in your next reply.

Attention! Kaspersky Online Scanner 7.0 may fail to start if another anti-virus program is already installed and running on your computer. Please deactivate the anti-virus software installed on your computer prior to starting Kaspersky Online Scanner 7.0.

Upgrading Java:

• Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 15.
  
• Click the "Download" button to the right.
  
• Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
  
• Click on Continue.
  
• Click on the link to download Windows Offline Installation (jre-6u15-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
  
• Close any programs you may have running - especially your web browser.
  
• Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
  
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  
• Click the Remove or Change/Remove button.
  
• Repeat as many times as necessary to remove each Java version.
  
• Reboot your computer once all Java components are removed.
  
• Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u15-windows-i586.exe and select "Run as an Administrator.")

[_GRN_]

Alright got the new win32kdiag.exe log inside my attachment.


I figured out that my desktop and icons do load up when I use Normal boot, but it's really, really, really, really slow.

I have an issue with java too, I can't for some reason delete the old Java SE Runtime Environment 5 - 6 (not update 16/15) files Neither in safe mode or Normal boot (which took almost forever to freakin' get to).
I tried to use Microsoft Installer Clean Up utility, but that doesn't work with safe mode.

I tired to use Normal boot to install the clean up utility, but it takes like ages and I mean AGES for anything to start up, making it near impossible to install in order to remove java. I can't install the new java update in safe mode either.
Is there any other scanner I can use? Or possible a cure for my slow as molasses computer X(

Attached Files

•  Win32kDiag.txt   49.2K   12 downloads

[JSntgRvr]

Hi, _GRN_

Lets review some of the settigs in the computer.

Download the enclosed folder. Save and extract its contents to the desktop. It contains a batch file that must be ran in Normal Mode. Once extracted, open the folder and click on the RunMe.bat Post the resulting report.

To uninstall JAVA as, an alternate program to Windows Clean up utility, use REVO.

[_GRN_]

Okay, got the RunMe log for you.

Uninstalled java successfully as well with Revo.

I attempted to install the new java update, but it still wouldn't allow me to install even in Normal boot.

Attached Files

•  Log_Runme_.txt   5.86K   43 downloads

[JSntgRvr]

Hi, _GRN_

Quote

I attempted to install the new java update, but it still wouldn't allow me to install even in Normal boot.

Remove the C:\Program Files\Java folder as well as the C:\Program Files\Common files\Java folder. Then click on the installer on your desktop.

Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan

• Tick the box next to YES, I accept the Terms of Use
  
• Click Start
  
• When asked, allow the ActiveX control to install
  
• Click Start
  
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  
• Click Scan (This scan can take several hours, so please be patient)
  
• Once the scan is completed, you may close the window
  
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  
• Copy and paste that log as a reply to this topic

Install the Recovery Console:

See the instructions below:

http://www.bleepingc...utorial117.html

Then run Combofix once again. Combofix will skip serious infections if the Recovery CD is not installed.

[_GRN_]

Couldn't do the ESET Online Scanner, since I forgot my admin password.

I don't have anything to report, but I gonna do something a little different if you don't mind. I know you said I shouldn't "install any new programs or update anything unless told to do so while" fixing my problem, but my dad saw what I was doing when I asked where the Windows XP CD was at, and he told me to stop.
My dad who's also pretty good with computers said he was gonna buy some cd that would restore the registry on my computer to make it act normal and not slow. Since I removed a pretty big chuck of the Trojan (or maybe the whole thing), I think it should be safe to do so.


Now, would the registry help remove any virus remains that might've been left behind?

[JSntgRvr]

_GRN_, on Sep 6 2009, 01:38 PM, said:

Couldn't do the ESET Online Scanner, since I forgot my admin password.

I don't have anything to report, but I gonna do something a little different if you don't mind. I know you said I shouldn't "install any new programs or update anything unless told to do so while" fixing my problem, but my dad saw what I was doing when I asked where the Windows XP CD was at, and he told me to stop.
My dad who's also pretty good with computers said he was gonna buy some cd that would restore the registry on my computer to make it act normal and not slow. Since I removed a pretty big chuck of the Trojan (or maybe the whole thing), I think it should be safe to do so.


Now, would the registry help remove any virus remains that might've been left behind?

The answer is no. Registry Cleaners may disable your computer. It is possible your computer may still be infected. Running Combofix may help determine that, but the Recovery Console must be installed prior to or during Combofix's run.

Consult with your father before continue.

[_GRN_]

Please do not lock or delete this thread yet. As soon as I find or get a new windows xp cd (same version am mine of course) from ebay I will continue, but for right now I have to put it on a halt.

[JSntgRvr]

Why do you need the XP Setup Disc?

[_GRN_]

After reading the instructions on how to get Recovery console installed I need to have a Windows XP CD from the information that you gave.
If there's another way to get it installed then I'd appreciated greatly.

[JSntgRvr]

Check Post #5. With a connection to the Internet. You can install the Recovery Console running Combofix.

• Copy the entire contents of the Quote Box below to Notepad.
  
• Name the file as CFScript.txt
  
• Change the Save as Type to All Files
  
• and Save it on the desktop

Folder::
C:\SDFix

File::
c:\program files\Common Files\xaxuqiqygy.db

Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting report. This will launch Combofix. If asked to install the Recovery Console, select Yes.

[_GRN_]

Alright got the new Combo-Fix log.
Normal boot is still extremely slow.

Attached Files

•  _combo__fix_log.txt   19.63K   29 downloads

[JSntgRvr]

What is ActiveMonitor and the TheStubware. Is there an Antivirus in the computer? Somehow Combofix if not providing me that information.

[_GRN_]

TheStubware was a malware removal tool that I attempted to use to remove the Virus: http://www.thestubwa...ory/braviax.php
I forgot that I still had that program in there.

I have no clue what ActiveMonitor is though.