Jump to content

Malwarebytes and HijacksThis log won't work Braviax.exe Trojan.


_GRN_
 Share

Recommended Posts

Hi,

I have had this Braviax Virus for quite sometime now (4 to be exact)

And for some reason everything I try to scan something with HijackThis or Malwarebytes it stops and when I try to open in again it says "Windows cannot access the specified device, path or file (etc.)"

So. I tried installing both these programs (Including SDfix and SuperantiSpyware) inside a Flash usb.

The programs work inside the usb when I install and load them, but when I start to scan it just stops and closes out, really frustrating.

I even tried downloading fr33.exe and placing the scanners there. Not even that work.

Also I am using my brother's computer since the internet on my infected computer does not work at all. And I can't use Normal boot because everytime I log into an account I just get nothing except the wallpaper desktop showing. So safe mode is the only way to go for me.

Please help me someone.

Link to post
Share on other sites

Alright got the log

It's saying I don't have backup privileges for C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll

Log file is located at: C:\Documents and Settings\DoMorrison\Desktop\Win32kDiag.txtWARNING: Could not get backup privileges!Searching 'C:\WINDOWS'...Cannot access: C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll[1] 2005-07-26 00:20:23 225792 C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\catsrv.dll (Microsoft Corporation)[1] 2001-08-23 08:00:00 215040 C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll ()[1] 2004-03-05 22:16:10 225280 C:\WINDOWS\$xpsp1hfm$\KB828741\catsrv.dll (Microsoft Corporation)[1] 2004-08-04 00:56:42 229888 C:\WINDOWS\ServicePackFiles\i386\catsrv.dll (Microsoft Corporation)

Link to post
Share on other sites

Hi, _GRN_ ;)

Please follow these steps:

Step 1

Open a command prompt. (Start->Run, type CMD and click OK) At the prompt copy and paste the following and press Enter after each line:

Copy C:\WINDOWS\ServicePackFiles\i386\eventlog.dll C:\

Exit

Step 2

Click on Start->Run, copy and paste the following command into the "Run" box (including the quotation marks), and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here in your next reply.

"%userprofile%\desktop\win32kdiag.exe" -f -r

Step 3

1. Please download The Avenger by Swandog46 to your Desktop.

  • Right click on the Avenger.zip folder and select "Extract All..."
  • Follow the prompts and extract the avenger folder to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Begin copying here:
Files to move:
C:\eventlog.dll | C:\WINDOWS\system32\eventlog.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

  • Right click on the window under Input script here:, and select Paste.
  • You can also click on this window and press (Ctrl+V) to paste the contents of the clipboard.
  • Click on Execute
  • Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

[*]It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete", The Avenger will actually restart your system twice.)

[*]On reboot, it will briefly open a black command window on your desktop, this is normal.

[*]After the restart, it creates a log file that should open with the results of Avenger

Link to post
Share on other sites

Your the best man, My computer is almost there in getting fully fixed.

Just a few problems that came up:

-Couldn't get the new Win32kDiag.txt log when I typed: "%userprofile%\desktop\win32kdiag.exe" -f -r into the "Run" box. It said it couldn't locate the file

-I ran Combo-Fix in safe mode and there was no internet. Which means I didn't get to install the Windows recovery thing, not sure if that is necessary. (hope I don't have to go through the whole combo fix scan process again ;) lol)

-When I go into Normal boot and login it's still only showing the wallpaper and not the rest of the desktop menus/buttons. And it is kinda loads slow when click on a username to sign in.

All logs except the first of course are inside the attachment. I really appreciate your service, man.

avenger.txt

mbam_log_2009_09_05__23_56_22_.txt

_COMBO_FIX_log.txt

Link to post
Share on other sites

Hi, _GRN_ ;)

win32kdiag.exe must be saved on your desktop. Anywhere else, it will return an error message. Copy the win32kdiag.exe file to your desktop and repeat the command:

"%userprofile%\desktop\win32kdiag.exe" -f -r

It should take a while to finish. Post the resulting report. (Win32kDiag.txt on your desktop)

Lets also scan for remnants:

Please do an online scan with Kaspersky WebScanner

Kaspersky online scanner uses JAVA tecnology to perform the scan. If you do not have the latest JAVA version, follow the instrutions below under Upgrading Java, to download and install the latest vesion.

  1. Read through the requirements and privacy statement and click on Accept button.
  2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  3. When the downloads have finished, click on Settings.
  4. Make sure the following is checked.
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases

[*]Click on My Computer under Scan.

[*]Once the scan is complete, it will display the results. Click on View Scan Report.

[*]You will see a list of infected items there. Click on Save Report As....

[*]Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.

[*]Please post this log in your next reply.

Attention! Kaspersky Online Scanner 7.0 may fail to start if another anti-virus program is already installed and running on your computer. Please deactivate the anti-virus software installed on your computer prior to starting Kaspersky Online Scanner 7.0.

Upgrading Java:

  • Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 15.
  • Click the "Download" button to the right.
  • Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
  • Click on Continue.
  • Click on the link to download Windows Offline Installation (jre-6u15-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u15-windows-i586.exe and select "Run as an Administrator.")

Link to post
Share on other sites

Alright got the new win32kdiag.exe log inside my attachment.

I figured out that my desktop and icons do load up when I use Normal boot, but it's really, really, really, really slow.

I have an issue with java too, I can't for some reason delete the old Java SE Runtime Environment 5 - 6 (not update 16/15) files Neither in safe mode or Normal boot (which took almost forever to freakin' get to).

I tried to use Microsoft Installer Clean Up utility, but that doesn't work with safe mode.

I tired to use Normal boot to install the clean up utility, but it takes like ages and I mean AGES for anything to start up, making it near impossible to install in order to remove java. I can't install the new java update in safe mode either.

Is there any other scanner I can use? Or possible a cure for my slow as molasses computer X(

Win32kDiag.txt

Link to post
Share on other sites

Hi, _GRN_ ;)

Lets review some of the settigs in the computer.

Download the enclosed folder. Save and extract its contents to the desktop. It contains a batch file that must be ran in Normal Mode. Once extracted, open the folder and click on the RunMe.bat Post the resulting report.

To uninstall JAVA as, an alternate program to Windows Clean up utility, use REVO.

Link to post
Share on other sites

Hi, _GRN_ ;)

I attempted to install the new java update, but it still wouldn't allow me to install even in Normal boot.

Remove the C:\Program Files\Java folder as well as the C:\Program Files\Common files\Java folder. Then click on the installer on your desktop.

Please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan

  • Tick the box next to YES, I accept the Terms of Use
  • Click Start
  • When asked, allow the ActiveX control to install
  • Click Start
  • Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  • Click Scan (This scan can take several hours, so please be patient)
  • Once the scan is completed, you may close the window
  • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic

Install the Recovery Console:

See the instructions below:

http://www.bleepingcomputer.com/tutorials/tutorial117.html

Then run Combofix once again. Combofix will skip serious infections if the Recovery CD is not installed.

Link to post
Share on other sites

Couldn't do the ESET Online Scanner, since I forgot my admin password.

I don't have anything to report, but I gonna do something a little different if you don't mind. I know you said I shouldn't "install any new programs or update anything unless told to do so while" fixing my problem, but my dad saw what I was doing when I asked where the Windows XP CD was at, and he told me to stop.

My dad who's also pretty good with computers said he was gonna buy some cd that would restore the registry on my computer to make it act normal and not slow. Since I removed a pretty big chuck of the Trojan (or maybe the whole thing), I think it should be safe to do so.

Now, would the registry help remove any virus remains that might've been left behind?

Link to post
Share on other sites

Couldn't do the ESET Online Scanner, since I forgot my admin password.

I don't have anything to report, but I gonna do something a little different if you don't mind. I know you said I shouldn't "install any new programs or update anything unless told to do so while" fixing my problem, but my dad saw what I was doing when I asked where the Windows XP CD was at, and he told me to stop.

My dad who's also pretty good with computers said he was gonna buy some cd that would restore the registry on my computer to make it act normal and not slow. Since I removed a pretty big chuck of the Trojan (or maybe the whole thing), I think it should be safe to do so.

Now, would the registry help remove any virus remains that might've been left behind?

The answer is no. Registry Cleaners may disable your computer. It is possible your computer may still be infected. Running Combofix may help determine that, but the Recovery Console must be installed prior to or during Combofix's run.

Consult with your father before continue.

Link to post
Share on other sites

Check Post #5. With a connection to the Internet. You can install the Recovery Console running Combofix.

  • Copy the entire contents of the Quote Box below to Notepad.
  • Name the file as CFScript.txt
  • Change the Save as Type to All Files
  • and Save it on the desktop

Folder::
C:\SDFix

File::
c:\program files\Common Files\xaxuqiqygy.db

CFScriptB-4.gif

Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting report. This will launch Combofix. If asked to install the Recovery Console, select Yes.

Link to post
Share on other sites

Hi, _GRN_ :huh:

Remove that program and make sure you install a good Antivirus. AVAST is a good program. Defrag the computer. That should improve the performance.

Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programmes changing them. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(Windows XP)

1. Turn off System Restore.

On the Desktop, right-click My Computer.

Click Properties.

Click the System Restore tab.

Check Turn off System Restore.

Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.

On the Desktop, right-click My Computer.

Click Properties.

Click the System Restore tab.

UN-Check *Turn off System Restore*.

Click Apply, and then click OK..

Since the tools we used to scan the computer, as well as tools to delete files and folders, are no longer needed, they should be removed, as well as the folders created by these tools.

Follow these steps to uninstall Combofix

  • Click START then RUN
  • Now copy and paste "c:\documents and settings\DoMorrison\Desktop\Combo-Fix.exe" /u (including the quotation marks) in the runbox and click OK. Note the space between the x and the /u, it needs to be there.

Create a Restore point (If the above process fails to do so):

  1. Click Start, point to All Programs, point to Accessories, point to System Tools, and then click System Restore.
  2. In the System Restore dialog box, click Create a restore point, and then click Next.
  3. Type a description for your restore point, such as "After Cleanup", then click Create.

The following is a list of free tools and utilities that I like to suggest to people. This list is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again.

  1. Spybot Search & Destroy - A useful tool which can search and annhilate bad files that make it onto your system. Now with an Immunize section that will help prevent future infections.
  2. AdAware - Another very powerful tool which searches and kills bad files that infect your system. AdAware and Spybot Search & Destroy compliment each other very well.
  3. SpywareBlaster - Great prevention tool to keep bad files from installing on your system.
  4. ZonedOut + IE-SpyAd - puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
  5. ATF! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those bad files that like to reside in the temp folders.
  6. Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.
  7. Google Toolbar - Free google toolbar that allows you to use the powerful Google search engine from the bar, but also blocks pop up windows.
  8. Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
  9. ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  10. Recovery Console - Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see This Article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Miekiemoes.

Best wishes! wavey.gif

Link to post
Share on other sites

Hey man.

Don't mean to rain on your parade, but my computer is still extremely slow.

When I mean slow, I mean unnaturally slow. It takes maybe 15-30 minutes in order for the desktop and it's menu to show up. And when I go to start, for example, it takes five minutes just for the window to come up. It's like almost unusable to browse around the computer because everything takes so long to start and end/close out.

I defraged my computer, deleted Thestubware and its drivers, removed combo-fix, and turned off/on System restore in Safe mode (didn't create a new restore point yet, still need don't know administrator password).

And yet, no performance change.

Do I need a different defragment program instead of the default one?

Cause there are still whole bunch of red (fragmented) areas on the graph.

I not even sure if defragging my computer will help my problem at this point since I didn't see any improvement in speed from the first defragment.

Link to post
Share on other sites

Hi, _GRN_ :huh:

Download GMER from Here. Note the file's name and save it to your root folder, such as C:\.

  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
  • Click on this link to see a list of programs that should be disabled.
  • Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
  • Allow the driver to load if asked.
  • You may be prompted to scan immediately if it detects rootkit activity.
  • If you are prompted to scan your system click "No", save the log and post back the results.
  • If not prompted, click the "Rootkit/Malware" tab.
  • On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
  • Select all drives that are connected to your system to be scanned.
  • Click the Scan button to begin. (Please be patient as it can take some time to complete)
  • When the scan is finished, click Save to save the scan results to your Desktop.
  • Save the file as Results.log and copy/paste the contents in your next reply.
  • Exit the program and re-enable all active protection when done.

Link to post
Share on other sites

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.