Need help removing nasty malware please

[djtetris]

Hello,

My laptop seems to have some nasty malware and this is the first time im unable to get rid of it.

The computer:

Acer Laptop running Windows XP

Everytime the computer boots up i have braviax.exe running in task manager as well as the icon in my tray. Braviax.exe and cru629.dat or w.e show up in my windows and system32 folder, but deleting them does nothing as they show back up on reboot.

I am unable to run any program such as Hijackthis S&D, Combofix, etc etc etc....

I can only get programs to run when i rename them and they close a second into starting, then are blocked and i dont have access to them anymore.

NOTHING works in safe mode, combofix will run in safemode and say "rootkit has been detected! must restart computer!" but then it reboots, cmd prompt opens, and quickly closes after that with nothing being accomplished.

I have read on forums of people getting rid of this braviax problem and i would greatly appreciate any help in this matter, it has brought me much grief.

Thankyou for reading and i look forward to a response and possibly a fix!

[extremeboy]

Hello and welcome to the Malwarebytes forum!

Please follow the instructions mentioned over here: http://www.malwarebytes.org/forums/index.php?showtopic=9573

Download and run RootRepeal CR

Please download RootRepeal from the following location and save it to your desktop.

• Direct Download (Recommended)
  • Primary Mirror
    
  • Secondary Mirror
    
  • Secondary Mirror
    
  • Secondary Mirror
    

  [*]Zip Mirrors (Recommended if you have a slower connection or if the Direct Download mirror is down)

  • Primary Mirror
    
  • Secondary Mirror
    
  • Secondary Mirror
    

• Unzip the RootRepeal.zip file it to it's own folder. (If you did not use the "Direct Download" mirror to download RootRepeal).
  
• Close/Disable all other programs especially your security programs (anti-spyware, anti-virus, and firewall) Refer to this page, if you are unsure how.
  
• Physically disconnect your machine from the internet as your system will be unprotected.
  
• Double-click on RootRepeal.exe to run it. If you are using Vista, please right-click and run as Administrator...
  
• Click the tab at the bottom.
  
• Now press the button.
  
• A box will pop up, check the boxes beside All Seven options/scan area
  
  
• Now click OK.
  
• Another box will open, check the boxes beside all the drives, eg : C:\, then click OK.
  
• The scan will take a little while to run, so let it go unhindered.
  
• Once it is done, click the Save Report button.
  
• Save it as RepealScan and save it to your desktop
  
• Reconnect to the internet.
  
• Post the contents of that log in your reply please.
  

Then, please give me an update of the condition of your machine and what problems or symptoms you may have.

With Regards,

Extremeboy

[extremeboy]

Hello.

Are you still there?

If you are please follow the instructions in my previous post.

If you still need help, follow the instructions I have given in my response. If you have since had your problem solved, we would appreciate you letting us know so we can close the topic.

Please reply back telling us so. If you don't reply within 5-7 from the last day I replied initially, the topic will need to be closed.

Thanks for understanding.

With Regards,

Extremeboy

[extremeboy]

Hello.

Are you still there?

If you are please follow the instructions in my previous post.

If you still need help, follow the instructions I have given in my response. If you have since had your problem solved, we would appreciate you letting us know so we can close the topic.

Please reply back telling us so. If you don't reply within 5-7 from the last day I replied initially, the topic will need to be closed.

Thanks for understanding.

With Regards,

Extremeboy

[extremeboy]

Hello.

Due to Lack of feedback, this topic is now Closed.

If you need this topic reopened, please Send Me a Message. In your message please include the address of this thread in your request.

This applies only to the original topic starter.

Everyone else please start a new topic.

With Regards,

Extremeboy