braviax\cru629 strikes another innocent pc

I was online two days ago, when my computer suddenly rebooted. As it started back up I noticed that my Norton software had been disabled, which seems to open up a whole world of possibilities, unfortunately they are not all good. I also have the now famous red circle with a white cross in my system tray. It seems to me that some generous soul has sent me a free copy of braviax\cru629. I would really like to get rid of it.

I searched your malware forums and it seems that my computer has most of the symptoms described in the thread titled "System Defender has attacked me".

I went through all the steps outlined in "read and run me first thread". I updated my Java, and followed all of the other steps that applied to my system (Dell 8300, 3.0Ghz, 1 Gig ram, XP Pro). I have Norton Systemworks, Spybot Search and Destroy, Spyware Terminator, and Ad Aware all of which were installed and functional prior to my receiving the afore mentioned unsolicited giftware.

After the initial discovery I ran Spyware Terminator and it removed several rootkits, which I hoped would put an end to this but of course it did not. Spybot has also been disabled and will not run. I tried re-installing it to no avail. I was also unable to install SUPERAntispyware, Combofix seems to have been installed but it will not run. I ran CCleaner and MGtools, and have attached the logfile it created.

Your help will be greatly appreciated...

pyroter

 

Quote

“Did you run it exactly as requested from the command prompt with the killall option? Did it give you any error messages? What happened exactly? You could try running in safe boot mode too as this sometimes helps.”

Yes. No. Nothing. Safemode did not help.

I was able to remove Windows Messenger.
---------------------------------------------------------------------------------------------------------------------------------
I ran analyse.exe (HijackThis) and selected the lines specified for removal.
I was not able to find the line---

“O4 - HKLM\..\Run: [braviax] braviax.exe”

or the line---

“O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background”

I would imagine the latter was removed when Windows Messenger was removed. HijackThis did remove all of the lines I selected.
---------------------------------------------------------------------------------------------------------------------------------

I downloaded and ran The Avenger. It removed everything except the registry value

“HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | braviax”.

Avenger popped up a box which said “Error: Invalid registry syntax in command” (see attached screenshot in zip file avenger.doc). I tried to delete it manually but I could not find it either.

It also generated the following:

Error: registry key “\Registry\Machine\system\CurrentControlSet\Services\cru629” not found!
Deletion of driver “cru629” failed!
status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

I searched for the files Avenger attempted to delete but did not find them.
---------------------------------------------------------------------------------------------------------------------------------
I deleted the temporary files specified and then ran CCleaner.

At this point braviax/cru629 seems to be gone and my system boots normally. I was able to run SUPERAntiSpyware as well as Norton Antivirus, AdAware, Spybot Search and Destroy, and Spyware Terminator. I updated each program and then ran a scan and each program found several things to remove except for Norton Antivirus. After removal I repeated each scan to make sure the items were actually removed. The last time I ran SUPERAntiSpyware it did find the following:

Trojan.LanMan/Rootkit
C:\SYSTEM VOLUME INFORMATION\_RESTORE{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP433\A0097582.SYS

C:\SYSTEM VOLUME INFORMATION\_RESTORE{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP433\A0097583.SYS

Trojan.Downloader-Gen/AVP
C:\SYSTEM VOLUME INFORMATION\_RESTORE{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP434\A0098028.EXE

I am guessing these could be removed by toggling System Restore, but I will wait until I hear from you to do so.


I then ran CCleaner and MGtools again to generate the attached logs. I also attached several logs and screenshots from the other scan tools mentioned above.

I realize I need to update XP to SP2, I was just giving Microsoft a little time to work the bugs out. Can you recommend a utility to backup my system prior to installing SP2?
Do you know if Zone Alarm firewall can peacefully coexist with SP2?

Please let me know if you see any other issues that need to be addressed.

Thank you,

pyroter