Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Suspected Spyware Infection - Braviax.exe ?


  • Please log in to reply
6 replies to this topic

#1 Smyther

Smyther

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:03:49 PM

Posted 31 March 2008 - 01:46 PM

My PC appears to be infected with a virus or spyware and I would like to take some advice on removing it. I've searched for similar problems and found some very useful posts by 'quietman7' but don't want to follow the exact same instructions just in case my problem differs slightly and therefore involves different resolution steps.

Here are the details of my system and the symptoms that I am encountering. I'd be very grateful if someone would spare the time to help me out.

System
=====
I am running Windows XP SP2 and receive automatic updates on a regular basis.

I have installed AVG Anti-Virus Free Edition 5.5.519
The Virus Base is 269.22.0/1344
The date for this is 26/03/2008 08:32, which is the last time it was updated prior to getting infected later that day. I have not been online since to receive any further updates.

I have installed AVG Anti-Spyware Free Edition 7.5.1.43, which was updated on the same date as above.

I have a broadband connection. My ISP is Tiscali.


Symptoms
=======
I was online surfing the web, when all of a sudden my PC just shut itself it down and rebooted. Straight away (and ever since) I am getting a pop-up bubble from the bottom-right-hand-corner system tray, from a red circular icon with a white cross in it. The message tells me that spyware has been detected and that Windows will download appropriate removal tools. I'm not convinced that this is a legitimate Windows message - I suspect that this is the malicious spyware in action.

I ran an AVG Anti-Virus scan, which detected and quarantined an infected file. I selected 'Heal' for this but it had no effect. I then selected 'Remove' and the quarantined file was deleted, but my system is still behaving the same (i.e. asthough it is still infected). Apologies, but I don't have the name of the file identified by AVG Anti-Virus. I should have wrote it down but didn't. I'm pretty sure that it was a file in C:\WINDOWS\system32 and that it began with 'w'. But I know that this isn't very helpful!

I then ran an AVG Anti-Spyware scan, which identified something called 'Not-A-Virus.Adware.Agent' in file C:\WINDOWS\systems32\univrs32.dat. I opted to delete this.

Still, my PC was continuing to behave as infected.

I rebooted the machine and ran another Anti-Virus scan. This time nothing was detected. This has been the case for all subsequent scans. The only details reported from the scan are that the following four files in system32 have a status of 'changed' : kernel32.dll, user32.dll, shell32.dll and ntoskrnl.dll. This has always been the case, ever since I installed the product, and so I'm not sure if this is an area of concern or not.

I then re-ran another Anti-Spyware scan. The same issue was detected and deleted once again, and has done so in all subsequent scans - in other words 'Not-A-Virus.Adware.Agent' in file C:\WINDOWS\systems32\univrs32.dat is continually identified after a reboot.

If I order the contents of system32 by Date Modified, there is a file called braviax.exe which was modified at a very similar time (if not the exact time) when the initial issue occured. I therefore suspect that this is a file with some involvement in my problems, but I haven't tried to do anything with it because I'm not sure of the implications. I can see that this is a running process on my system.

So, that's all I can think of for now. If there is any more information that would perhaps help someone to offer me some advice then please feel free to ask. I'd be very grateful for any kind of support on this.

Thanks

BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,089 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:49 AM

Posted 31 March 2008 - 02:46 PM

Hello Smyther

If you're using Windows 2000/XP, please print out and follow the instructions for using SDFix in BC's self-help tutorial "How to use SDFix".
-- When using this tool, you must use the Administrator's account or an account with "Administrative rights"
When done, the SDFix report log will open in notepad and automatically be saved in the SDFix folder as Report.txt. Please copy and paste the contents of Report.txt in your next reply.

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2
  • Make sure you are connected to the Internet.
  • Double-click on Download_mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • On the Scanner tab:
    • Make sure the "Perform Quick Acan" option is selected.
    • Then click on the Scan button.
  • The next screen will ask you to select the drives to scan. Leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

This has been the case for all subsequent scans. The only details reported from the scan are that the following four files in system32 have a status of 'changed' : kernel32.dll, user32.dll, shell32.dll and ntoskrnl.dll. This has always been the case, ever since I installed the product, and so I'm not sure if this is an area of concern or not.

Reported changes in system files such as kernel32.dll, wsock32.dll, user32.dll, shell32.dll and ntosknrl.exe are normal for AVG.

There are many valid reasons for those files to show changed, a Windows update, file system check that replaced them if corrupted, and others. As long as AVG doesn't say they are infected it is ok. If it continues to show changed, delete the following file(s) in the C:\ directory and AVG will create a new one(s)...AVG7DB_F.DAT, AVG7QT.DAT

kernel32.dll, wsock32.dll, user32.dll, shell32.dll and ntosknrl.exe have "changed"

It is normal that AVG shows that files, the MBR or Boot record to have changed. These are done during normal maintainance, when you or windows updates files or have had to correct errors on the drive. The only time that you should worry is if they also show as infected.

To get AVG to quit showing them as changed...

Changed File Alerts
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 Smyther

Smyther
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:03:49 PM

Posted 31 March 2008 - 04:05 PM

Thanks, I will perform the requested actions and get back to you.

Am I OK going back online to do this whilst I still have the spyware on my system?

#4 Smyther

Smyther
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:03:49 PM

Posted 06 April 2008 - 05:41 AM

:thumbsup: quietman7 I think you have solved my problems. Here are the logs from SDFix and MBAM

SDFix
====
SDFix: Version 1.166

Run by Andy on 06/04/2008 at 10:47

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\sdfix

Checking Services :


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\braviax.exe - Deleted
C:\WINDOWS\system32\univrs32.dat - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-06 10:50:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Symantec\\Ghost\\ngctw32.exe"="C:\\Program Files\\Symantec\\Ghost\\ngctw32.exe:*:Enabled:Symantec Ghost Win32 Client Agent"
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Symantec\\Ghost\\ngctw32.exe"="C:\\Program Files\\Symantec\\Ghost\\ngctw32.exe:*:Enabled:Symantec Ghost Win32 Client Agent"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sat 16 Feb 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sat 16 Feb 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Sat 16 Feb 2008 4,348 ...H. --- "C:\Documents and Settings\Andy\My Documents\My Music\License Backup\drmv1key.bak"
Sat 16 Feb 2008 20 A..H. --- "C:\Documents and Settings\Andy\My Documents\My Music\License Backup\drmv1lic.bak"
Sat 16 Feb 2008 400 ...H. --- "C:\Documents and Settings\Andy\My Documents\My Music\License Backup\drmv2key.bak"
Sat 16 Feb 2008 12,288 A..H. --- "C:\Documents and Settings\Andy\My Documents\My Music\License Backup\drmv2lic.bak"
Thu 4 Nov 1999 20,480 A..H. --- "C:\Documents and Settings\Andy\My Documents\University\Year2\Sem1\Ar21\~WRL2110.tmp"
Thu 4 Nov 1999 24,064 A..H. --- "C:\Documents and Settings\Andy\My Documents\University\Year2\Sem1\Ar21\~WRL2185.tmp"
Thu 4 Nov 1999 24,576 A..H. --- "C:\Documents and Settings\Andy\My Documents\University\Year2\Sem1\Ar21\~WRL2520.tmp"
Thu 4 Nov 1999 23,552 A..H. --- "C:\Documents and Settings\Andy\My Documents\University\Year2\Sem1\Ar21\~WRL3194.tmp"
Thu 4 Nov 1999 24,576 A..H. --- "C:\Documents and Settings\Andy\My Documents\University\Year2\Sem1\Ar21\~WRL3750.tmp"

Finished!


MBAM
====
Malwarebytes' Anti-Malware 1.10
Database version: 594

Scan type: Quick Scan
Objects scanned: 30306
Time elapsed: 3 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



I no longer have any symptoms. I have created a new restore point and removed all others.

Many Thanks
Much Appreciated!

#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,089 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:49 AM

Posted 06 April 2008 - 07:09 AM

Your welcome.

To protect yourself against malware and reduce the potential for re-infection, be sure to read:
"Simple and easy ways to keep your computer safe".
"How did I get infected?, With steps so it does not happen again!".
"Best Practices - Internet Safety for 2008".
"Hardening Windows Security - Part 1 & Part 2".
"IE Recommended Minimal Security Settings".
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#6 Mankind

Mankind

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:10:49 AM

Posted 07 April 2008 - 09:17 PM

Hi, I basically have a similar problem with univrs32, so I did a search on Google and it brought me here. Am sorry if I needed to make a new thread and I didn't.

I was wondering if I have to do the same thing as this person.

I have Windows 2000 pro. The problem began last night when I was downloading a song then all of a sudden my computer rebooted. When it started again, I was left with a red circle and a white X in the middle of it at the right bottom corner and it's stating that my computer is infected with spyware.

I ran Kaspersky and it says that my computer is well protected but that I have an adware "not a virus" called C:\WINNT\system32\univrs32.dat. It claims that it will delete it when the system restarts, but it is still there.

I tried running windows in safe mode and I was actually able to locate the file and delete it, but the problem is, it is still there when I log in on regular windows.


Any kind of advice will be very helpful, but on a simple level. I don't really know much about computers.

#7 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,089 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:49 AM

Posted 08 April 2008 - 08:50 AM

Welcome to BC Mankind

If you have an issue or problem you would like to discuss, please start your own topic. Doing that will help to avoid the confusion that often occurs when trying to help two or more members in the same thread with different problems. Even if your problem is similar to the original poster's problem, the solution could be different based on the kind of hardware, software, system requirements, etc. you are using and the presence of other malware. Further, posting for assistance in someone else's topic is not considered proper forum etiquette.

Thanks for your cooperation.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users