Braviax, Msword98, Fraudo, ikowin32 - Diagnose Virus Infection

[Sir Myke]

Hello, I'm Myke and I need your Help.

I'm not new to virus infections and this is the first time I really have to take my virus problems to a forum, so...

The Set: In an attemt to get myself with a keygen for some low-profile video coverter I ended up in a torrent page, clicked a download button and Surprise!, virus detected!.

The Infection: My antivirus (Avast 4.8 Home) pop'ed up inmediatly but could't delete the threat cuz it was already executing, then went fast to the taskmngr and tried to end unknown process, from which I found some ol'friends like a copy of svchoost (quited them on the spot) but then there was this Braviax.exe that won't go along with others that restarted after quitting. My antivirus was struggling with those files running not beeing able to terminate them, Suddenly a dialogbox appeared saying "instalation complete" then a box poped saying my computer will restart, services terminated blablabla (I don't really remember what else said) I freak'd out and reseted the machine.

The Problem: (from reseting) Bios startup ok, devices ok, but then on the windows splash screen (when loading the OS) it showed a blue screen for half second and restarted, then tried safe mode and same thing, bios reset (even with battery taken) and nothing. So i took another disk from a clean computer and put it on the infected pc (with the infected disk as slave) and again!, so I feared the other disk could get infected, took it back where it belongs and at the first attempt it restarted (every restart happens when loading the OS) but at the second It ran OK, so I tried to do the same with the infected disk (on the clean PC) and still rebooting, but since the other disk DID worked, i repaired the infected one there... (runned chkdsk, then an OS repair [windows XP sp2]). After the repair I ACCESSED the infected disk. Quickly i sheduled a boot time scan to bypass the virus to activate again, and the scan found the virus temp. files, an installer, a worm32 and a trojan called "Fraudo".

But, even with that scan i found some files still executing (like the svchoost copy) but the self-restart problem was gone, so with that i went hunting isolated files (on msconfig, windows 32 and start up menu). I found these guys.
-Braviax.exe
-ikowin32.exe
-msword99.exe
i serched for associated files and deleted them all.
after restarting again, those annoying process were gone, and so far the disk remained clean, i left the pc going for about 30 minutes and nothing re-installed o bothered.

STILL, back on the infected PC, with the disk virus-free, it reboots on windows splash screen...

Diagnose & Solutions: So, what do you think it is... I've been fighting this thing for 2 days and my back hurts a lot... I'll try to do another OS repair from windows cd on the infected computer but that seems unnecesary at this point. I disabled the self-restart on errors and the blue screen that appears shows this error
- 0x0000007b (0xBACC3524, 0xc0000034, 0x00000000, 0x0000000)

Obviously this thing is now hardware malfunction, but what can it be?, BIOS?, RAM? GPU? CPU? the whole Motherboard? how can i figure out that?


I'm really desperate now, my computer is high-end enough to run smootly Unreal Tournament 3 and games alike with full graph settings and anti-a x4 ... for this to be harware

thanks for your attention guys.

[micky77]

There is another post with the same problem http://forum.avast.com/index.php?topic=47639.0 Unfortunatley, he still has the problem. You could post logs from Hijackthis, MalwareBytes Antimalware, and SuperAntispyware http://filehippo.com/download_hijackthis/
http://filehippo.com/download_malwarebytes_anti_malware/
http://filehippo.com/download_superantispyware/

[Maxx_original]

braviax detection will be updated today..

[YoKenny]

@Sir Myke
Using keygens is a sure way to get your system infected. 

The malware purveyors know people like to have applications unlocked and publish keygens to trap their victims.

[Sir Myke]

There is another post with the same problem http://forum.avast.com/index.php?topic=47639.0 Unfortunatley, he still has the problem. You could post logs from Hijackthis, MalwareBytes Antimalware, and SuperAntispyware http://filehippo.com/download_hijackthis/
http://filehippo.com/download_malwarebytes_anti_malware/
http://filehippo.com/download_superantispyware/

Sorry, I made it too long so its unclear what the problem is...

I Had the virus, then managed to get rid of it...
The Disk is accesible on other Pc's as Master and the OS works fast & fine.
the thing is, I still can't acces to the OS on the infected PC, I tryed BIOS reset, even disconnected the entire hardware (CPU, GPU, RAM). and same thing.

I also forgot to ask you guys, What is the effect of those virus on the PC? I mean, are they like the chernobyl virus or the one that sets password to the BIOS?

Second, I read the thread you linked, seems like they could access the OS after infection, but on my case, after restarting for the first time i couldn't return to it (untill doing a windows repair from the CD)

I know these little punks have just appeared and solutions are still appearing. I'll run a hijackthis scan on the other pc to see if i really removed all threats. If so I'll share my manual removal method on those things hehehe 



@YoKenny: I know!, and worse on torrent pages, but i was blinded by my ambitious little project that forgot my self-warnings

[John2009]

ALL keygens are fake, dont trust them, especially since they are illegal

[Sir Myke]

sorry again.. I didn't read my post after creating the thread... it appears that the page "ommited" (or i forgot to put it, it was erased but mistake before posting, i dunno) but on the "problem" description some critical information regarding my actual problem was missing.

The post is already edited, is not much, just the part of my pc restarting.