Hi, I have tried many of the steps on this page and other sites helpful but not enough – I still had the virus.
I didn’t really do anything, was watching an online video at a site I normally go to. Maybe there was a popup add? I don’t remember. (I can tell you though that I nearly had a heart attack seven time ovber when this just “started to automatically install” itself.)
This virus has now mutated and goes under other names and alias. I can’t find the site where I read it, but apparently it affects Spybot, Zone Alarm, System Restore, Windows Update, Norton, MacAfee, Avast, AVG, Kapernsky, TrendMicro (or whatever its called) Antivirus and so many others. It also blocks access to antivirus sites and online scans. You might be able to get around the latter by using Firefox instead of IE.
Combined with further research I was able to get rid of this deadly Trojan.
It also now adds “AntivirusPro_2010” and “System Security 2009” among other files/names to your computer.
Also read the solutions posted at this site:
http://www.spywarevoid.com/...
First you need to boot into Safe Mode (preferably with Networking). You have to press F5 at boot-up.
In SAFE MODE:
CTRL-ALT-DELETE to see all the processes, but you may not see all of them, as it seems many do not come up in Task Manager. If you do see any suspicious tasks, disable them. Also, just removing them from Task Manager *Will NOT* delete the virus, it will still be there and will come back into the processes again and again.
START>RUN> type in “msconfig” and then disable all the items with the names of your viruses, including the following:
- Sys32_nov.exe
- braviax.exe
- oxabayv.dll
- a set of six numbers, I had “18905624.exe”, the numbers will likely be different for you.
- AntivirusPro_2010
- System Security 2009
- Total Security
- any other names that are suspicious or sound similar to virus names on this post.
Delete the following files or folders if you find them (and any similar ones):
C:\ Documents and Settings\All Users\Application Data\18905624
C:\ Documents and Settings\All Users\Start Menu\Programs\Total Security
C:\ Documents and Settings\All Users\Start Menu\Programs\AntivirusPro_2010
C:\ Documents and Settings\All Users\Desktop\Total Security 2009.Ink
C:\ Documents and Settings\All Users\Desktop\AntivirusPro_2010.Ink
C:\ Documents and Settings\Administrator\Sys32_nov.exe
*In addition to “All Users”, also look in the other user profiles, such as “Administrator”, and all the other users you have on your computer for the same files above. Follow the same path for the files in the respective user folders.
In Addition, also delete:
C:\Program Files\AntivirusPro_2010\AVEngn.dll
C:\Program Files\AntivirusPro_2010\htmlayout.dll
C:\Program Files\AntivirusPro_2010
C:WINDOWS\oxabayv.dll (shows up as “Nxoguguxavigamep” in SpySweeper)
C:WINDOWS\braviax.exe
C:\WINDOWS\System\cru629.dat
C:\WINDOWS\System\winsource.dll
C:\WINDOWS\System32\wisdstr.exe
C:\WINDOWS\System32\Sys32_nov.exe
C:\WINDOWS\System32\braviax.exe
C:\WINDOWS\Prefetch\Sys32_NOV.exe-18E8F1FC.pf
C:\WINDOWS\Prefetch\BRAVIAX.EXE-OB81BFC9.pf
Then SEARCH (START>Search>Files & Folders>All Files) for the following files/folders and delete them:
You may not have them all, and be sure to check the dates the files were create/modified, this will help you make the determination if it a virus file or not; if it was created on the day you got the virus, and you don’t recognize it, consider deleting it. Also, use the Search ‘Advance Options” to chose modified dates narrowing the search to the same day or 2 days were you know the you got the virus & remember to search *without*
using file extensions to get more complete results for most of the following files:
“sys32_nov” (shows up as “sys32_nov.exe” with file info as
“Pfjqarjmuc yluze Fvwuwou Tacjjlaptyq tlepejo xweyl desd Qecowyk” in SpySweeper)
“oxabayav” (shows up as “oxabayav.dll” with file info as “Nxoguguxavigamep” in SpySweeper)
“braviax” (normally as “braviax.exe” plus other files maybe)
“18905624” => replace with your virus ‘number’
“AntivirusPro_2010”
“System Security 2009”
“Total Security”
“winsource.dll”
“ikowin32.exe”
“tsc”
“9129837.exe”
“cru629” (normally as “cru629.dat” plus other files maybe)
“wpv201251705172.exe”
“wpv711251705172.exe”
“wpv181251705172.exe”
“wpv961251225613.exe”
“wpv111252894422.exe”
“wpv741252921009.exe”
“wpv831252625374.exe”
“ wpv* “ => Try search with the * (astrix) as a wildcard to get any other files starting with
wpv in you computer – delete them all if they look anything like the ones above.
In the Windows Registry (START>RUN> tpe in “regedit” ), delete the following keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Total Security 2009
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntivirusPro_2010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Security 2009
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\18905624 => Your ‘number’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\braviax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oxabayav
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sys32_nov
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\18905624 => Your ‘number’
HKEY_LOCAL_MACHINE\Software\Microsoft\System Security 2009
HKEY_LOCAL_MACHINE\Software\Microsoft\18905624.exe => Your ‘number’
HKEY_LOCAL_MACHINE\Software\18905624.exe => Your ‘number’
Now look again for the exact same paths/files above, but now in the HKEY_CURRENT_USER section instead and delete them too if you find them.
Now search for these other keys :
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Menu Order\Start menu\Programs\AntivirusPro_2010
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Menu Order\Start menu\Programs\Total Security
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Menu Order\Start menu\Programs\System Security 2009
In the section HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache
=> Delete only the ones with the following values:
- 18905624 or 18905624.exe (Or your ‘number’)
- AntivirusPro_2010 or AntivirusPro_2010.exe
- braviax or braviax.exe
- sys32_now or sys32_nov.exe
- “Total Security” or “System Security 2009”, etc, etc.
In the section HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Current Version\Windows
=> Delete the one with the value “cru629.dat”
In the section HKEY_CLASSES_ROOT\CLSID
=> Delete the entire key in { } brackets where you find any of the virus names we mentioned earlier
(sys32_nov.exe, braviax.exe, Total Security, AntiviruisPro_2010, System Security 2009, etc, etc)
Now SEARCH the registry (EDIT>FIND)
Now each time you find something and delete it, don’t forget to EDIT>FIND NEXT to get the rest of the results.
Then once you reach the end, search again one more time to make sure you haven’t missed any before searching the next one. Search for the following and delete any instance you find – especially those with creation dates the same as when you got the virus.:
“sys32_nov” => In some places there are two of these, one right after the other, don’t delete only one and miss the other.
“oxabayav”
“braviax”
“18905624” => replace with your virus ‘number’
“AntivirusPro_2010”
“System Security 2009”
“Total Security”
“winsource.dll”
“ikowin32.exe”
“tsc”
“9129837.exe”
“cru629”
“ wpv* “
Unfortunately after this point, while you have removed most of the virus, you problem is NOT gone. Try to do a virus scan if you can, preferably a boot time scan before windows loads. This may not be enough. After my virus scan, though I got rid of a lot of it, a lot of it kept coming back, especially “braviax” and a few of the others. Also this is a very intelligent virus. It is know to do and did do the following for me:
- Disabled Windows Update
- Corrupted *all* my System Restore point, user or pc checkpoints.
- Disabled Spybot by deleting critical files, and you cannot fix it, only reinstall.
- Created issues with Spysweaper, preventing it from cleaning out infections or completing scans.
- Disabled virus definitions updates in Avast! Antivirus.
What I had to do at this point, was to download “Malwarebytes Anti-Malware” – It’s free. Don’t think about it – like ‘great, another program to install?” Install it, it will get rid of so much none of the other programs could even detect. It’s frankly amazing. Download it at the following sites and then run the scan and get rid of the stupid viruses – and run the scan *several* times until you get a consistent “0 files infected”.
http://www.malwarebytes.org/mbam.php
http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html
Do you think that is enough? Alas, no, there is more.
After this, I was malware free – but the damage to the operating system had been done. I still could not use System Restore as all the system restore points were corrupted. I could not Right-Click on anything without the sytem suddenly not-quite crashing, but in Windows explorer it would crash explorer.exe (even in safe mode) and on the desktop I couldn’t right or left click on anything after a accidental right-click. Many other issues as well.
I downloaded RegCure 1.6 to solve my problems – it worked like crazy, and removed over 2600 issues.
Download it as a torrent either at Pirate Bay (The Best Option) or download version 1.6 at http://www.diagnoseyourpc.com/download5.php,
You will need to disconnect your Internet after install and use 2D003 03220 84A76 7A1E9 to at least give you *temporary” access to run the scan and fix problems - otherwise it will only fix 2 problems out of thousands. Then buy the software if it works for you – it did for me.
The only way to fix System Restore is to Right-Click MY COMPUTER>Properties>System Restore and check “turn off Sytem Restore” . *Warning* This will DELETE *ALL* of your previous System Restore points. Do this only if your restore points have been corrupted. You should restart, then turn on System Restore again.
Why, Why would someone spend so much time and effort to do this kind of a program? This is an incredible virus, requiring so much knowledge and effort. If only the programmer who used all his time to create the program and any other future updates to the virus were to instead write legitimate programs, then we could have so many great programs and he/she would no doubt be leading a multi-million dollar software company that could rival Microsoft I’m sure. What a waste – and what a @#$#@%@ jerk he is, too.
Hope I helped.
Acer aspire one disable system restore