 | Home | | Download | | About | | Donation | | Forum | |
Description of trojan.braviax (braviax.exe)
This malware runs a process "braviax.exe" at Windows startup, it hides its startup key in registry so you cannot find out how it is running at Windows startup, then this process displays a balloon from system tray stating your computer is infected by some malware, when you click the balloon, it will download some rogue program, in most cases, the downloaded rogue program is "PC Security 2009" or "PC Antispyware 2010" or "Home Antivirus 2010".
How to remove trojan.braviax (braviax.exe) with TheStubware
TheStubware can remove this trojan FOR FREE.
NOTE: You must restart Windows after installing TheStubware.
Please run TheStubware, click "Active Monitor" tab and set its work mode to "Block Mode", then click "Scanner" tab and click "Start Scan" button, wait for the scan is done, the following items should be checked:
- PROCESS : C:\Windows\braviax.exe
- PROCESS : C:\Windows\system32\sys32_nov.exe
- PROCESS : C:\Document and Settings\%user name%\sys32_nov.exe
- Auto-Run Programs : HKCU\Run\sys32_nov=C:\Document and Settings\%user name%\sys32_nov.exe
- Auto-Run Programs : HKCU\Run\braviax=braviax.exe
- Auto-Run Programs : HKLM\Run\Regedit32=C:\WINDOWS\system32\regedit.exe
- Auto-Run Programs : HKLM\NT\Windows\AppInit_Dlls=cru629.dat
- Recent Created File : C:\Windows\cru629.dat
- Recent Created File : C:\Windows\braviax.exe
- Recent Created File : C:\Windows\system32\cru629.dat
- Recent Created File : C:\Windows\system32\sys32_nov.exe
please click "Fix Selected" button, if TheStubware prompts you to restart Windows, just do it. After Windows is restarted, check if the trojan is gone.
What if I finished the above steps but still have the malware ?
- Open "notepad" from "Start -> Run -> notepad"
- Copy and paste the following text into the notepad and save it on your desktop or any other place you can easily find it
<RSF>
<FILE>C:\Windows\braviax.exe</FILE>
<FILE>C:\WINDOWS\system32\cru25.dat</FILE>
<FILE>*C:\WINDOWS\system32\cru629.dat</FILE>
<FILE>*C:\WINDOWS\cru629.dat</FILE>
<FILE>C:\Windows\system32\sys32_nov.exe</FILE>
<REGVALUE>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run=braviax</REGVALUE>
<REGVALUE>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows=App_InitDlls</REGVALUE>
</RSF> - Launch "TheStubware", drap and drop the text file you saved just now into "TheStubware" window
- "TheStubware" will run the removal automatically, in most case, it will prompt you to reboot Windows to finish the removal
If you finished the above steps but still get the malware, your computer may be infected by a new variant, The new variant may use different method to hide itself, but don't worry, you can run the scanner first, after the scan is done, click "View Log" button, then send your log file to me for anylasis. You can submit your log file to technical support forum or send it in email to : support@TheStubware.com. After your log file is received, you will be sent a customizing removal to remove this malware.
A new variant is just reported in tech support forum: New Variant
Another new variant is just reported in tech support forum : New Variant2
About TheStubware
TheStubware is a FREE malware removal tool with a real time protection. It can help you remove those stubborn malware and protect you from being infected again. Download TheStubware
Leave your comment (Currently 7 comments)
Thank you! Thank you! Thank you!
I had tried everything! All the malware, AV software, adware software I could find. I even tried the forums. Booted into Safe Mode, Tried system restore without success.
In addition, each scan were super slow, the process confusing, frustrating and more importantly, not effective!
With TheStubware, the instructions are concise, the scan super fast and effective. I am glad to have something that really works.
I am now a supported of TheStubware!
Commented by Norman Lim-- 09/03/09 7:15:02 |
I installed the program, system restarted and process started then stopped and sutdown the program, I clicked on the program and it says path not valid????FYI it has done this with each removal tool I've tried. Commented by Andrew James-- 09/05/09 7:35:04 |
to kill braviax.exe :
1-shut down internet.
2-open task manager
3-end braviax.exe and its creator sys32_nov.exe
4-than open windows/system32/
5-search find and delete with unlocker these found files sys32_nov.exe and braviax.exe in system32 folder..it means you survived braviax.exe))
Commented by taylocan-- 09/05/09 7:58:35 |
unable to locate file names sys32_nov.exe, not found in any search results and not running in the task manager. Commented by Andrew James-- 09/05/09 8:21:02 |
This trojan will create some random process depending on different variants, so if you can't find the sys32_nov.exe, it may create some other process, just fix what it finds then check if the trojan is gone, if still have it, send your log file to forum for analysis. Commented by Michael-- 09/05/09 12:17:12 |
It worked for me. Thanks for the free product. Commented by Happy-- 09/19/09 13:09:29 |
It worked for me. Thanks for the free product. Commented by Happy-- 09/19/09 13:10:42 |