Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

-Edit- for the people who say it isn't a virus. Norton does detect it as a virus, an icon was placed on my system tray and rkpg.exe is in my C: which was placed 6 min ago around the time my computer rebooted on its own causing me to lose data :@.

Situation I on Windows XP, behind a Linksys router, I don't have DMZ on so nothing should be connecting to me. I had Firefox, MSN and Visual Studio opened. With C# I programmed a quick application to scan some pages with Internet Explorer. The site it was scanning was deviantART (which is pretty trustworthy), I doubt any banners there would hold a virus. I went to a suspicious site called but that was on Firefox and it didn't load the site. With an extra check I ping it and got this message "Ping request could not find host"

The virus seems to be called braviax. Right now it brought up a message saying my computer may be infected? How on earth did it get in? I don't have uTorrent installed or any torrent or p2p applications. Nothing is installed on my computer that I haven't installed before and I know the exact time it installed because I see rkpg.exe on my C drive and my computer restarted on its own around the same time. For the previous 30 minutes actually the previous hour all I did was talk on MSN, not click any links (I went to freetxt on my own) and had that Internet Explorer thing running (which I programmed).

How did it get in? I really doubt it came from a banner on deviantART and installed when I loaded the page with the webbrowser-control so something else may have happened? Is there any system defaults I should turn off? I have remote assistance off but even if it was on I shouldn't be infected due to the router not forwarding any ports?

share|improve this question
Please cut down the abbreviations, it's a bit hard to read and it makes you sound like a whining kid. – hasen Jul 24 '09 at 22:02
up vote 1 down vote accepted

Well, this won't help you get rid of it, but it will tell you how to avoid it.

DeviantArt is a trustworthy site, although whatever ad service they use is not. You should run Windows Update to get all the IE patches, and make sure you're using version 8 as well.

Although, as a heads up, no site with third-party ads is trustworthy because they'll sell out to the highest bidder to put whatever code they want on their site, especially JavaScript. Your best solution is to implement hosts-level ad blocking.

share|improve this answer
it turns out it was from DA. – acidzombie24 Aug 2 '09 at 1:43
No, you should use firefox with adblockplus extension. You won't need to run windows update because firefox has its own superior update mechanism. – hasen Sep 8 '09 at 2:59
@hasen j - True, but you should run Windows Update anyways for OS and MSRT patches. I was working on the assumption that the user would not want to switch browsers. – MiffTheFox Sep 8 '09 at 21:23
hasen j: You may have miss it. The page was loaded via webbrowser-control which is IE in C#. So i cant use firefox since it doesnt interface. I dont know if learning the API (let alone trying to get it to work if it exist) and rewriting code is feasible. – acidzombie24 Sep 22 '09 at 20:43
If you want to use Firefox with C#, you can use GeckoFX. – MiffTheFox Sep 23 '09 at 12:47

If it's just popups then it's probably just spyware, not a full blown virus. Spybot should take care of it.

share|improve this answer
These days there is rarely such a thing as "just spyware" – user23307 Apr 7 '10 at 22:38

You ran something you shouldn't have, sometime, somewhere. Without watching over your shoulder it's kind of hard to pinpoint.

Like John says, it's probably not a virus but just a piece of malware which Adaware or Spybot or some other Malware-cleaner can take care of.

share|improve this answer
This is usually how viruses and spyware infect computers. It doesn't matter how secure your router is or if you have a specific program installed. – Travis Jul 24 '09 at 14:02

You have changed the default password on your router, right?

share|improve this answer
excellent question. yes i did. my comp isnt currently shared but i would turn it on w/o thinking when i need to. – acidzombie24 Jul 25 '09 at 0:08

Had the exact same infection (braviax, etc.) - Malware Bytes is your friend.

There's quite a few holes in browsers and apps that are loaded via the browser such as Adobe Acrobat Reader, so this is the most likely route. (In my case I thought I saw Acrobat launch in the browser very briefly before things went pear shaped.)

share|improve this answer
i didnt know about that. Does adobe leak through firefox? currently i dont have it installed (its like a month old install) – acidzombie24 Jul 25 '09 at 0:32

If you're certain it wasn't from that suspicious site perhaps it had been on your computer for a while and it was just coincidence that it appeared when it did.

I'm currently trying to get rid of a virus off several machines which stays dormant for about 2 weeks and then starts to cause problems. You kill off every sign of it with AV software and then 2 weeks later it comes back again.

In my case the infection probably came from sharing USB flash drives though I'll never really know. It's the 1980s and infected floppy disks all over again.

share|improve this answer

I'd second malwarebytes - though in some case some virus' tend to block it from being installed if it isn't already. The slightly more paranoid might give rootkit revealer a shot or an offline antivirus tool, such as the one avira has depending on if you think your system itself is compromised, the latter won't hurt anyway.

Once you got it taken care of, running as a limited user might help as well, unless you need to- as a preventive measure.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .