-1

-Edit- for the people who say it isn't a virus. Norton does detect it as a virus, an icon was placed on my system tray and rkpg.exe is in my C: which was placed 6 min ago around the time my computer rebooted on its own causing me to lose data :@.

Situation I on Windows XP, behind a Linksys router, I don't have DMZ on so nothing should be connecting to me. I had Firefox, MSN and Visual Studio opened. With C# I programmed a quick application to scan some pages with Internet Explorer. The site it was scanning was deviantART (which is pretty trustworthy), I doubt any banners there would hold a virus. I went to a suspicious site called freetxt.com but that was on Firefox and it didn't load the site. With an extra check I ping it and got this message "Ping request could not find host freetxt.com."

The virus seems to be called braviax. Right now it brought up a message saying my computer may be infected? How on earth did it get in? I don't have uTorrent installed or any torrent or p2p applications. Nothing is installed on my computer that I haven't installed before and I know the exact time it installed because I see rkpg.exe on my C drive and my computer restarted on its own around the same time. For the previous 30 minutes actually the previous hour all I did was talk on MSN, not click any links (I went to freetxt on my own) and had that Internet Explorer thing running (which I programmed).

How did it get in? I really doubt it came from a banner on deviantART and installed when I loaded the page with the webbrowser-control so something else may have happened? Is there any system defaults I should turn off? I have remote assistance off but even if it was on I shouldn't be infected due to the router not forwarding any ports?

1
  • 6
    Please cut down the abbreviations, it's a bit hard to read and it makes you sound like a whining kid.
    – hasen
    Jul 24, 2009 at 22:02

6 Answers 6

0

Well, this won't help you get rid of it, but it will tell you how to avoid it.

DeviantArt is a trustworthy site, although whatever ad service they use is not. You should run Windows Update to get all the IE patches, and make sure you're using version 8 as well.

Although, as a heads up, no site with third-party ads is trustworthy because they'll sell out to the highest bidder to put whatever code they want on their site, especially JavaScript. Your best solution is to implement hosts-level ad blocking.

5
  • it turns out it was from DA.
    – user3109
    Aug 2, 2009 at 1:43
  • 1
    No, you should use firefox with adblockplus extension. You won't need to run windows update because firefox has its own superior update mechanism.
    – hasen
    Sep 8, 2009 at 2:59
  • 1
    @hasen j - True, but you should run Windows Update anyways for OS and MSRT patches. I was working on the assumption that the user would not want to switch browsers.
    – MiffTheFox
    Sep 8, 2009 at 21:23
  • 1
    hasen j: You may have miss it. The page was loaded via webbrowser-control which is IE in C#. So i cant use firefox since it doesnt interface. I dont know if learning the API (let alone trying to get it to work if it exist) and rewriting code is feasible.
    – user3109
    Sep 22, 2009 at 20:43
  • If you want to use Firefox with C#, you can use GeckoFX. geckofx.org
    – MiffTheFox
    Sep 23, 2009 at 12:47
3

If it's just popups then it's probably just spyware, not a full blown virus. Spybot should take care of it.

1
  • These days there is rarely such a thing as "just spyware"
    – user23307
    Apr 7, 2010 at 22:38
1

You ran something you shouldn't have, sometime, somewhere. Without watching over your shoulder it's kind of hard to pinpoint.

Like John says, it's probably not a virus but just a piece of malware which Adaware or Spybot or some other Malware-cleaner can take care of.

1
  • This is usually how viruses and spyware infect computers. It doesn't matter how secure your router is or if you have a specific program installed.
    – Travis
    Jul 24, 2009 at 14:02
1

Had the exact same infection (braviax, etc.) - Malware Bytes is your friend.

There's quite a few holes in browsers and apps that are loaded via the browser such as Adobe Acrobat Reader, so this is the most likely route. (In my case I thought I saw Acrobat launch in the browser very briefly before things went pear shaped.)

1
  • i didnt know about that. Does adobe leak through firefox? currently i dont have it installed (its like a month old install)
    – user3109
    Jul 25, 2009 at 0:32
0

If you're certain it wasn't from that suspicious site perhaps it had been on your computer for a while and it was just coincidence that it appeared when it did.

I'm currently trying to get rid of a virus off several machines which stays dormant for about 2 weeks and then starts to cause problems. You kill off every sign of it with AV software and then 2 weeks later it comes back again.

In my case the infection probably came from sharing USB flash drives though I'll never really know. It's the 1980s and infected floppy disks all over again.

0

I'd second malwarebytes - though in some case some virus' tend to block it from being installed if it isn't already. The slightly more paranoid might give rootkit revealer a shot or an offline antivirus tool, such as the one avira has depending on if you think your system itself is compromised, the latter won't hurt anyway.

Once you got it taken care of, running as a limited user might help as well, unless you need to- as a preventive measure.

You must log in to answer this question.