Infected with brastk.exe, karna.dat, Antivirus 2009..

Hi Tarq57...thanks so much for your assistance. Unfortunately, neither of those links work in either of my 2 browsers: IE7 and Firefox 3 (this just shows how screwed up my system is, I guess). In IE7, I get taken to the page from Google that says "Oops! This link appears broken" (for MBAM) or to a page which says "Internet Explorer cannot display the webpage." In Firefox 3, I get taken to a page which says "Failed to connect." Can I access these any other way?

Thanks very much

Maybe you give the following a try:

For IE7 -

1. Try IE7 w/out add-ons -
START | type internet into start search box | click on IE without add-ons

2. Reset IE7 to default settings -
START | type inetcpl.cpl into the start search box and hit enter | select the Advanced tab | Click on Reset (bottom-right) | Click OK (if hi-lighted) | Click OK

3. Reset the Windows Firewall to its default settings -
START | type FirewallSettings.exe into the start search box | click on FirewallSettings.exe above | select the Advanced Tab | click on "Restore Defaults" | Click Apply (if hi-lighted) | Click OK

4. Boot into SAFEMODE w/Networking and test IE7 there

5. Try same w/ Mozilla Firefox

http://www.techsupportforum.com/microsoft-support/windows-vista-support/301414-trojan-bad-setting-all-web-site-ads-have-dns-error.html

Hi...thank you for these instructions. I was trying to follow them, but I think they may apply to people with Vista. I have XP Home...is there another way for me to carry these instructions out?

Thanks

INTRODUCTION
Internet Explorer 7 for Windows XP and Internet Explorer 7 in Windows Vista have many security improvements that make Internet Explorer 7 less susceptible to spyware and to malware. However, badly written add-ins, even though they might not be spyware or malware, can affect the browsing experience in Internet Explorer 7. We have included a new feature in Internet Explorer 7 named Reset Internet Explorer Settings. This feature returns Internet Explorer 7 to its basic state, without any add-ins or other browser extensions.

More: http://support.microsoft.com/kb/923737

One part is not clear is that; when your XP doesn't even start how did you get to run CCleaner and Webroot?
You can't do anything just watch the screen went blank. Describe the method in detail will you?

Hi. Sorry for the ambiguity there...actually, XP always was (and is) able to start. At first, I was getting blue screens shortly AFTER XP had started up fully. So my computer then would re-start automatically. But, I was able to quickly launch CC (followed by WW) before any blue screen occurred on a couple of occassions. At the time, I thought that running these apps is what prevented the blue screen from occurring...but I was wrong, because I did notice one time subsequently that a blue screen occurred while CC was running. At the moment, the blue screens on startup seemed to have ceased. Perhaps removing Y Messenger and cleaning out my registry with CC and OneCare helped with that...I'm not sure. But I still see blue screens whenever I try to install the Webroot AntiVirus with AntiSpyware scan-only app (in both normal and safe modes).

Hi Marianna...thank you so much for that Norton link. I had a few questions about what I read there, if you would be so kind:

1. There is a link to a program that can delete brastk within that Norton link. But the brastkremover link did not work (a common problem on my system, at the moment). So, I Googled "brastkremover", and I found 2 types: brastkremover.exe and brastkremover.rar. Is there an important difference between these, and, if so, which should I use? And how exactly would I launch either one?


2. The person in the Norton link says that after running the brastkremover, he removed all entries for brastk.exe and karna.dat from his registry. Before I do this, I plan on creating a manual restore point. However, would you be able to assist me in figuring out what exactly to delete from my registry using RegEdit? I would definitely like to have expert opinion on this matter, first. I don't want to delete ANYTHING from my registry without making sure it's okay to do so first.

Thank you so much..

The download shows this link:

http://net-studio.org/software/BrastkRemover.rar and has 403 kb.

Download the exe file onto your desktop and SCAN the exe with your AV - only to be sure !

Then doubleclick the file.

Before you do anything in the registry - BACK UP your registry!!

Click on Start-Run. When the box opens type in "regedit" (without the quotes). Click Ok. When the Registry Editor window opens, click on the "My Computer" entry so it is highlighted. Next, click on "Registry" in the upper left corner of the window, ("File" in Windows 2000/XP) choose "Export Registry File" (or "Export" in Windows 2000/XP). When the next window opens, be sure of the location where you are saving it to (I direct it to my desktop for easy access) and give the file a name like Backup. Click "Save". You now have a backup registry that can be double clicked and will replace the new one you?re going to make, IF you make any deletions you don't like.. (Thanks to Grif)

I don't know, IF you could read the page about
brastk (brastk.exe) Remover

Here it goes:

nformation


A malicious backdoor trojan that runs in the background and allows remote access to the compromised system.

File


* <System>\brastk.exe
* <System>\delself.bat
* <System>\dllcache\beep.sys
* <System>\dllcache\figaro.sys



Registry


* Created Registry Values:
o [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
+ 1208 = 0x00000000
+ 2500 = 0x00000003
o [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
+ 1208 = 0x00000000
+ 2500 = 0x00000003
o [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
+ 1208 = 0x00000000
+ 2500 = 0x00000003
o [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
+ 1208 = 0x00000000
+ 2500 = 0x00000003
o [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
+ 1208 = 0x00000000
+ 2500 = 0x00000003
o [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
+ brastk = "%System%\brastk.exe"

o [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
+ Enable Browser Extensions = "yes"
+ Search Bar = "http://www.google.com/ie"
o [HKEY_CURRENT_USER\Software\Microsoft\Security Center]
+ AntiVirusDisableNotify = 0x00000001
+ FirewallDisableNotify = 0x00000001
+ UpdatesDisableNotify = 0x00000001

o [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
+ brastk = "%System%\brastk.exe"

* Registry Values were modified:
o [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
+ Default_Search_URL = "http://www.google.com/ie"
+ Search Page = "http://www.google.com"
+ Start Page = "http://www.google.com"
o [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
+ SearchAssistant = "http://www.google.com"
o [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
+ 1201 = 0x00000000
+ 1804 = 0x00000001
o [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
+ 1201 = 0x00000000
o [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
+ 1201 = 0x00000000
+ 1804 = 0x00000001
o [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
+ 1201 = 0x00000000
o [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
+ 1200 = 0x00000000
+ 1201 = 0x00000000
+ 1608 = 0x00000000
+ 1804 = 0x00000001
o [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
+ Start Page = "http://www.google.com"
+ Search Page = "http://www.google.com"



ATTENTION
Once the virus installed on your computer, it will connect to http://do-scan-progress.com/?wmid=1058&l=33&it=2&s=1 and tries to download a file named wini10581.exe , puts it in the Windows directory and installs an application called XP AntiSpyware 2008 (or 2009) or XP AntiVirus 2008 or 2009.

http://net-studio.org/application/brastk.php

Good Luck and fingers crossed

Hi Marianna...I cannot thank you enough for those detailed instructions that you provided. That was exactly what I needed: step-by-step instructions. There were just a few questions I had regarding the final part dealing with the registry:

1. Should I search for and delete from my system the 4 items listed under "File" (eg. <system>\brastk.exe)? Do I just do a search in "my computer" for these?

2. Should I delete those items (via regedit) listed under "created registry values"? And also, do I navigate to these entries in regedit by typing in the entire "HKEY" title?

3. And for the items listed under "registry values were modified", should I delete those, as well?

Finally, I just wanted to mention that, earlier today, I did a search of my registry (using regedit) for "brastk" and "karna". Items pertaining to these did appear. I also found entries with "data" names like "beep", "2009", "antivirus2009", and "wini10581.exe". Should I go ahead and delete any entries I find that are obviously malicious like these (even though they are not necessarily included in the registry list that you provided)?

Thanks once again very much...your help is greatly appreciated.

Hey, good news! I got mine safe mode and start normal back up again.
I tell you what I do, I edit the registry on another XP by loading on to regedit. You next delete every brastk and karna.
Those two files are found mostly on the root directory, windows/ directory and systems32 directory.
I also replace the csrss file I think it got corrupted.

The issue that you are having is often installed with a rootkit. Depending on the variant, you may not see visible evidence in the registry. Due to the public nature of this forum, I can give no additional details.
I suggest that anyone experiencing similar symptoms post on one of the forums that can have a helper work with you step-by-step to run some specialized tools that will clean as well as produce the logs needed to diagnose this. If necessary, your helper will move you to a rootkit forum.
There is a list of general malware removal forums on Trend Micro's page:
http://hjt-data.trend-braintree.com/hjt/analyzethis/index.php?report=7784239

Hi Marianna...I was sort of familiarizing myself with RegEdit, and I think that I know now how to navigate to specific entries. As such, I just wanted to ask 2 questions about how to proceed:

1. Should I delete from my registry any entries which match those listed under "created registry values" (from the registry list that you provided)?

2. And if I find any entries that match those under "registry values were modified", should I delete those too?

Thanks again

You made a BACK UP of the registry?? IF YES......

Yes, go through the list in the link and delete those listed.

On another note, did you update and run Malwarebytes Anti Malware again? Did it find anything?

Hi Marianna...I actually have not made a registry backup yet, but I intend to do it before I make any changes to my registry. And as of yet, I have not run nor installed MalwareBytes. My plan actually is as follows:

1. Enter Safe Mode
2. Download brastkremover.exe to desktop and scan it with AV.
3. Run brastkremover.exe
4. Delete entries for "brastk", "karna", "beep.sys", "antivirus2009", and "delself.bat" from C:\WINDOWS and C:\WINDOWS\system32
5. Backup the registry
6. Create manual restore point
7. Clean out the registry of entries in the list you provided, as well as any entries pertaining to "brastk", "karna", "delself", and "antivirus2009".
8. Reboot to normal mode
9. Check msconfig>startup for "brastk" and also check the Task Manager for "brastk" and "karna" ("brastk" is currently in both).
10. Install and run Malwarebytes and re-try the scan-only Webroot app and some online scanners, as well.

Is this sequence OK, or would you recommend that I try MalwareBytes BEFORE doing the brastkremover.exe/registry cleanup?

Also, should I click "end process" for "brastk.exe" in the Task Manager immediately?

Thanks so much...

Hi Marianna...thank you for your approval of my step-by-step plan. But there's already a slight problem...I cannot seem to create a manual restore point. Every time I try, I get a message saying that it could not be created, and please try again upon reboot. Well, I did reboot and I tried again, but again it did not work. Should I try from Safe mode? And, if it fails there too, should I just proceed with the execution of brastkremover.exe?

Thanks again...

making a new restore point. Give it a try in safemode.

Did you click "end process" for "brastk.exe" in the Task Manager before trying to create a new restore point?

Yes, proceed with brastkremover.exe

Fingers crossed all works well

Hi Marianna...I did actually disable the "brastk.exe" in my Task Manager prior to trying to set the restore point. I also came to the conclusion that the malware is preventing me from setting it, as I have never had this problem before Anyway, I will give it a go from Safe mode, and, if it fails there too, I will proceed with my sequence of steps...I'll keep you informed..

Thanks again very much...

o.k......... after you ran the brastk.exe fix........ and BEFORE you BACK UP your registry........ try to make a NEW restore point and see if it now works.......

Keep up the good work

Hi Marianna...I have not commenced my procedure yet, as I just want to get my whole plan in order first. The only thing I've done thus far is kill brastk.exe from the Task Manager. I will certainly try again to make a restore point prior to the registry backup, and I'll let you know how it goes.

Before I commence this procedure, though, there is just one thing I wanted to be CERTAIN about. In that list of registry entries you provided, some of them are listed as having been "modified" by the virus. Are you certain that it's okay to DELETE these, as opposed to modifying them BACK to their "normal" state? If the latter, how do I find out what their "normal" forms are?

Thanks so much...

I had another look at the Norton forum. As they are now using "specific tools", I would suggest downloading HJT ..

HOW to post your HJT log on ONE of the HJT forums
http://forums.cnet.com/5208-6132_102-0.html?forumID=32&threadID=255339&messageID=2639147&tag=forums06;posts#2639147

Here's a list of reputable HJT forums:

http://www.bleepingcomputer.com/forums/forum22.html

http://www.geekstogo.com/forum/index.php?s=e39ad7e237ae123f43517316e44bf4bf&showforum=37

http://forums.spywareinfo.com/index.php?showforum=18

I think, that should be the SAFEST way to remove this infection.

Hi Marianna...I actually used HJT soon after I discovered my problem (as mentioned in my initial post here). I showed it to a computer-expert friend of mine, and he pointed out one thing to delete: AppInit_DLLs:karna.dat. I did so, but, I just checked HJT again, and this particular entry has now returned. I now also see some entries with the name "brastk" in it. I certainly will post this ASAP in a suitable forum, and then get back to you with news...

If HJT fails to cure my problem, however, I still wanted to just know one thing about the registry cleaning: for the registry entries listed under "registry values were modified (ie. by the virus)" in the list you provided, should I DELETE those or MODIFY them (that is, modify them back to their "normal" forms)? And if the latter, how can I determine what their "normal" forms are?

Thanks so much

Here is a good article about the registry: "How to Use the Registry Editor":

http://antivirus.vt.edu/info/regedit.asp

As I mentioned before, in a reputable HJT forum, they will give you exact instructions what to do as they can see a LOT of info in your HJT log and IF needed, they could give you a registry fix. So, do NOT worry

Thanks so much for that link regarding RegEdit. It is extremely informative for my purposes, but also quite interesting, as well. I always wondered about how the registry worked..

Thanks again..I'll keep in touch with developments. I am going to send my HJT logfile to some British site called "Icrontic".

Good Luck and fingers crossed

Well I got it to. Well this is deep. This virus has several fall backs. If u get rid of

karna.dat
and
brastk.exe

they will come back. I traced the roots back to the following file

csrss.exe

Now this is a windows file, and possibly infected.

So I tried to copy it over and discovered that the virus has also corrupted or some how using winlogon.exe, bcz when u delete/replace csrss.exe, winlogon.exe will go and create the csrss.exe again. So far I have traced the virus back to all these files. Once I fix them, I will let you know if there are any other files which need replacement.

Can any one not infected post size information for these files if u have xp sp2 or 3.

csrss.exe located in c:\windows\system32
winlogon.exe located in c:\windows\system32

As mentioned above, if you have the latest variant of this, you will not see the additional files or registry entries.

Hi houstontoca, thanks for your warning about those 2 files. I haven't really tried any troubleshooting steps yet, so I'm not sure if those 2 files are infected on my system. But, nonetheless, maybe I should go ahead and replace them when the time comes. Im sort of a newbie, so I was just wondering, how exactly do you replace files like those?

Thanks so much..