“Brave Sentry – BS 2.0” Windows XP Professional

[KRamos120]

Currently I am experiencing a problem with a Dell Insprion 600M laptop, operating system Windows XP Professional.  The problem began yesterday evening during which my desktop background became black and stated, “Your computer is in Danger.  Windows Security center has detected spyway/adware infection!  It is strongly recommended to use special antispyware tool to prevent data loss.”  Seconds later a balloon appeared in the lower left hand corner, which stated, “Your computer is infected.  Windows has detected spyware infection. It is strongly recommended to use special antispyware tool to prevent data loss.  Windows will now download and install the most up-to-date antispyware for you.  Click here to protect your computer from spyware.”  After which a box appeared “Brave Sentry – BS 2.0” and began scanning my computer for potential damages, listing different malwares (Trojan X Download, Win Desktop, Hotbar toolbar, Keenvalue/Perfect NAV, Internexus Dialer, Gatordone, etc.) and the threats (severe, high, etc.) they posed.   Not ever encountering this problem I let the program run.  After the program detected about 27 possible threats the scan stopped and the “remove threat” button appeared.  In clicking on the “remove threat” button, another box appeared titled “BS Evaluation Version Warning” underneath the title there was a brief paragraph, which stated “This version of BS is for evaluation purposes only.  The removal feature is disabled.  You may scan your PC to locate malware threats.  To be able to remove threats found you should purchase a license.”  Under the paragraph were two buttons the first being “purchase licenses” and the second being “continue evaluating.”  Below the two buttons there was a sentence that read “BS activation, if you have already purchased a licenses please enter the activation code below.”  Underneath the statement the third button being “Activate BS Now!”  Since this issue began, I am unable to connect to the Internet even when the computer is directly plugged into the modem and/or the wireless router is used.  The computer however, detects the wireless router, which it states is giving off a strong signal.  Lastly, there is another box which appears and is titled “Warning!” with the sentence “Get free *censored* now!” along with two buttons “OK” and “Cancel.”  If at all possible, I would greatly appreciate someone assisting me with this problem. 

[Broni]

Welcome aboard

Never, ever allow any unknown programs to be running on your computer. Period!

http://www.bleepingcomputer.com/forums/topic55983.html

Brave Sentry is an alleged antispyware application that uses Trojans and other malware into tricking or scaring you into purchasing it. If you are infected with this malware, your desktop background may change to a black screen with a false warning message. There will also be an alert in your taskbar stating that you have various infections or other security problems with your computer. When you click on these messages it automatically opens BraveSentry. It is advised that you do not purchase this program as it is on the rogue antispyware applications list.

Screenshots of the application and the warning can be found below:





Now...

1. Print out these instructions as we will need to close every window that is open later in the fix.

2. Download SmitfraudFix.exe from here and save it to your desktop:

http://www.bleepingcomputer.com/files/smitfraudfix.php

3. Next, please reboot your computer into Safe Mode by doing the following:

   a. Restart your computer

   b. Start tapping F8 key

   c. A menu will appear

   d. Select the first option, to run Windows in Safe Mode.

4. Close all open Windows.

5. Now, double-click on the SmitFraudfix icon.

6. When the tool first starts you will see a credits screen. Simply press any key on your keyboard to get to the next screen.

7. You will now see a menu. Press the number 2 on your keyboard and the press the Enter key to choose the option Clean.

8. The program will start cleaning your computer and go through a series of cleanup processes. When it is done, it will automatically start the Disk Cleanup program.
This program will remove all Temp, Temporary Internet Files, and other files that may be leftover files from this infection. This process can take up a long time depending on your computer, so please be patient. When it is complete, it will close automatically and you should continue with next step.

9. When Disk Cleanup is finished, you will be presented with an option asking Do you want to clean the registry ? (y/n). At this screen you should press the Y button on your keyboard and then press the Enter key.

10. When this last routine is finished, you will be presented with a red screen stating Computer will reboot now. Close all applications. You should now press the spacebar on your computer. A counter will appear stating that the computer will reboot in 15 seconds. Do not cancel this countdown and allow your computer to reboot.

11. Once the computer has rebooted, you will be presented with a Notepad screen containing a log of all the files removed from your computer.
Save that log to your desktop, and attach it to your next reply.

[KRamos120]

Since this issue began, I am unable to connect to the Internet even when the computer is directly plugged into the modem and/or the wireless router is used.  The computer however, detects the wireless router, which it states is giving off a strong signal. I am currently using an iBook to obtain any help from this website and if anyone can further help me I would greatly appreciate it.

[Broni]

Op Pmed me with this:

Thank you very much for assistance, I really appreciate it.  I just seem to have one tiny problem and that is I can not get on the internet from my dell laptop.  Since this issue began, I am unable to connect to the Internet even when the computer is directly plugged into the modem and/or the wireless router is used.  The computer however, detects the wireless router, which it states is giving off a strong signal. The laptop only has internet explorer on it and everytime I click the desktop icon a blank page comes up and states it can not find the server.  I am just not sure what to do from here I understood the directions you send regarding the malware, I am just not sure how to download that link when using an iBook and not the computer that is having the problem.  I hope you can help me with this and once again I thank you for your help.

[Broni]

That file to download is only little bit over 1MB, so you can put it on floppy, and transfer it to your XP computer.

[KRamos120]

I just download the file that you suggested onto my Mac ibook when trying to run the program to fully install it and download onto a cd to transfer it to the PC however, when trying to run the program it opens up my itunes for some odd reason and then I can not find it in my itunes.  I also tried to insert the cd-r to the iBook and manually move the icon off the program to the cd-r to burn the cd which work.  However, when I placed the cd-r into the PC directions in French appeared and translated to roughly the program is missing files do you want to continue to install.  In hitting yes, there was another box that came up and where cancel appeared (in French) and closed (in French) as the two options.  Trying both of them nothing happened.  Are there any other ways to fix this problem?

[Broni]

when trying to run the program to fully install it

This is Windows program, you can't run it on mac. Just burn that file to CD. That's it.

[KRamos120]

I downloaded the program you suggester placed it on a cd-r inserted the cd-r with the program into the other laptop (PC) and there is an alert that comes up in French stating that there is a problem with the program it is missing files and when you continue with the installation it shuts you out.  Is there any thing else I can do I tried installing the program onto 4 different cd-r's and still nothing.  Considering the spyware that is in the computer ... is that the problem with why the internet is not working from the PC Laptop???

[Broni]

Considering the spyware that is in the computer ... is that the problem with why the internet is not working from the PC Laptop

Very possible.
Try to restart your laptop in Safe Mode, and see if you can install/run from there.

[KRamos120]

I ran/downloaded the program into the PC laptop in safemode.  It was success through all the steps except for a few.  However, a red Norton AntiVirus box appeared titled, Alert: Malicious Script Detected and below it stated Object: FileSystem Object Activity: Create TextFile, Your computer is halted and needs to do something about this script File: C:\WINDOWS\SYSTEM32\GETVALUE.vbs, What do you want to do? and just below there is a drop down box with these following options 1. Stop this script (recommended), 2. Allow this activity once, 3. Allow the entire script once, 4. Quarantine this script, 5. Authorize this script.  Then there is an option button stating okay.  I tried to allow the entire script option and as well as the allow this activity once and another Norton AntiVirus box came up titled Alert: Malicious Script Detected and below it stated Object: FileSystem Object Activity: Create TextFile, Your computer is halted and needs to do something about this script File: C:\Documents and Settings\logan pepchinski\SmitfraudFix\ScanDNS.vbs then when I chose the same option again the desk cleaning comes up ... cleans then the Registry cleaning prompt comes up where I enter Y (yes) and enter.  After which a rapport - Notepad appears as well as another box which is Titled Desktop, Windows is running in safe mode.  This special diagnostic mode of Windows enables you to fix a probelm which may be caused by your network or hardware settings.  Make sure these settings are correct in Control Panel, and then try starting Windows again.  While in safe mode, some of your devices may not be available.  To proceed to work in safe mode, click yes.  If you prefer to use System Restore to restore your computer to a previous state, click not.  Then there are the two buttons below with yes and no.  In clicking yes nothing happens afterwards there is no box counting down or any of the other things. 

[KRamos120]

Also, while waiting after a box titled Warning Get free *censored* now appeared with the two buttons below 1. okay (highlighted) and 2 cancel.   

[Broni]

There is something wrong here.
Did you print out my instructions?
This program HAS to be run from Safe Mode.
In Safe Mode, Norton CAN NOT run.
When you said Safe Mode, did you actually see SAFE MODE text in all four corners of your screen?

[KRamos120]

Yes, and the desktop back is black ... It is def. in safe mode. 

[Broni]

Do you have Norton icon in taskbar?

[KRamos120]

I ejected the cd-r which had the program on it and then the Norton AntiVirus box did not appear however, the box titled Desktop, Windows is running in safe mode.  This special diagnostic mode of Windows enables you to fix a probelm which may be caused by your network or hardware settings.  Make sure these settings are correct in Control Panel, and then try starting Windows again.  While in safe mode, some of your devices may not be available.  To proceed to work in safe mode, click yes.  If you prefer to use System Restore to restore your computer to a previous state, click not.  Then there are the two buttons below with yes and no.  In clicking yes nothing happens afterwards there is no box counting down or any of the other things.

[KRamos120]

No there is no Norton icon on the task bar.

[Broni]

Slow down. One thing at a time. Wait.

[Broni]

Then there are the two buttons below with yes and no.

This message is from Windows, not from program.
Insert that CD again, and run SmitfraudFix again. Have your printed instructions handy, and follow them.
Disregard any possible Norton warnings, means, "5. Authorize this script", etc.

[KRamos120]

I am not really sure what happened however, when I saved the program I placed sent it to a zipfile (I think that is what it is called), and the Norton AntiVirus boxes did not appear just the whole thing at the end on whether to continue running in safe mode.  I hit the yes button and restarted the computer in turning it back on - not in safe mode.  The BS 2.0 did not appear and the screen was back to the regular blue background.  I am not sure if the computer is playing tricks on me.  It kind of seems to good to be true and maybe it is because I am still unable to connect to the internet although the router is detected with excellent signal.  I hope this thing is not playing games with me.  I really do appreciate all the time you have spend with me on this problem ... I would be lost if it was not for your continued help.  Thanks so much

[Broni]

You wait there. I'm still munching your answer, and reading the whole thread from the beginning to offer you next step.
I hope, you followed all steps correctly.
I'll back with you, when I'm done with reading, but meanwhile, you answer my questions.
While running the program, did it went through Disk Cleanup, and registry cleanup, and did it start the counter to reboot?
After rebooting, you should be presented with Notepad text file, which I'd like to see.

[KRamos120]

While running the program it went through Disk Cleanup, Registry Cleanup, and it did start the counter to the reboot after which there was a notepad that appeared with text

[Broni]

Good...
Hopefully, BS is gone.
I assume, you can't connect to the Internet now, right?

[KRamos120]

I sure hope so, thanks to your help and you are correct, still unable to connect to the internet.  I am trying to save the notepad on a desk to download it to my Mac however, the disk is full.   

[Broni]

What disk is full?

[Broni]

Forget about that log file, for now.
I'd like to get you on-line, first, but I need an answer.
You said Norton. Is it Norton firewall + antivirus? Is it running now?

[KRamos120]

It was Norton AntiVirus but it is not appearing anymore.

[Broni]

Well, before I'll try to get you back on-line, you need some protection.
Is Norton listed in Add/Remove? Is it listed in "msconfig", Startup tab? Do you have your Windows firewall up?