Just so you know......
If you get something like Braviax.exe/cru629.dat it reloads via a replacement for beep.sys (c:\windows\system32\drivers\...)- which makes the 'BEEP' noise when you boot and at some program errors. There are apparently other malwares using this method of re-installing themselves too, the standard WinXP one is only about 4Kb while the code-rewriting one is about 24kb but may vary depending on the exact bug - they are always updating them.
There are variants of Braviax/Cru629.dat so I couldn't say that they all use the BEEP.SYS trick but some definitely do - some of them also use a viral infector and a IRC bot apparently, the little devils. The last one I did was stealthing the files braviax and cru629 which didn't appear in either Task Manager or Explorer - which is nice. They always seem to download other malware too. Annoyingly the thing has been around for several months but the antivirus/antispyware vendors don't seem to be catching it or removing it.
Bookmarks