PC Live Infection--Caught it early?

dmend · September 10, 2012

Hello everyone,

This is my first post on your forum. On my desktop PC I picked-up that PC Live infection. However, I don't think it has been able to become active on the PC. Everytime I boot-up, PC Live comes on screen and starts to down load its program. I've always been able to cancel it and it stops down loading. I have no other PC Live symptoms on the PC.

I've searched for the various files that on-line sites say are created by PC Live and can't find any (that could be my ineptness, though). I've used Malwarebytes (free) and other programs but can't pick up the file that starts the downloads.

Is my only option to let PC Live download and become active on the PC, then start removal procedures?

Thank you for your comments.

Dmend

Maniac · September 10, 2012

Hello Dmend and :welcome: ! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.

No, do not allow this rogue application to be installed on your system. Do you see the name? Something like PC Live Guard or Live PC Care?

Next, download and run this tool:

http://forums.malwarebytes.org/index.php?showtopic=9573

Post the log files in your next reply.

dmend · September 15, 2012

Hello,

LivePC Support Manager Update Manager is trying to download to my PC. I cancel it and it stops, but retries with each boot-up. I can provide a screen shot of that if you like.

Thank you,

dmend

Below are the dds.text and attach.text log files for your review.

dds.tex:

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 10.5.1

Run by dm at 8:16:15 on 2012-09-15

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1548 [GMT -5:00]

.

FW: COMODO Firewall *Enabled*

.

============== Running Processes ===============

.

C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

C:\WINDOWS\system32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Conext\Conext Shutdown Manager\mainserv.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\COMODO\COMODO Internet Security\cfp.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Real\RealPlayer\update\realsched.exe

C:\Program Files\Conext\Conext Shutdown Manager\conexttray.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com

mURLSearchHooks: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - c:\program files\adawaretb\adawareDx.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll

BHO: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - c:\program files\adawaretb\adawareDx.dll

BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\oracle\javafx 2.1 runtime\bin\ssv.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\oracle\javafx 2.1 runtime\bin\jp2ssv.dll

TB: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - c:\program files\adawaretb\adawareDx.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

mRun: [COMODO] c:\program files\comodo\comodo geekbuddy\CLPSLA.exe

mRun: [CPA] c:\program files\comodo\comodo geekbuddy\VALA.exe

mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [Ad-Aware Browsing Protection] "c:\documents and settings\all users\application data\ad-aware browsing protection\adawarebp.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\conext~1.lnk - c:\program files\conext\conext shutdown manager\Display.exe

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

TCP: DhcpNameServer = 75.75.75.75 75.75.76.76

TCP: Interfaces\{1F6ED7F0-8C8E-4A14-B874-190D71475997} : DhcpNameServer = 75.75.75.75 75.75.76.76

Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll

Notify: SDWinLogon - SDWinLogon.dll

AppInit_DLLs: c:\windows\system32\guard32.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\dm\application data\mozilla\firefox\profiles\7dx5m19g.default\

FF - prefs.js: browser.startup.homepage - hxxp://google.com/

FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=utf-8&mssrc=ms_kwd&mstb=adawaretb&q=

FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll

FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll

FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\google\update\1.3.21.115\npGoogleUpdate3.dll

FF - plugin: c:\program files\oracle\javafx 2.1 runtime\bin\plugin2\npjp2.dll

FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll

FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_3_300_271.dll

FF - plugin: c:\windows\system32\npDeployJava1.dll

FF - plugin: c:\windows\system32\npptools.dll

.

---- FIREFOX POLICIES ----

FF - user.js: extensions.funmoods_i.newTab - false

FF - user.js: extensions.funmoods_i.tlbrSrchUrl - hxxp://start.funmoods.com/results.php?f=3&a=adknlg&q=

FF - user.js: extensions.funmoods_i.id - 20d761ca00000000000000e04cc9de7b

FF - user.js: extensions.funmoods_i.instlDay - 15451

FF - user.js: extensions.funmoods_i.vrsn - 1.5.11.16

FF - user.js: extensions.funmoods_i.vrsni - 1.5.11.16

FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.11.168:50:37

FF - user.js: extensions.funmoods_i.prtnrId - funmoods

FF - user.js: extensions.funmoods_i.prdct - funmoods

FF - user.js: extensions.funmoods_i.aflt - adknlg

FF - user.js: extensions.funmoods_i.smplGrp - none

FF - user.js: extensions.funmoods_i.tlbrId - base

FF - user.js: extensions.funmoods_i.instlRef -

FF - user.js: extensions.funmoods_i.dfltLng -

FF - user.js: extensions.funmoods_i.excTlbr - false

.

============= SERVICES / DRIVERS ===============

.

R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [2011-12-19 494968]

R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2011-12-19 31704]

R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2011-12-23 101720]

R2 CLPSLS;COMODO livePCsupport Service;c:\program files\comodo\comodo geekbuddy\CLPSLS.exe [2011-11-23 1052472]

R2 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2011-12-19 1983232]

R2 Conext UPS Service;Conext UPS Service;c:\program files\conext\conext shutdown manager\mainserv.exe [2012-2-28 143482]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-12-25 136176]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-6 250056]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-12-25 136176]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-6-12 22344]

S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-4-26 113120]

S3 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files\spybot - search & destroy 2\SDFSSvc.exe [2012-4-23 1181104]

S3 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files\spybot - search & destroy 2\SDUpdSvc.exe [2012-4-23 1185704]

S4 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-6-12 655944]

.

=============== Created Last 30 ================

.

2012-08-17 13:52:04 9826504 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe

2012-08-17 12:37:42 -------- d-----w- c:\program files\CCleaner

2012-08-17 12:21:41 -------- d-----w- c:\windows\system32\wbem\repository\FS

2012-08-17 12:21:41 -------- d-----w- c:\windows\system32\wbem\Repository

2012-08-17 12:13:36 -------- d-----w- C:\sh4ldr

2012-08-17 09:20:05 -------- d-----w- c:\documents and settings\dm\local settings\application data\Identities

2012-08-17 09:18:01 -------- d-----w- c:\windows\system32\GroupPolicy

2012-08-17 09:18:01 -------- d-----w- c:\program files\Windows Desktop Search

2012-08-17 03:36:43 -------- d-----w- c:\documents and settings\all users\application data\Rising

2012-08-17 03:36:21 -------- d-----w- c:\program files\Rising

2012-08-17 00:13:58 -------- d-----w- c:\program files\PC Tools(2)

2012-08-17 00:10:36 -------- d-----w- c:\program files\common files\PC Tools

2012-08-17 00:09:37 -------- d-----w- c:\documents and settings\all users\application data\PC Tools

2012-08-17 00:09:36 -------- d-----w- c:\documents and settings\dm\application data\TestApp

2012-08-16 16:45:07 -------- d-----w- c:\program files\VS Revo Group

.

==================== Find3M ====================

.

2012-08-17 13:52:06 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-08-17 13:52:06 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-07-12 03:57:46 499712 ----a-w- c:\windows\system32\msvcp71.dll

2012-07-06 13:58:51 78336 ----a-w- c:\windows\system32\browser.dll

2012-07-04 14:05:18 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-07-03 18:46:44 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-07-03 13:40:15 1866112 ----a-w- c:\windows\system32\win32k.sys

2012-06-28 21:33:05 667136 ----a-w- c:\windows\system32\wininet.dll

2012-06-28 21:33:05 61952 ----a-w- c:\windows\system32\tdc.ocx

2012-06-28 21:33:04 81920 ------w- c:\windows\system32\ieencode.dll

2012-06-28 12:46:29 369664 ------w- c:\windows\system32\html.iec

2010-05-25 23:54:52 10455896 ----a-w- c:\program files\setup.exe

.

============= FINISH: 8:18:31.08 ===============

Attach.tex:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 12/21/2011 9:18:21 PM

System Uptime: 9/15/2012 8:08:33 AM (0 hours ago)

.

Motherboard: | | P4M266A-8235

Processor: Intel® Pentium® 4 CPU 2.60GHz | Socket 478 | 2587/100mhz

.

==== Disk Partitions =========================

.

A: is Removable

C: is FIXED (NTFS) - 37 GiB total, 6.418 GiB free.

D: is CDROM ()

E: is FIXED (FAT32) - 38 GiB total, 31.257 GiB free.

.

==== Disabled Device Manager Items =============

.

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}

Description: Universal Serial Bus (USB) Controller

Device ID: PCI\VEN_1106&DEV_3104&SUBSYS_32041565&REV_82\3&13C0B0C5&0&83

Manufacturer:

Name: Universal Serial Bus (USB) Controller

PNP Device ID: PCI\VEN_1106&DEV_3104&SUBSYS_32041565&REV_82\3&13C0B0C5&0&83

Service:

.

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}

Description: Multimedia Audio Controller

Device ID: PCI\VEN_1106&DEV_3059&SUBSYS_F6141565&REV_50\3&13C0B0C5&0&8D

Manufacturer:

Name: Multimedia Audio Controller

PNP Device ID: PCI\VEN_1106&DEV_3059&SUBSYS_F6141565&REV_50\3&13C0B0C5&0&8D

Service:

.

==== System Restore Points ===================

.

RP188: 8/17/2012 7:36:57 AM - System Checkpoint

RP189: 8/17/2012 12:37:08 PM - Software Distribution Service 3.0

RP190: 8/20/2012 6:21:49 PM - System Checkpoint

RP191: 8/21/2012 6:58:14 PM - System Checkpoint

RP192: 9/1/2012 3:13:37 PM - System Checkpoint

.

==== Installed Programs ======================

.

Ad-Aware Security Toolbar

Adobe AIR

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader X (10.1.4)

Apple Application Support

Apple Software Update

Belarc Advisor 8.2

CCleaner

Comodo Dragon

COMODO GeekBuddy

COMODO Internet Security

Conext Shutdown Manager

EVGA Display Driver

GIMP 2.6.12-2

Google Chrome

Google Earth Plug-in

Google Update Helper

Hotfix for Windows XP (KB2633952)

Hotfix for Windows XP (KB942288-v3)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB981793)

Inkscape 0.48.2

Java Auto Updater

Java 6 Update 22

Java 6 Update 31

Java 7 Update 5

JavaFX 2.1.1

MailWasher Pro

Malwarebytes Anti-Malware version 1.62.0.1300

Microsoft Office XP Professional

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Mihov Image Resizer 1.2 (remove only)

Mozilla Firefox 14.0.1 (x86 en-GB)

Mozilla Maintenance Service

OpenOffice.org 3.3

Opera 11.60

PCI Audio Driver

QuickTime

RealNetworks - Microsoft Visual C++ 2008 Runtime

RealPlayer

RealUpgrade 1.1

Security Update for Microsoft Windows (KB2564958)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player (KB979402)

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2124261)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2290570)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2507938)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2510581)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276-v2)

Security Update for Windows XP (KB2544521)

Security Update for Windows XP (KB2544893-v2)

Security Update for Windows XP (KB2566454)

Security Update for Windows XP (KB2570222)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2584146)

Security Update for Windows XP (KB2585542)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB2598479)

Security Update for Windows XP (KB2603381)

Security Update for Windows XP (KB2618451)

Security Update for Windows XP (KB2619339)

Security Update for Windows XP (KB2620712)

Security Update for Windows XP (KB2621440)

Security Update for Windows XP (KB2624667)

Security Update for Windows XP (KB2631813)

Security Update for Windows XP (KB2633171)

Security Update for Windows XP (KB2646524)

Security Update for Windows XP (KB2647516)

Security Update for Windows XP (KB2653956)

Security Update for Windows XP (KB2659262)

Security Update for Windows XP (KB2660465)

Security Update for Windows XP (KB2661637)

Security Update for Windows XP (KB2676562)

Security Update for Windows XP (KB2685939)

Security Update for Windows XP (KB2686509)

Security Update for Windows XP (KB2695962)

Security Update for Windows XP (KB2699988)

Security Update for Windows XP (KB2705219)

Security Update for Windows XP (KB2707511)

Security Update for Windows XP (KB2709162)

Security Update for Windows XP (KB2712808)

Security Update for Windows XP (KB2722913)

Security Update for Windows XP (KB2723135)

Security Update for Windows XP (KB2731847)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB923789)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB953155)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB970483)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975254)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975561)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB976323)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979559)

Security Update for Windows XP (KB979683)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980195)

Security Update for Windows XP (KB980218)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981349)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982381)

Security Update for Windows XP (KB982665)

Spybot - Search & Destroy

Spybot - Search & Destroy 2

Update for Windows XP (KB2345886)

Update for Windows XP (KB2641690)

Update for Windows XP (KB2718704)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

WebFldrs XP

Windows Genuine Advantage Notifications (KB905474)

Windows Media Format Runtime

Windows Media Player 10

Windows XP Service Pack 3

ZipWiz 2005 by Synaptek Software

.

==== Event Viewer Messages From Past Week ========

.

9/8/2012 10:55:38 AM, error: Dhcp [1002] - The IP address lease 192.168.1.101 for the Network Card with network address 00E04CC9DE7B has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

.

==== End Of File ===========================

Maniac · September 16, 2012

Step 1

Please uninstall this application: Ad-Aware Security Toolbar

Step 2

Launch Malwarebytes' Anti-Malware
Go to Update tab and select Check for Updates. If an update is found, it will download and install the latest version.
Go to Scanner tab and select Perform Quick Scan, then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer,please do so immediately.

Step 3

Please download AdwCleaner from here and save it on your Desktop.

Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
Now click on the Search tab.
Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

Step 4

Download aswMBR.exe to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan

On completion of the scan click save log, save it to your desktop and post in your next reply

In your next reply, post the following log files:

Malwarebytes' Anti-Malware log
AdwCleaner log
aswMBR log
a new fresh DDS log

dmend · September 17, 2012

I ran the programs. Below are the reports. When the computer rebooted, the PC Live program attempted to download again.

Malwarebytes:

2012/07/18 10:25:41 -0500 POWERSPEC2 MESSAGE Starting protection

2012/07/18 10:25:59 -0500 POWERSPEC2 dm MESSAGE Protection started successfully

2012/07/18 10:26:03 -0500 POWERSPEC2 dm MESSAGE Starting IP protection

2012/07/18 10:26:47 -0500 POWERSPEC2 dm MESSAGE IP Protection started successfully

2012/07/18 10:26:47 -0500 POWERSPEC2 dm MESSAGE Stopping IP protection

2012/07/18 10:26:47 -0500 POWERSPEC2 dm MESSAGE IP Protection stopped

2012/07/18 10:29:27 -0500 POWERSPEC2 dm MESSAGE Starting database refresh

2012/07/18 10:29:46 -0500 POWERSPEC2 dm MESSAGE Database refreshed successfully

2012/07/18 13:12:57 -0500 POWERSPEC2 MESSAGE Starting protection

2012/07/18 13:13:18 -0500 POWERSPEC2 dm MESSAGE Protection started successfully

2012/07/18 13:13:21 -0500 POWERSPEC2 dm MESSAGE Starting IP protection

2012/07/18 13:13:52 -0500 POWERSPEC2 dm MESSAGE IP Protection started successfully

2012/07/18 13:13:52 -0500 POWERSPEC2 dm MESSAGE Stopping IP protection

2012/07/18 13:13:52 -0500 POWERSPEC2 dm MESSAGE IP Protection stopped

Adwcleaner:

# AdwCleaner v2.002 - Logfile created 09/17/2012 at 18:27:42

# Updated 16/09/2012 by Xplode

# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)

# User : dm - POWERSPEC2

# Boot Mode : Normal

# Running from : C:\Documents and Settings\dm\Desktop\adwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

File Found : C:\user.js

Folder Found : C:\Documents and Settings\All Users\Application Data\WeCareReminder

***** [Registry] *****

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}

Key Found : HKCU\Software\wecarereminder

Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

Key Found : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Key Found : HKLM\SOFTWARE\Classes\AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}

Key Found : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}

Key Found : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Key Found : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}

Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL

Key Found : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL

Key Found : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL

Key Found : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL

Key Found : HKLM\SOFTWARE\Classes\AppID\esrv.EXE

Key Found : HKLM\SOFTWARE\Classes\CLSID\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}

Key Found : HKLM\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}

Key Found : HKLM\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}

Key Found : HKLM\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}

Key Found : HKLM\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}

Key Found : HKLM\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}

Key Found : HKLM\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}

Key Found : HKLM\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}

Key Found : HKLM\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}

Key Found : HKLM\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}

Key Found : HKLM\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}

Key Found : HKLM\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}

Key Found : HKLM\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}

Key Found : HKLM\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}

Key Found : HKLM\Software\Funmoods

Key Found : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}

Key Found : HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}

***** [internet Browsers] *****

-\\ Internet Explorer v6.0.2900.5512

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (en-GB)

Profile name : default

File : C:\Documents and Settings\dm\Application Data\Mozilla\Firefox\Profiles\7dx5m19g.default\prefs.js

Found : user_pref("extensions.funmoods_i.aflt", "adknlg");

Found : user_pref("extensions.funmoods_i.dfltLng", "");

Found : user_pref("extensions.funmoods_i.excTlbr", false);

Found : user_pref("extensions.funmoods_i.id", "20d761ca00000000000000e04cc9de7b");

Found : user_pref("extensions.funmoods_i.instlDay", "15451");

Found : user_pref("extensions.funmoods_i.instlRef", "");

Found : user_pref("extensions.funmoods_i.newTab", false);

Found : user_pref("extensions.funmoods_i.prdct", "funmoods");

Found : user_pref("extensions.funmoods_i.prtnrId", "funmoods");

Found : user_pref("extensions.funmoods_i.smplGrp", "none");

Found : user_pref("extensions.funmoods_i.tlbrId", "base");

Found : user_pref("extensions.funmoods_i.tlbrSrchUrl", "hxxp://start.funmoods.com/results.php?f=3&a=adknlg&q[...]

Found : user_pref("extensions.funmoods_i.vrsn", "1.5.11.16");

Found : user_pref("extensions.funmoods_i.vrsnTs", "1.5.11.168:50:37");

Found : user_pref("extensions.funmoods_i.vrsni", "1.5.11.16");

-\\ Google Chrome v [unable to get version]

File : C:\Documents and Settings\dm\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

-\\ Opera v11.60.1185.0

File : C:\Documents and Settings\dm\Application Data\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [4465 octets] - [17/09/2012 18:27:42]

########## EOF - C:\AdwCleaner[R1].txt - [4525 octets] ##########

ASWMBR:

Run date: 2012-09-17 18:33:24

-----------------------------

18:33:24.972 OS Version: Windows 5.1.2600 Service Pack 3

18:33:24.972 Number of processors: 1 586 0x209

18:33:24.972 ComputerName: POWERSPEC2 UserName: dm

18:33:32.953 Initialize success

18:34:16.245 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4

18:34:16.245 Disk 0 Vendor: WDC_WD400EB-00JEF0 13.03G13 Size: 38166MB BusType: 3

18:34:16.245 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-c

18:34:16.245 Disk 1 Vendor: HDS728040PLAT20 PF1OA21B Size: 32253MB BusType: 3

18:34:16.255 Disk 0 MBR read successfully

18:34:16.255 Disk 0 MBR scan

18:34:16.255 Disk 0 Windows XP default MBR code

18:34:16.265 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 38154 MB offset 63

18:34:16.265 Disk 0 scanning sectors +78140160

18:34:16.336 Disk 0 scanning C:\WINDOWS\system32\drivers

18:34:23.936 Service scanning

18:34:38.718 Modules scanning

18:34:48.362 Disk 0 trace - called modules:

18:34:48.372 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys viaide.sys PCIIDEX.SYS

18:34:48.392 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a5daab8]

18:34:48.392 3 CLASSPNP.SYS[f7637fd7] -> nt!IofCallDriver -> \Device\0000005b[0x8a5fb0a0]

18:34:48.392 5 ACPI.sys[f75ae620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-4[0x8a624d98]

18:34:48.392 Scan finished successfully

18:35:20.598 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\dm\My Documents\MBR.dat"

18:35:20.598 The log file has been saved successfully to "C:\Documents and Settings\dm\My Documents\aswMBR.txt"

DDS:

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 10.5.1

Run by dm at 18:35:57 on 2012-09-17

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1445 [GMT -5:00]

.

FW: COMODO Firewall *Enabled*

.

============== Running Processes ===============

.

C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

C:\WINDOWS\system32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Conext\Conext Shutdown Manager\mainserv.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe