Liveupdt.exe

[DreamTaco]

Ok so on bootup I get the message "windows cannot run the text you entered " liveupdt.exe." Because the file does not exist." Ive read that it might be an Asus thing, but it only just started happening. If the file doesn't exist, but it's trying to run it, does that mean it's just something in my startup programs I need to change? Or could it be malware trying to disguise itself as an executable file? Thanks

 

[blues_harp28]

Hi, check and post
TSG System Information Utility - found here.
http://static.techguy.org/download/SysInfo.exe
======
Download Security Check by screen317 from.
http://screen317.spywareinfoforum.org/
Or
http://www.bleepingcomputer.com/download/securitycheck/dl/123/

Save it to your Desktop.
Double click the install icon.
If using Vista - Win 7 - right click the install icon and select "Run as Administrator"
A command Prompt window will open.
Let it scan the Pc - press any key when asked.
It should now open in Notepad.
Copy and Paste the result of the scan in the reply box below.
======
Liveupdt.exe
It is a valid program but does not need to run at start up.
http://www.bleepingcomputer.com/startups/LiveUpdate-26396.html

Download SINO by Artellos.

• Save SINO to your desktop and run SINO.exe. (If you downloaded the ZIP version you will need to extract it first)
• Then please check the following checkboxes:
  

  Startup Items

• Once checked, hit the Run Scan! button and wait for the program to finish the scan.
  
• A notepad window will pop up. Please copy all of the content into your next reply.

Note: If you try to interact with the program once it’s started scanning it might appear to hang. The scan however will continue.

 

[DreamTaco]

Ok I will do that as soon as I get back to my computer, thank you for your reply

 

[blues_harp28]

Ok - post back when you are ready.

 

[DreamTaco]

Results of screen317's Security Check version 0.99.93
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
AVG AntiVirus Free Edition 2015
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
AVG Web TuneUp
Adobe Flash Player 10 Flash Player out of Date!
Mozilla Firefox 29.0 Firefox out of Date!
````````Process Check: objlist.exe by Laurent````````
AVG avgwdsvc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 7%
````````````````````End of Log``````````````````````

 

[DreamTaco]

System Investigator by Olrik
Log Created On: 1441_15-01-2015
SINO Version: 3.1.0.0
Total RAM: 12265 MB | Free RAM: 9521 MB | Pagefile Size: 12265 MB
C: | 164501 MB out of 300061 MB Free | Local Fixed Disk
D: | 357151 MB out of 357687 MB Free | Local Fixed Disk
E: | 368236 MB out of 389738 MB Free | Local Fixed Disk
F: | 205323 MB out of 357715 MB Free | Local Fixed Disk
G: | None | CD-ROM Disc
<<<< System Information >>>>
Computer Name: WILLISPC
Username: Willis
Language Setting: ENU
Windows Directory: C:\Windows
Windows Version: Windows 7 Service Pack 1
UAC Status: Off
Windows Mode: Normal
<<<< Startup Items >>>>
[StormWatch.lnk] - <Startup> - C:\Program Files (x86)\StormWatch\StormWatch.exe
[StormWatchApp.lnk] - <Startup> - C:\Program Files (x86)\StormWatch\StormWatchApp.exe
[AsusVibeLauncher.lnk] - <Common Startup> - C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe
[RTHDVCPL] - <HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run> - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
[AtherosBtStack] - <HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run> - "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
[AthBtTray] - <HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run> - "C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe"
[fspuip] - <HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run> - %ProgramFiles%\FSP\fspuip.exe
[IntelTBRunOnce] - <HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run> - wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
[THXCfg64] - <HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run> - C:\Windows\system32\RunDLL32.exe C:\Windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64
[Setwallpaper] - <HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run> - c:\programdata\SetWallpaper.cmd


------ End of File ------

 

[blues_harp28]

Adobe Flash Player 10 Flash Player out of Date!
http://get.adobe.com/flashplayer/?no_redirect
Untick the free McAfee scan before downloading Adobe

(UAC is disabled!)
Turn on User Account Control.
http://windows.microsoft.com/en-gb/windows/turn-user-account-control-on-off#1TC=windows-7
======
Start > Search > Type
msconfig
Under the Start Up Tab.
Untick all entries Except

Software\Microsoft\Windows\CurrentVersion\Run> - %ProgramFiles%\FSP\fspuip.exe
[IntelTBRunOnce] -

Software\Microsoft\Windows\CurrentVersion\Run> - c:\programdata\SetWallpaper.cmd

Apply > Ok > Reboot your Pc.

The System Configuration Utility box appear on restart - saying changes have been made.
Tick the box on the lower left and then OK.

Any entry can be re-enabled using msconfig - if it needs to be
http://www.netsquirrel.com/msconfig/
http://www.bleepingcomputer.com/startups/

Avg should be set to run at start up.
Add Avg to the above start up list.
======
Download the following.
Download AdwCleaner by Xplode to your desktop.
http://www.bleepingcomputer.com/download/adwcleaner/
Click on the Download Now @BleepingComputer button and save it to your desktop.

NOTE: If using Internet Explorer and you get an alert that stops the program downloading click on Smartscreen Filter > Turn off Smartscreen Filter then click on OK in the box that opens. Then click on the link again.

Close any browsers that may be open - double click on the ADWCleaner icon on your desktop
Click on the Scan button.
Let it scan your Pc - when that is done click on the Report button.
Allow it to clean and reboot your Pc.
The report will appear on your desktop - Copy and Paste it into your next post.

 

[DreamTaco]

# AdwCleaner v4.107 - Report created 15/01/2015 at 15:22:27
# Updated 07/01/2015 by Xplode
# Database : 2015-01-13.2 [Live]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Willis - WILLISPC
# Running from : C:\Users\Willis\Desktop\AdwCleaner.exe
# Option : Scan
***** [ Services ] *****
Service Found : Partner Service
Service Found : SWUpdater
Service Found : vToolbarUpdater18.2.0
***** [ Files / Folders ] *****
Folder Found : C:\Program Files (x86)\Common Files\AVG Secure Search
Folder Found : C:\Program Files (x86)\StormWatch
Folder Found : C:\ProgramData\AVG Secure Search
Folder Found : C:\ProgramData\AVG Security Toolbar
Folder Found : C:\ProgramData\Partner
Folder Found : C:\Users\Willis\AppData\Local\StormWatch
Folder Found : C:\Users\Willis\AppData\Local\Temp\Cyti Web
Folder Found : C:\Users\Willis\AppData\Local\Weather_Protector_LLC
Folder Found : C:\Users\Willis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StormWatch
***** [ Scheduled Tasks ] *****

 

[DreamTaco]

# AdwCleaner v4.107 - Report created 15/01/2015 at 15:27:30
# Updated 07/01/2015 by Xplode
# Database : 2015-01-13.2 [Live]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Willis - WILLISPC
# Running from : C:\Users\Willis\Desktop\AdwCleaner.exe
# Option : Clean
***** [ Services ] *****
[#] Service Deleted : Partner Service
[#] Service Deleted : SWUpdater
[#] Service Deleted : vToolbarUpdater18.2.0
***** [ Files / Folders ] *****
Folder Deleted : C:\ProgramData\AVG Secure Search
Folder Deleted : C:\ProgramData\AVG Security Toolbar
Folder Deleted : C:\ProgramData\Partner
Folder Deleted : C:\Program Files (x86)\StormWatch
Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search
Folder Deleted : C:\Users\Willis\AppData\Local\Temp\Cyti Web
Folder Deleted : C:\Users\Willis\AppData\Local\StormWatch
Folder Deleted : C:\Users\Willis\AppData\Local\Weather_Protector_LLC
Folder Deleted : C:\Users\Willis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StormWatch
***** [ Scheduled Tasks ] *****

 

[blues_harp28]

Has the Liveupdt.exe gone at start up?
======
You need some anti-spyware program installed.
Download MalwareBytes to your desktop.
Download the Free version.
MalwareBytes
Once downloaded to your desktop.
Close all open browser windows.

Click on the Install icon - allow it to update during the install process.
Start Malwarebytes Anti-Malware.
Before you run a scan.
Under Settings > Detection and Protection in the left pane.
Under Detection Options - make sure that all three entries are ticked.
Under Non-Malware detections - set to Treat detections as Malware.

Now click - Scan button.
Then select - Threat Scan.
Then - Scan Now.
If any infections are found during the scan, the number of them will be listed.
When the scan is finished, make sure to select and remove Everything in the list.
You may be prompted to restart to finish the removal process.
If Yes - restart your Pc.

Start Malwarebytes Anti-Malware again.
Click History > Application Logs.
Select the most recent scan log.
Click View.
Select Export >Text File.
Name it mbam > then save it on the desktop.
Copy-and-paste its contents in the reply box below.

 

[DreamTaco]

Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 1/15/2015
Scan Time: 4:24:00 PM
Logfile: MB.txt
Administrator: Yes
Version: 2.00.4.1028
Malware Database: v2015.01.15.14
Rootkit Database: v2015.01.14.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Willis
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 368501
Time Elapsed: 17 min, 23 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 5
PUP.Optional.Taplika.A, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\lfkjojacgdjkninepeghaamnapdjmlfn, Quarantined, [66546f887d0c50e671065c135ea538c8],
PUP.Optional.Taplika.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\lfkjojacgdjkninepeghaamnapdjmlfn, Quarantined, [4278fdfae8a16ec84c2b155a000343bd],
PUP.Optional.Taplika.A, HKU\S-1-5-21-1540731633-3877377461-2134828316-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\wse_taplika, Quarantined, [c1f9c53256332313e58b91de758e8779],
PUP.Optional.Taplika.A, HKU\S-1-5-21-1540731633-3877377461-2134828316-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\lfkjojacgdjkninepeghaamnapdjmlfn, Quarantined, [a91155a25e2b251116624f20a3608f71],
PUP.Optional.Taplika.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WSE_Taplika, Quarantined, [07b316e1b1d83ff72aa9ed7fb54e24dc],
Registry Values: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Folders: 2
PUP.Optional.Taplika.A, C:\Program Files (x86)\WSE_Taplika, Quarantined, [07b316e1b1d83ff72aa9ed7fb54e24dc],
PUP.Optional.Taplika.A, C:\Program Files (x86)\WSE_Taplika\bh, Quarantined, [07b316e1b1d83ff72aa9ed7fb54e24dc],
Files: 5
PUP.Optional.Taplika.A, C:\Program Files (x86)\WSE_Taplika\astcnfg.dat, Quarantined, [07b316e1b1d83ff72aa9ed7fb54e24dc],
PUP.Optional.Taplika.A, C:\Program Files (x86)\WSE_Taplika\FavIcon.ico, Quarantined, [07b316e1b1d83ff72aa9ed7fb54e24dc],
PUP.Optional.Taplika.A, C:\Program Files (x86)\WSE_Taplika\Sqlite3.dll, Quarantined, [07b316e1b1d83ff72aa9ed7fb54e24dc],
PUP.Optional.Taplika.A, C:\Program Files (x86)\WSE_Taplika\uninst.dat, Quarantined, [07b316e1b1d83ff72aa9ed7fb54e24dc],
PUP.Optional.Taplika.A, C:\Program Files (x86)\WSE_Taplika\uninstall.exe, Quarantined, [07b316e1b1d83ff72aa9ed7fb54e24dc],
Physical Sectors: 0
(No malicious items detected)

 

[DreamTaco]

Also the message came up earlier after adwcleaner but not right upon bootup, have not seen it since though

 

[blues_harp28]

Malwarebytes
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Run the scan again.
Make sure that all entries are ticked under Under Settings > Detection and Protection in the left pane.
Under Detection Options - make sure that all three entries are ticked.
Under Non-Malware detections - set to Treat detections as Malware.

Only post the scan log file if it finds something.
======
Download Junkware Removal Tool
http://www.bleepingcomputer.com/download/junkware-removal-tool/

Temporarily shutdown your anti-virus to avoid any conflicts.
http://www.bleepingcomputer.com/for...nti-virus-firewall-and-anti-malware-programs/
Be sure to enable the anti-virus program after the scan.

Right-mouse click JRT.exe and select Run as administrator (If using XP just double click on the icon to run it.)
The tool will open and start scanning your system.
Please be patient as this can take a while to complete.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

 

[DreamTaco]

MB found nothing, here is JRT results

~~~ Services


~~~ Registry Values


~~~ Registry Keys


~~~ Files
Successfully deleted: [File] C:\Windows\prefetch\GOOGLETOOLBARNOTIFIER.EXE-7AE0A20E.pf
Successfully deleted: [File] C:\Windows\prefetch\TOOLBARUPDATER.EXE-5D621FC1.pf

 

[DreamTaco]

also I just got the message again just before the scan. I quote "windows cannot find 'Liveupdt.exe'. Make sure you typed the name correctly, and then try again