Pcsecuritylab.com is a browser hijacker.
It may also change desktop wallpaper, shows message:
Warning! SpyWare Threat Detected on Your PC!
You will also periodically get fake security warning:
Your Security and Privacy are at risk: Spyware has been detected. Click HERE to remove it.
It automatically runs on every Windows startup. Pcsecuritylab.com is a very high security risk threat and should be removed immediately as to prevent harm to your computer and your privacy.
Download HijackThis and save the file to your desktop. Double click on the file for install.
Download CCleaner. Double click on the file for install.
Download Avenger and unzip to your desktop.
Open notepad and copy/paste the text in the quotebox below into it:
REGEDIT4
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000000-d9e3-4bc6-a0bd-3d0ca4be5271}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000012-890e-4aac-afd9-eff6954a34dd}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{029e02f0-a0e5-4b19-b958-7bf2db29fb13}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06dfedaa-6196-11d5-bfc8-00508b4a487d}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1adbcce8-cf84-441e-9b38-afc7a19c06a4}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{51641ef3-8a7a-4d84-8659-b0911e947cc8}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53C330D6-A4AB-419B-B45D-FD4411C1FEF4}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{669695bc-a811-4a9d-8cdf-ba8c795f261e}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6abc861a-31e7-4d91-b43b-d3c98f22a5c0}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8ABA9A9C-8791-4d61-8D5B-BCC9448EA573}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{944864a5-3916-46e2-96a9-a2e84f3f1208}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a4a435cf-3583-11d4-91bd-0048546a1450}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A6E432B4-D4C2-43B3-BF55-C364F8F7362A}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b8875bfe-b021-11d4-bfa8-00508b8e9bd3}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c2680e10-1655-4a0e-87f8-4259325a84b7}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c4ca6559-2cf1-48b6-96b2-8340a06fd129}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c5af2622-8c75-4dfb-9693-23ab7686a456}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ca1d1b05-9c66-11d5-a009-000103c1e50b}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d8efadf1-9009-11d6-8c73-608c5dc19089}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e690500e-1dd1-11b2-a943-9ecd016314d0}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9147a0a-a866-4214-b47c-da821891240f}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9306072-417e-43e3-81d5-369490beef7c}] [HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\winlogon] “Userinit”=”C:\\WINDOWS\\system32\\userinit.exe,”
Save this as Fix.reg to your Desktop (remember to select Save as file type: All files in Notepad.).
Double-click on the Fix.reg. When it asks if you would like to merge the information, press the Yes button and then the OK button when it is done.
Start HijackThis. Click “Do a system scan only.” and put a checkmark next to the following items:
O2 – BHO: (no name) – {12F02779-6D88-4958-8AD3-83C12D86ADC7} – (no file)
O8 – Extra context menu item: &Search – http://edits.mywebsearch.com/toolbar…p=ZJxdm186NJUS
Now close all browser and other windows except for HijackThis, and click “Fix Checked” to have HijackThis fix the entries you checked.
Run Avenger.
Check the ‘Input script manually’ option. Click the Magnifying Glass icon. In the box that opens, copy,then paste the following text:
Files to delete:
C:\WINDOWS\system32\dpqaqlqx.bin
C:\WINDOWS\system32\stfv.bin
C:\WINDOWS\system32\vvgeowbv.exe
C:\WINDOWS\system32\ace16win.dllFolders to delete:
C:\WINDOWS\system32\Mz15r
C:\WINDOWS\PerfInfo
C:\WINDOWS\McAfee.com
C:\Program Files\LimeWire
C:\WINDOWS\system32\acespy
Then click on ‘Done’.
Click the Traffic Light icon to start the program.
Then press OK at the prompts to reboot your PC.
Run CCleaner.
Click Analyze button. After scan your system, click Run Cleaner.
Reboot your PC.
If you are still having problems with spyware after completing these instructions, it`s possible, then please follow the steps outlined in the topic linked below:
Spyware removal – Read Before Posting
Hello:
I worked on getting rid of parts and pieces of the PCsecuritylab virus/trojan and all of it\\\’s associated downloaders and adware for hours using a variety of virus scanners (and the weakest was my Mcafee). I used the above fix. Combofix and our script worked well. I saved the log it generated. When I went to Hijackthis the 02 and 08 references correlated to McAfee and a helper for MSExcel, so I skipped that step and moved to Ccleaner. it found a few cookie entries but also said it deleted 50mg of stuff.
I think I am fixed and wanted to thank you.
Sincerely,
Wayne Essick