Old Napster Virus - or viruses?

Before we can continue, I need to know which user account you are trying to clean. You mentioned vairous problems running tools and the tools need to be run with accounts having administrator priviledges for them to run most effectively. You cannot get the same full effect by running the scans from a different user account than the account that you want to clean. Doing it that way will potentially clean problems in common file areas and common registry keys but it will not fully scan other user account areas.

Based on the logs you attached, you ran things under the Steve user account which is a Restricted User account which could explain some of your issues. But is this the user account you wanted to clean? Is this the user account that you use and wanted to clean?

Also note that you are extremely out of date with your copy of SUPERAntiSpyware and are also somewhat out of date with Malwarebytes. Thus to be safe, do the below on the user account your want to clean.

• Please uninstall your current version (this is necessary).
• Then download this SUPERAntiSpyware
• Install this new version. It may tell you that you need to reboot to complete the installation. You must reboot at this time.
• After the reboot, run SUPERAntiSpyware and immediately click the Check for Updates button to get more updates for the database.
• Now run a new full scan of your system. And attach this new log.

Now run Malwarebytes and click the Update tab. Then click the Check for Updates button so you update to the current version of the program and database. Then run a new scan with it too. Attach the new log.

 

Why did you create a new user account when you already had this account mom2many where you previously had posted this thread: http://forums.majorgeeks.com/showthread.php?t=179547

You are only updating the Core and Trace databases when you click the update button. This does not update the actual program version. You need to watch for program version updates and then uninstall the old version and install the new one like I had you do. This is the only way to get the program version updated (at least with the free version).

You do not have your PC in normal startup mode as requested in step 4 of the READ & RUN ME which said the below

You need to do this now before we can continue since it impacts our ability to provide proper and complete fixes. I will attempt to get you started on a fix but if you still do not have your PC in normal startup mode when we get the next set of logs, we will not be able to continue.


Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)

After clicking Fix, exit HJT.

Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

Now attach the below log:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

You're welcome.

You are basically clean now but you have some left overs to cleanup from Avast, Symantec, Online Armor, and Comodo which are no longer installed. Also I have other suggestions.


I strongly advise you to cleanup your Desktop. Remove eveything but links to run programs. Do not download and save programs here and defintely do not use it for long term storage. You need to keep ComboFix.exe here for now as we need it, but we will be removing it when we are finished with your cleanup. A cluttered Desktop is malware's playground and it can also cause performance degradation.
Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O23 - Service: BOCore - COMODO - C:\Program Files\Comodo\CBOClean\BOCORE.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
If you get any error messages about removing the above services just click OK and continue.
After clicking Fix, exit HJT.

Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

MGtools does not say anything about this. I assume you meant ComboFix. Keeping your software upto date is just something you need to stay on top of.

I'm not sure what you mean by "stalling" and "not functioning as expected". Your logs are clean. Your problems may just be related to what you still have installed, what you had installed and then uninstalled (like Online Armor, Sunbelt, ZoneAlarm...etc) and what you had installed that we had to cleanup. You had things from Symantec and Comodo installed while other ecurity programs were installed. Also you have Avira and BETA program (IObit Security 360). Beta programs are called beta because they can be flaky. Personally, I would not un this program even thought they imply it is okay to run with other antivirus programs.

Also the software you have installed from your ISP has been know to cause problems in the past. See: http://searchtasks.answersthatwork.com/tasklist.php?File=MotiveSB

Unknown but since your PC does not show any infections, this is probably not a malware issue anyway. If you don't trust these items then delete them and uninstall any software your loaded to play them.

Yes. Not a malware issue. You are still loading the service:
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

You caused many of these problems yourself by using MSconfig to control startups/sevices and then you uninstalled the software while these were still in MSconfig. This was explain in the READ & RUN ME as one of the many reasons why MSconfig should not be used. You need to stop and delete the service. You can do this by running the below from a command prompt window

sc stop LexBceS
sc delete LexBceS

Normal with IE8

I also see 10 instances of a process called SVCHOST.EXE running at all times. Is this good or bad? [/quote] Can be quite normal with all the items you are loading at startup. 6 to 8 is quite typical. I have 7 right now.

The process count will obviously be related to the software you run. It is not a problem unless the processes are slowing your PC down. Either way, it is not a topic for the malware forum unless you have malware processes. The READ & RUN ME gave you a link explaining How to Deal with Startups. It is up to you to figure out what you need and don't need.

Delete the files/folders that you see left over.

You're welcome. Since your logs are clean, I'm going to give you final cleanup instructions, but I'm not going to have you toggle system restore yet. This is just to keep restore points around in case you still feel you have problems that you did not have in the past. You could try a System Restore to that point in time.



If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /u
     • Notes: The space between the combofix" and the /u, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
5. Go to add/remove programs and uninstall HijackThis.
6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
7. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!