[HOH_Virus]

[b]OTS Would stop working but I got it to complete after the third try. The only notepad I noticed was after the reboot the information in it is below.

Ive noticed a big improvement and stablization of the system now the only things that are not running properly is Malwarebytes will not open at all and sometimes when shutting off or restarting the computer gets stuck on the logging off or shutting down screen other than that things seem to going alot better, more programs are starting to run properly and the wifi is back to normal.

All Processes Killed
[Registry - All]
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\opmlllsys not found.
DllUnregisterServer procedure not found in c:\users\matt\appdata\local\temp\ssrrro.DLL
c:\users\matt\appdata\local\temp\ssrrro.DLL moved successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\tuturpsys deleted successfully.
File c:\users\matt\appdata\local\temp\ssrrro.DLL not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\avgrssta.dll not found.
[Files/Folders - Modified Within 30 Days]
C:\Users\Matt\AppData\Local\Temp\DIO1373.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\DIO143D.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\DIO198B.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\DIO1B8D.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\DIO257C.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\DIO3101.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\DIO3390.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\DIO4137.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\DIO4625.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\DIO4B44.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\DIO52B4.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\DIO57E.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\DIO5F41.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\DIO6E30.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\DIOA1ED.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\DIOABB.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\DIOE3DA.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\DIOF097.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\e4jED16.tmp_dir8111\exe4jlib.jar deleted successfully.
C:\Users\Matt\AppData\Local\Temp\e4jED16.tmp_dir8111\i4jdel.exe deleted successfully.
C:\Users\Matt\AppData\Local\Temp\e4jED16.tmp_dir8111 folder deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MAR2CD.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MAR36A.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MAR39D4.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MAR3A33.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MAR58B.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MAR638.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MAR9EFC.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MARA0E1.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MARB01C.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MARB73E.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MARB96F.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MARB99E.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MARDE8B.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MARDEBB.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MARE3F7.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MARE456.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MARED2B.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MARED6A.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MAREFAB.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MAREFEA.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MARF93C.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\MARF9D9.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\AFK.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\ARA.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\BGR.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\BIH.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\CHS.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\CHT.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\CSY.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\DAN.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\DEU.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\ELL.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\ENU.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\ESN.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\FIN.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\FRA.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\HEB.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\HRV.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\HUN.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\ITA.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\JPN.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\KAT.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\KOR.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\LTH.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\LVI.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\NLB.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\NOR.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\PLK.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\PTB.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\ROM.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\RUS.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\SKY.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\SLV.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\SRL.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\SVE.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\TRK.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang\UKR.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\Lang folder deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\dtsetup.ini deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\HomePage.ini deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\InstallOptions.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\ioSpecial.ini deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\modern-header.bmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\modern-wizard.bmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\RegPageType.ini deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\setuphlp.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\SPTDinst-x64.exe deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\SPTDinst-x86.exe deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\StartPage.bmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\System.dll deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp\WaitPage.ini deleted successfully.
C:\Users\Matt\AppData\Local\Temp\nsx2405.tmp folder deleted successfully.
C:\Users\Matt\AppData\Local\Temp\PCW515A.tmp deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DF09E82C67E4B73AA6.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DF173CBBBE8AEEACE3.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DF193A0C775CDCFF80.TMP deleted successfully.
File delete failed. C:\Users\Matt\AppData\Local\Temp\~DF3446AE5A14AA03E9.TMP scheduled to be deleted on reboot.
C:\Users\Matt\AppData\Local\Temp\~DF36FA9331FA7E34BA.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DF58F624C9D1E3A6F2.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DF5AE4A37D2874F144.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DF64184AF653473653.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DF6E670C84E3D99887.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DF727B1C5373B75661.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DF758C010740443FBE.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DF7B3153C785ED4077.TMP deleted successfully.
File delete failed. C:\Users\Matt\AppData\Local\Temp\~DF7C1D9F3B4DFE8D09.TMP scheduled to be deleted on reboot.
C:\Users\Matt\AppData\Local\Temp\~DF7DD7DEAC779B38C0.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DF90513E5EF8B4124B.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DF9549850F21B38DFC.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DF9CB392EA8AE7D705.TMP deleted successfully.
File delete failed. C:\Users\Matt\AppData\Local\Temp\~DFB1F3FB878D8B161F.TMP scheduled to be deleted on reboot.
C:\Users\Matt\AppData\Local\Temp\~DFB7D34C8E0DBBFB84.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DFBC52360F203A0DD0.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DFBE08279E9A85A6CF.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DFC5F7740467ACEBB0.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DFCE4F0D3821C3B788.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DFD81FCB69D237C6FE.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DFDB7BE1154D98177F.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DFDE08D73D504A5B00.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DFE51A6C7D566E5396.TMP deleted successfully.
C:\Users\Matt\AppData\Local\Temp\~DFEA68D1B3DD9C5C21.TMP deleted successfully.
File delete failed. C:\Users\Matt\AppData\Local\Temp\~DFEBE1942BC8266201.TMP scheduled to be deleted on reboot.
C:\Users\Matt\AppData\Local\Temp\~DFF9EF9D2B5E55187E.TMP deleted successfully.
File delete failed. C:\Users\Matt\AppData\Local\Temp\~DF3446AE5A14AA03E9.TMP scheduled to be deleted on reboot.
File delete failed. C:\Users\Matt\AppData\Local\Temp\~DF7C1D9F3B4DFE8D09.TMP scheduled to be deleted on reboot.
C:\Users\Matt\AppData\Local\Temp\~DF9549850F21B38DFC.TMP deleted successfully.
File delete failed. C:\Users\Matt\AppData\Local\Temp\~DFB1F3FB878D8B161F.TMP scheduled to be deleted on reboot.
C:\Users\Matt\AppData\Local\Temp\~DFE51A6C7D566E5396.TMP deleted successfully.
File delete failed. C:\Users\Matt\AppData\Local\Temp\~DFEBE1942BC8266201.TMP scheduled to be deleted on reboot.
C:\ProgramData\SPL8F24.tmp deleted successfully.
C:\ProgramData\SPLFD03.tmp deleted successfully.
[Empty Temp Folders]


User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Matt
->Temp folder emptied: 9876706 bytes
->Temporary Internet Files folder emptied: 38602789 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 24576 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 12018167 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33237 bytes
RecycleBin emptied: 101106812 bytes

Total Files Cleaned = 154.00 mb

< End of fix log >
OTS by OldTimer - Version 3.1.22.0 fix logfile created on 02212010_213423

Files\Folders moved on Reboot...
File\Folder C:\Users\Matt\AppData\Local\Temp\~DF3446AE5A14AA03E9.TMP not found!
File\Folder C:\Users\Matt\AppData\Local\Temp\~DF7C1D9F3B4DFE8D09.TMP not found!
File\Folder C:\Users\Matt\AppData\Local\Temp\~DFB1F3FB878D8B161F.TMP not found!
File\Folder C:\Users\Matt\AppData\Local\Temp\~DFEBE1942BC8266201.TMP not found!
C:\Users\Matt\AppData\Local\Temp\ehmsas.txt moved successfully.
C:\Users\Matt\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Matt\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\RDVBA2GO\Programs-will-not-open-not-respond-t269054[2].htm moved successfully.
C:\Users\Matt\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DM953G49\iframe[1].htm moved successfully.
C:\Users\Matt\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
C:\Users\Matt\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.

Registry entries deleted on Reboot...

[Advertisements]

So far so good. Lets see what the OTS log brings.

[JSntgRvr]

So far so good. Lets see what the OTS log brings.

[HOH_Virus]

OTS Scan results

Attached Files

•  OTS.Txt   357.36KB   270 downloads

[JSntgRvr]

Set Explorer to view Hidden Files and Folders:

• Right-click your Start button and go to "Explore".
• Select Organize from the menu
• Select Folder and Search Options
• Select the View tab
• Click on Show all Files and Folders
• Remove the checkmark from Hide extensions for known file types
• Remove the checkmark from Hide protected operating System files
• Select Apply to All Folders | Yes | Apply | OK.

Navigate to this file:

• c:\users\matt\appdata\local\temp\ssrrro.DLL

If present, right click on it and select Properties. Remove the check mark by Hidden and click OK. Right click on it again and select Delete. Let me know if an error message is received. If able to delete, restart the computer and attach a fresh OTS log.

Set Explorer to Defaults:

• Right-click your Start button and go to "Explore".
• Select Organize from the menu
• Select Folder and Search Options
• Select the View tab
• Click on Restore Defaults
• Select Apply to All Folders | Yes | Apply | OK.

[HOH_Virus]

Here is the error msg I get whenever I try to delete the file.

Attached Thumbnails

• 

[JSntgRvr]

I am going to review these finding with the file uploaded and detected as Trojan.Win32.Pincav.qoz I will get back to you as soon as I have a response.

Meanwhile, please run a scan with Malwarebytes'Antimalware.


Launch and update Malwarebytes' Anti-Malware.

• If unable to update, download and run the rules file from here.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.

[HOH_Virus]

I still cannot run malwarebytes, I have uninstalled and reinstalled numerous times the program will not open.
I have tried to run superantispyware as well and as soon as I hit the scan button the programs quits responding.

[JSntgRvr]

I am going to kill (turn Off) ezprint.exe, and will try to remove that file afterward.

Start OTS. Copy/Paste the information in the Quotebox below into the pane where it says "Paste fix here" and then click the Run Fix button.

[Kill All Processes]
[Unregister Dlls]
[Processes - Safe List]
YN -> ezprint.exe -> C:\Program Files (x86)\Lexmark S300-S400 Series\ezprint.exe
[Registry - All]
< 64bit-Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "EzPrint" -> C:\Program Files (x86)\Lexmark S300-S400 Series\ezprint.exe ["C:\Program Files (x86)\Lexmark S300-S400 Series\ezprint.exe"]
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YY -> "pmligesys" -> c:\users\matt\appdata\local\temp\ssrrro.DLL [rundll32.exe "c:\users\matt\appdata\local\temp\ssrrro.dll",DllRegisterServer]
< Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YY -> "mlkliisys" -> c:\users\matt\appdata\local\temp\ssrrro.DLL [rundll32.exe "c:\users\matt\appdata\local\temp\ssrrro.dll",DllRegisterServer]
[Custom Items]
:files
c:\users\matt\appdata\local\temp\ssrrro.DLL
:end
[Start Explorer]
[Reboot]

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. CLick the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a fresh OTS scan log[/b].

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

Attempt to run Malwarebytes after the fix.

Edited by JSntgRvr, 22 February 2010 - 11:16 PM.

[HOH_Virus]

After several attempts I finally got the fix to run in OTS. Everytime I tried it would run then as soon as the pop up window came up telling me to restart OTS would stop responding. When I finally got it to run all the way through no log file was left after the fix. I am about to run an OTS scan and as soon as it is done I will attach the file.

Thanks for all the help!!! Its greatly appreciated by the way.

[HOH_Virus]

To my luck OTS Stops reponding when I try to run a scan now but I did run a scan earlier after running the fix you gave me here is that file.

Attached Files

•  OTS.Txt   351.32KB   274 downloads

[JSntgRvr]

ezprint.exe is no longer running. But the file still present. Attempt to manually delete this file as indicated on post 34 to see what is its excuse now.

[HOH_Virus]

I went to the file and try to delete it but got the message from the SS below. I navicated back to the file and it was no longer there though.

Attached Thumbnails

• 

[JSntgRvr]

I went to the file and try to delete it but got the message from the SS below. I navicated back to the file and it was no longer there though.

It is not the ezprint.exe file but the c:\users\matt\appdata\local\temp\ssrrro.DLL the one to be deleted.

[HOH_Virus]

it says it cannot be deleted because it is open in printer device monitor.

[JSntgRvr]

Physically disconnect your printer from the computer, then remove the following programs:

Lexmark Tools for Office
Lexmark S300-S400 Series

Restart the computer.

Set Explorer to view hidden files and attempt once again to remove the following file:

c:\users\matt\appdata\local\temp\ssrrro.DLL

If successful, attempt to run Malwarebytes.