Removal of "Exploit Rogue Scanner(type 820)

I am running AVG free with windows XP.
Every time I try and open something it has said that
wltuser.exe infected
skype.exe infected
rundled52.edxded infected.
Each time I do something it adds another file infected.
It also refers to a file name : winsecure2010.com/purchase?r=57.5.
I don't know what this refers to.
How do I fix this?

I am running AVG free with windows XP.
Every time I try and open something it has said that
wltuser.exe infected
skype.exe infected
rundled52.edxded infected.
Each time I do something it adds another file infected.
It also refers to a file name : winsecure2010.com/purchase?r=57.5.
I don't know what this refers to.
How do I fix this?

Hello.

Please download exeHelper from one of the two links.
Link 1
Link 2

• Double-click on exeHelper.com or exeHelper.scr to run the fix.
  
• A black window should pop up, press any key to close once the fix is completed.
  
• Post the contents of log.txt (Will be created in the directory where you ran exeHelper.com)
  

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

Please download the current version of HijackThis from HERE

• Double click and run the installer.
  
• It will install to C:\Program Files\Trend Micro\HijackThis\hijackthis.exe
  
• After installing, you should get the user agreement, press accept and Hijack This will run.
  
• Select Do a system scan and save a log file. This will open a notepad file of everything Hijack This found, copy and paste it back here.
  

Here are the results of the scans:


exeHelper by Raktor
Build 20091122
Run at 17:19:09 on 12/03/09
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

and

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:47:23 PM, on 12/3/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\lxctcoms.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
D:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\dllhost.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Lexmark 5400 Series\lxctmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Lexmark 5400 Series\ezprint.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=20008&gct=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=20008&gct=&gc=1&q=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R3 - URLSearchHook: (no name) - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - (no file)
O1 - Hosts: ::1 localhost
O1 - Hosts: 94.232.248.66 browser-security.microsoft.com
O1 - Hosts: 94.232.248.66 antivirprotection.com
O1 - Hosts: 94.232.248.66 www.antivirprotection.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Gamevance - {0ED403E8-470A-4a8a-85A4-D7688CFE39A3} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [lxctmon.exe] "C:\Program Files\Lexmark 5400 Series\lxctmon.exe"
O4 - HKLM\..\Run: [Lexmark 5400 Series Fax Server] "C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 5400 Series\ezprint.exe"
O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1248577848953
O16 - DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} - https://www.facebook.com/controls/contactx.dll
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = heb.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = heb.com
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxct_device - - C:\WINDOWS\system32\lxctcoms.exe
O23 - Service: PDAgent - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDEngine.exe

--
End of file - 6849 bytes

Thanks

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  R3 - URLSearchHook: (no name) - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - (no file)
  O1 - Hosts: ::1 localhost
  O1 - Hosts: 94.232.248.66 browser-security.microsoft.com
  O1 - Hosts: 94.232.248.66 antivirprotection.com
  O1 - Hosts: 94.232.248.66 www.antivirprotection.com
  O2 - BHO: Gamevance - {0ED403E8-470A-4a8a-85A4-D7688CFE39A3} - (no file)
  
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Here's the MBAM log:

Malwarebytes' Anti-Malware 1.42
Database version: 3292
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

12/4/2009 10:40:49 AM
mbam-log-2009-12-04 (10-40-49).txt

Scan type: Quick Scan
Objects scanned: 114047
Time elapsed: 10 minute(s), 17 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0ed403e8-470a-4a8a-85a4-d7688cfe39a3} (Adware.Gamevance) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f02fabcb-92dd-475a-98af-14217bd50746} (Adware.Gamevance) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{f02fabcb-92dd-475a-98af-14217bd50746} (Adware.Gamevance) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\AvScan (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Donna Million\Local Settings\Temp\578.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Donna Million\Local Settings\Temp\a.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Donna Million\Local Settings\Temp\b.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Donna Million\Local Settings\Temp\c.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

Also, upon auto restarting, in the center of the screen, an ERROR window popped up advising as follows:
Error-IM32FAX.DIL Not Found!

and in the lower right corner of the screen, another window popped up, it has a red shield emblem with a white X in it stating:

"Your computer be at risk
no fire wall turned on
automatic updates turned off
Click this balloon to fix this problem"

Hello.

• Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
  Link 1
  Link 2
  
• Double click DDS.scr to run.
  
• When complete, two logs will open. Save both of the report to your Desktop.
  
• Copy and paste BOTH LOGS back here, use more than one post if needed.
  

Here are the 2 logs you requested:


DDS (Ver_09-12-01.01) - NTFSx86
Run by Donna Million at 17:36:20.73 on Fri 12/04/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.588 [GMT -6:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Lexmark 5400 Series\lxctmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Lexmark 5400 Series\ezprint.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\lxctcoms.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\Program Files\Raxco\PerfectDisk\PDAgent.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\dllhost.exe
D:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Donna Million\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=20008&gct=&gc=1&q=%s
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
TB: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No File
uRun: [ccleaner] "c:\program files\ccleaner\ccleaner.exe" /AUTO
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [ePower_DMC] c:\acer\empowering technology\epower\ePower_DMC.exe
mRun: [lxctmon.exe] "c:\program files\lexmark 5400 series\lxctmon.exe"
mRun: [Lexmark 5400 Series Fax Server] "c:\program files\lexmark 5400 series\fm3032.exe" /s
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [EzPrint] "c:\program files\lexmark 5400 series\ezprint.exe"
mRun: [LXCTCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXCTtime.dll,_RunDLLEntry@16
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_04\bin\npjpi150_04.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1248577848953
DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} - hxxp://www.facebook.com/controls/contactx.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} - hxxp://driveragent.com/files/driveragent.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-1-24 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-1-24 108552]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-1-24 335240]
S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-1-24 908056]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-1-24 297752]
S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;\??\c:\windows\system32\elock2burnerlockdriver.sys --> c:\windows\system32\eLock2BurnerLockDriver.sys [?]
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;\??\c:\windows\system32\elock2fsctldriver.sys --> c:\windows\system32\eLock2FSCTLDriver.sys [?]
S3 vsdatant;vsdatant;\??\c:\windows\system32\vsdatant.sys --> c:\windows\system32\vsdatant.sys [?]

=============== Created Last 30 ================

2009-12-04 16:15:18 0 d-----w- c:\docume~1\donnam~1\applic~1\Malwarebytes
2009-12-04 16:15:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-04 16:15:11 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-12-04 16:15:10 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-04 16:15:10 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-04 15:49:02 0 ----a-w- c:\windows\system32\commonpriv.log.lock
2009-12-03 23:25:39 0 d-----w- c:\program files\Trend Micro
2009-12-03 20:29:53 0 ----a-w- c:\documents and settings\donna million\commonpriv.log.lock
2009-12-03 18:36:05 0 d-----w- c:\windows\system32\wbem\Repository
2009-12-03 18:33:28 0 d-----w- c:\windows\system32\FxsTmp
2009-12-03 18:27:50 0 d-----w- c:\program files\Lexmark 5400 Series
2009-12-03 18:25:41 0 d-----w- c:\windows\system32\drivers\Avg

==================== Find3M ====================

2009-06-26 21:32:35 0 ----a-w- c:\program files\22N0185060014YT.xml
2009-07-26 05:44:50 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009072620090727\index.dat

============= FINISH: 17:36:54.10 ===============

and


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 2/20/2007 2:21:42 PM
System Uptime: 12/4/2009 4:28:02 PM (1 hours ago)

Motherboard: Acer | | Navarro
Processor: AMD Turion(tm) 64 X2 Mobile Technology TL-50 | Socket M2/S1G1 | 798/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 53 GiB total, 40.59 GiB free.
D: is FIXED (NTFS) - 54 GiB total, 53.133 GiB free.
E: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Realtek RTL8139/810x Family Fast Ethernet NIC
Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_009F1025&REV_10\4&FCF0450&0&08A4
Manufacturer: Realtek Semiconductor Corp.
Name: Realtek RTL8139/810x Family Fast Ethernet NIC
PNP Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_009F1025&REV_10\4&FCF0450&0&08A4
Service: RTL8023xp

==== System Restore Points ===================

RP283: 9/8/2009 5:52:39 PM - System Checkpoint
RP284: 9/9/2009 7:48:47 PM - System Checkpoint
RP285: 9/10/2009 8:41:54 PM - System Checkpoint
RP286: 9/11/2009 9:31:11 PM - System Checkpoint
RP287: 9/12/2009 9:43:09 PM - System Checkpoint
RP288: 9/14/2009 1:07:13 AM - System Checkpoint
RP289: 9/15/2009 1:19:13 AM - System Checkpoint
RP290: 9/16/2009 1:43:15 AM - System Checkpoint
RP291: 9/17/2009 3:31:20 AM - System Checkpoint
RP292: 9/18/2009 5:31:15 AM - System Checkpoint
RP293: 9/19/2009 8:07:42 AM - System Checkpoint
RP294: 9/20/2009 8:59:46 AM - System Checkpoint
RP295: 9/21/2009 9:11:47 AM - System Checkpoint
RP296: 9/22/2009 1:01:53 PM - System Checkpoint
RP297: 9/23/2009 2:58:50 PM - System Checkpoint
RP298: 9/24/2009 4:58:41 PM - System Checkpoint
RP299: 9/25/2009 6:58:42 PM - System Checkpoint
RP300: 9/26/2009 8:43:49 PM - System Checkpoint
RP301: 9/27/2009 10:43:46 PM - System Checkpoint
RP302: 9/29/2009 1:16:58 AM - System Checkpoint
RP303: 9/30/2009 11:10:29 AM - System Checkpoint
RP304: 10/1/2009 5:47:59 PM - System Checkpoint
RP305: 10/2/2009 6:22:15 PM - System Checkpoint
RP306: 10/3/2009 8:22:12 PM - System Checkpoint
RP307: 10/4/2009 8:23:12 PM - System Checkpoint
RP308: 10/5/2009 8:55:40 AM - Avg8 Update
RP309: 10/6/2009 8:57:13 AM - Avg8 Update
RP310: 10/7/2009 9:18:26 AM - Avg8 Update
RP311: 10/8/2009 10:35:14 AM - System Checkpoint
RP312: 10/9/2009 11:34:42 AM - System Checkpoint
RP313: 10/10/2009 12:36:06 PM - System Checkpoint
RP314: 10/11/2009 2:22:12 PM - System Checkpoint
RP315: 10/12/2009 5:36:17 PM - System Checkpoint
RP316: 10/13/2009 6:56:35 PM - System Checkpoint
RP317: 10/14/2009 8:15:41 PM - System Checkpoint
RP318: 10/15/2009 11:09:20 PM - System Checkpoint
RP319: 10/17/2009 1:28:27 AM - System Checkpoint
RP320: 10/17/2009 9:14:45 AM - Avg8 Update
RP321: 10/18/2009 10:48:27 AM - System Checkpoint
RP322: 10/19/2009 11:19:06 AM - System Checkpoint
RP323: 10/20/2009 12:28:31 PM - System Checkpoint
RP324: 10/21/2009 8:29:43 AM - Avg8 Update
RP325: 10/22/2009 8:47:26 AM - System Checkpoint
RP326: 10/23/2009 10:28:59 AM - System Checkpoint
RP327: 10/24/2009 11:20:48 AM - System Checkpoint
RP328: 10/25/2009 11:33:36 AM - System Checkpoint
RP329: 10/26/2009 12:49:54 PM - System Checkpoint
RP330: 10/27/2009 2:02:18 PM - System Checkpoint
RP331: 10/28/2009 4:27:45 PM - System Checkpoint
RP332: 10/29/2009 7:00:47 PM - System Checkpoint
RP333: 10/30/2009 7:42:22 PM - System Checkpoint
RP334: 10/31/2009 9:31:02 PM - System Checkpoint
RP335: 11/1/2009 11:31:01 PM - System Checkpoint
RP336: 11/3/2009 1:32:12 AM - System Checkpoint
RP337: 11/3/2009 10:11:51 AM - Avg8 Update
RP338: 11/4/2009 10:15:26 AM - System Checkpoint
RP339: 11/5/2009 10:18:08 AM - System Checkpoint
RP340: 11/6/2009 10:42:38 AM - System Checkpoint
RP341: 11/6/2009 10:48:14 AM - Avg8 Update
RP342: 11/7/2009 12:41:30 PM - System Checkpoint
RP343: 11/8/2009 1:41:31 PM - System Checkpoint
RP344: 11/9/2009 2:40:44 PM - System Checkpoint
RP345: 11/10/2009 3:03:43 PM - System Checkpoint
RP346: 11/11/2009 3:58:11 PM - System Checkpoint
RP347: 11/12/2009 6:03:30 PM - System Checkpoint
RP348: 11/13/2009 9:37:44 PM - System Checkpoint
RP349: 11/15/2009 12:02:23 AM - System Checkpoint
RP350: 11/16/2009 1:06:57 AM - System Checkpoint
RP351: 11/17/2009 2:46:33 AM - System Checkpoint
RP352: 11/18/2009 4:46:33 AM - System Checkpoint
RP353: 11/19/2009 6:46:42 AM - System Checkpoint
RP354: 11/20/2009 8:46:37 AM - System Checkpoint
RP355: 11/21/2009 9:58:37 AM - System Checkpoint
RP356: 11/22/2009 10:08:11 AM - System Checkpoint
RP357: 11/23/2009 10:56:56 AM - System Checkpoint
RP358: 11/24/2009 12:55:50 PM - System Checkpoint
RP359: 11/25/2009 12:56:58 PM - System Checkpoint
RP360: 11/26/2009 8:33:08 AM - Avg8 Update
RP361: 11/27/2009 8:55:55 AM - System Checkpoint
RP362: 11/28/2009 10:07:29 AM - System Checkpoint
RP363: 11/29/2009 12:07:32 PM - System Checkpoint
RP364: 11/30/2009 2:57:55 PM - System Checkpoint
RP365: 12/1/2009 3:28:12 PM - System Checkpoint
RP366: 12/3/2009 9:48:49 AM - Removed AVG Free 8.5
RP367: 12/3/2009 9:52:02 AM - Installed AVG Free 8.5
RP368: 12/3/2009 12:23:59 PM - Restore Operation
RP369: 12/4/2009 2:11:03 PM - System Checkpoint

==== Installed Programs ======================

ABBYY FineReader 6.0 Sprint
Acer Empowering Technology
Acer ePerformance Management
Acer ePower Management
Acer ePresentation Management
Acer eSettings Management
Acer GridVista
Acer OrbiCam
Acer Screensaver
Adobe Flash Player 10 ActiveX
Adobe Reader 7.0
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Display Driver
ATI Parental Control & Encoder
AVG Free 8.5
Broadcom Driver v4.170.25.12_Foxconn Installation Program
Canon Camera Access Library
Canon Camera Support Core Library
Canon Camera Window DC_DV 5 for ZoomBrowser EX
Canon Camera Window DC_DV 6 for ZoomBrowser EX
Canon Camera Window MC 6 for ZoomBrowser EX
Canon G.726 WMP-Decoder
Canon MovieEdit Task for ZoomBrowser EX
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities EOS Utility
Canon Utilities PhotoStitch
Canon Utilities ZoomBrowser EX
CCleaner (remove only)
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 10 (KB903157)
J2SE Runtime Environment 5.0 Update 4
Launch Manager
Lexmark 5400 Series
LightScribe 1.4.74.1
Malwarebytes' Anti-Malware
MetaFrame Presentation Server Client
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB886903)
Microsoft .NET Framework 2.0
Microsoft .NET Framework 3.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Office Visio Viewer 2003 (English)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
MSXML 6.0 Parser (KB927977)
Nero Suite
Nokia Connectivity Adapter Cable DKU-5
NTI Backup NOW! 4
NTI CD & DVD-Maker
Otto
PerfectDisk
PowerDVD
PowerProducer
PowerTerm 7.1
QuickTime
Realtek High Definition Audio Driver
Security Update for Microsoft .NET Framework 2.0 (KB917283)
Security Update for Microsoft .NET Framework 2.0 (KB922770)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
SMSC IrCC V5.1.3600.7
Soft Data Fax Modem with SmartCP
Sonic Encoders
Synaptics Pointing Device Driver
Update for Windows Media Player 10 (KB913800)
Update Rollup 2 for Windows XP Media Center Edition 2005
WebFldrs XP
Windows Communication Foundation
Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (04/28/2006 1.3.1.0)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows Presentation Foundation
Windows Workflow Foundation
Windows XP Media Center Edition 2005 KB925766
Windows XP Service Pack 3
XML Paper Specification Shared Components Pack 1.0

==== Event Viewer Messages From Past Week ========

12/3/2009 9:55:56 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Memory Check Service service to connect.
12/3/2009 9:55:56 AM, error: Service Control Manager [7000] - The eLock2BurnerLockDriver service failed to start due to the following error: The system cannot find the file specified.
12/3/2009 9:34:13 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: bdpredir
12/3/2009 9:34:13 AM, error: Service Control Manager [7023] - The SSHNAS service terminated with the following error: Invalid access to memory location.
12/3/2009 9:34:13 AM, error: Service Control Manager [7000] - The eLock2FSCTLDriver service failed to start due to the following error: The system cannot find the file specified.
12/3/2009 12:43:41 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AvgLdx86 bdpredir
12/3/2009 12:43:41 PM, error: Service Control Manager [7024] - The AVG Free8 WatchDog service terminated with service-specific error 3758161981 (0xE001003D).
12/3/2009 12:43:41 PM, error: Service Control Manager [7001] - The AVG Free8 E-mail Scanner service depends on the AVG Free8 WatchDog service which failed to start because of the following error: The service has returned a service-specific error code.
12/3/2009 12:19:11 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MDM with arguments "" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}
12/3/2009 12:19:07 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
12/3/2009 12:18:07 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AmdK8 bdpredir Fips IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip WS2IFSL
12/3/2009 12:18:07 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
12/3/2009 12:18:07 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
12/3/2009 12:18:07 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
12/3/2009 12:18:07 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
12/3/2009 12:17:31 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
12/1/2009 9:24:39 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Fax service to connect.
12/1/2009 9:24:39 AM, error: Service Control Manager [7000] - The Fax service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

==== End Of File ===========================

Thanks

Hello.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

J2SE Runtime Environment 5.0 Update 4

How is the machine now?

On startup, I'm stll getting a pop-up:

Error-IM32FAX.DIL Not Found!

If the file it not there, how can a re-install?

Please post a new Hijack This log and we'll sort that error.

I think the file is associated with my Lexmark 5400 printer. Should I re-install the program?

Yes.