Hello. I have found several problems, and have read several forums on here to help correct these problems. Some have worked, but still problems remain.

Let's start at the beginning. My sister gave me her computer with Windows XP. It is a disaster. I could not access the internet, I was receiving popups, and some programs wouldn't open. The worse part was the the C: and My Documents folders were filled with thousands (literally) of .tmp files (named something like 'pn532.tmp'). These could not be deleted.

I ran Malwarebytes' Anti-Malware and it found: trojan.vundo, trojan.agent, rootkit.agent, Malware.Trace, Backdoor.Bot, Rogue.Link, and Hijack.UserInit. In Safe Mode, I ran Vundofix.exe, and it says that it removed every file except C:\Windows\System32\tuvutqo.dll. Upon restart, this file still can't be deleted. After this, I was able to delete all those .tmp files (my recycle bin had 33,000 of these files!!) Now I am stumped.

I ran Malwarebytes' Anti-Malware again, and it finds:
Trojan.Vundo - 13 entries
Trojan.Agent - 2 entries
Malware.Trace - 2 entries

I ran Spybot, and it finds:
Smitfraud-C
Virtumonde.dll
Virtumonde.generic
Virtumonde.prx
Win32.Agent.pz
Win32.Small.azl

I ran VirtumundoBeGone, and it says there are no infections detected.

I have the logs from Malwarebytes' Anti-Malware and VirtumundoBeGone, if that helps.

Windows Automatic Updates and Firewall keep turning off, even if I turn them back on.

So no matter what I do to try and delete these infections, it seems as if nothing is happening. The computer is functioning relatively normal now, and I haven't many problems with accessing the internet, or popups. BUT I still have all those infections. Can you help?

The latest error message I received is "The application or DLL C:\Windows\system32\xpowgwbe.dll is not a valid Windows image. Please check this against your installation diskette."

Copy/paste the contents of the MBAM scan results in your next reply.

Here is my mbam log:

Malwarebytes' Anti-Malware 1.20
Database version: 932
Windows 5.1.2600 Service Pack 2

1:02:56 AM 7/10/2008
mbam-log-7-10-2008 (01-02-56).txt

Scan type: Quick Scan
Objects scanned: 41489
Time elapsed: 11 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 6
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bc218790 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb7863 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd8185 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga7741 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc9920 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bmbf12b40c (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\SYSTEM32\elkeknnp.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\SYSTEM32\pnnkekle.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\ljhfe.dll_old (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\SYSTEM32\efhjl.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\efhjl.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\xpowgwbe.dll (Trojan.Agent) -> Delete on reboot.

Did you reboot the computer after using MBAM? If it encounters a file that is difficult to remove, you need to restart the computer so the malware can be fully removed. Failure to do so will prevent MBAM from removing all the malware. Your log indicates some files will be deleted on reboot. If you have not rebooted, make sure you do this. When done, rescan again with MBAM, click the Logs tab and copy/paste the contents of the new report in your next reply.

Also, let me know how your is computer running and if there are any more signs of infection.

I rebooted my computer after each scan. It says that these files have been deleted, but when I run the scan again, the same files still show up. That is the part that is confusing me. While I have not received any more error messages, I was browsing the internet yesterday and began to receive several popups.

I will be out of town until Monday. I will receive your next post then. Thanks.

Some infections can be difficult to remove because of their morphing characteristics and ability to regenerate itself. This will require further investigation and probably the use of more powerful tools than we recommend in this forum. Before that can be done you will need you to create and post a hijackthis log.

Please read the pinned topic titled "Preparation Guide For Use Before Posting A Hijackthis Log" and complete all the steps. There are instructions for downloading and running Deckard's System Scanner (DSS) which will create a hijackthis log for you, or automatically download and install the most current version of HijackThis if it's not already installed on your computer.

When you have done that, post your log in the HijackThis Logs and Malware Removal forum, NOT here, for assistance by the HJT Team Experts. A member of the Team will walk you through, step by step, on how to clean your computer. If you post your log back in this thread, the response from the HJT Team will be delayed because your post will have to be moved. This means it will fall in line behind any others posted that same day.

Start a new topic, give it a relevant title and post your log along with a brief description of your problem, a summary of any anti-malware tools you have used and a summary of any steps that you have performed on your own. An expert will analyze your log and reply with instructions advising you what to fix. After doing this, we would appreciate if you post a link to your log back here so we know that your getting help from the HJT Team.

Please be patient. It may take a while to get a response because the HJT Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT "bump" your post or make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

I have followed your directions, posted a new topic, and am waiting for a reply. Thanks for you help!

Your hijackthis log is posted here.

Now that your log is posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a HJT Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the member assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the HJT Team should be the only members that you take advice from, until they have verified your log as clean.

If after 5 days you still have received no response, then post a link to your HJT log in the thread titled "Haven't Had A Reply In Five Days?".

To avoid confusion, I am closing this topic until you are cleared by the HJT Team. If you still need assistance after your log has been reviewed and you have been cleared, please PM me or another moderator and we will re-open this topic.

Thanks for your cooperation and good luck with your log.