Believe infected with various trojans- .agent, .vundo.h, backdoor.generic10.ACET

I started having problems after I was searching for a free e-book a few weeks ago. I downloaded one that seemed fairly reputable and after that, I began getting many popups appearing, even when I was not browsing the internet.

I am running xp home edition. I have AVG free, Windows Defender, Spybot S&D, Malwarebytes. I have disabled system restore. AVG, mbam, and Spybot S&D have scanned every day for over a week and continually discover new infections. There are many tracking cookies, but the many trojans that come up are what worry me.
Here are some of the infections that have come up in the many logs and scan results I have looked through.
Win32/Heur (in various locations, but mostly in system 32 files), Trojan Horse Dowloader.Agent.AULY, Trojan Horse BackDoor.Generic10.ACET, Virtumonde, Trojan:Win32/Alureon.BI, TrojanSpy:Win32/Festeal.C, Trojan.Agent, Trojan.Vundo.H. Many registry keys have been affected also.

AVG did not actually remove some of the infections, but said: "object is in whitelist." Between the security programs, they removed some threats, but then the next day more of the same or similar threats are again detected. When the computer has been running for a while (a few hours or more), the internet connection does not work (even through the connection is physically there and working), Many applications will not open and they cite some error or say that there is not sufficient information to open it or the files no longer exist. When i restart, all of the above will work again. Windows firewall (which I normally have on) says: "Windows Firewall is turned off. Your network administrator is using Group Policy to control these settings." I am unable to turn it on. In the Task Manager, I constantly have many processes running (55-60 or more, even when I have no programs running). There are many svchost.exe and iexplorer processes running (even when IE is not open). CPU is often at 100%, while no programs are running. I would like to avoid formatting my disk, but am prepared to do so, if necessary.

If there is any other information I can give you that will help, please let me know. Here is the dds log that I ran a little bit ago today.

Thank you,
Rebekah

---------------------
DDS (Ver_09-02-01.01) - NTFSx86
Run by Owner at 12:44:54.67 on Wed 02/25/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.399 [GMT -8:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Micro Innovations\Wireless Keyboard and Laser Mouse\mouse32a.exe
C:\Program Files\Micro Innovations\Wireless Keyboard and Laser Mouse\kbdap32a.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
svchost.exe C:\WINDOWS\TEMP\VRT3.tmp
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uStart Page = hxxp://www.msn.com
mSearch Page = hxxp://www.google.com
mStart Page = hxxp://www.msn.com
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [LogitechSoftwareUpdate] "c:\program files\logitech\video\ManifestEngine.exe" boot
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [VnrPack24] "c:\program files\vnrpack\VnrPack24.exe"
mRun: [BCMSMMSG] BCMSMMSG.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [FLMOFFICE4DMOUSE] c:\program files\micro innovations\wireless keyboard and laser mouse\mouse32a.exe
mRun: [OFFICEKB] c:\program files\micro innovations\wireless keyboard and laser mouse\kbdap32a.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [LVCOMSX] c:\windows\system32\LVCOMSX.EXE
mRun: [LogitechVideoRepair] c:\program files\logitech\video\ISStart.exe
mRun: [LogitechVideoTray] c:\program files\logitech\video\LogiTray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
dRun: [msnmsgr] "c:\program files\msn messenger\msnmsgr.exe" /background
dRun: [reader_s] c:\windows\system32\config\systemprofile\reader_s.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\desktop messenger\8876480\program\LDMConf.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxps://activatemydsl.verizon.net/sdcCommon/download/DSL/tgctlcm.cab
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www.costcophotocenter.com/CostcoActivia.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://by115fd.bay115.hotmail.msn.com/resources/MsnPUpld.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1161324923015
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} - hxxp://sonecam1.mine.nu/bl_camera.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://sagesoftwareevents.webex.com/client/T25L/webex/ieatgpc.cab
DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} - hxxp://by115fd.bay115.hotmail.msn.com/activex/HMAtchmt.ocx
DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/ractrl.cab?lmi=100
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
LSA: Authentication Packages = msv1_0 c:\windows\system32\qoMfdCsQ

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\kr4a8wsg.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-2-5 325128]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-2-5 27656]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-2-5 107272]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-2-5 903960]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-2-5 298264]
R2 MSSQL$ACT7;SQL Server (ACT7);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2008-11-24 29263712]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
S0 anqinapk;anqinapk;c:\windows\system32\drivers\rpnzeaxn.sys --> c:\windows\system32\drivers\rpnzeaxn.sys [?]
S0 vogxvvlw;vogxvvlw;c:\windows\system32\drivers\htdprbkj.sys --> c:\windows\system32\drivers\htdprbkj.sys [?]
SUnknown euroaova;euroaova; [x]
UnknownUnknown restore;restore; [x]

=============== Created Last 30 ================

2009-02-25 12:10 578,560 a------- c:\windows\system32\agxvr
2009-02-25 12:09 105,984 a------- c:\windows\system32\7.tmp
2009-02-25 12:09 1 a------- c:\windows\system32\5.tmp
2009-02-25 12:09 0 a------- c:\windows\system32\6.tmp
2009-02-25 12:09 124 a------- c:\windows\system32\4.tmp
2009-02-25 08:02 244 a---h--- C:\sqmnoopt02.sqm
2009-02-25 08:02 232 a---h--- C:\sqmdata02.sqm
2009-02-25 07:59 244 a---h--- C:\sqmnoopt01.sqm
2009-02-25 07:59 232 a---h--- C:\sqmdata01.sqm
2009-02-25 07:54 244 a---h--- C:\sqmnoopt00.sqm
2009-02-25 07:54 232 a---h--- C:\sqmdata00.sqm
2009-02-25 07:51 105,984 a------- c:\windows\system32\azton.mt
2009-02-24 23:30 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-02-24 23:22 1,089,593 -c------ c:\windows\system32\dllcache\ntprint.cat
2009-02-24 06:41 401,720 a------- c:\program files\HiJackThis.exe
2009-02-23 21:47 262,144 a------- c:\windows\system32\nvtpm32.dll
2009-02-23 19:54 578,560 a------- c:\windows\system32\fmjwwf
2009-02-23 12:47 0 a------- c:\windows\mqcd.dbt
2009-02-23 12:46 32,768 a------- c:\windows\system32\odjan.wa
2009-02-23 12:46 28,672 a------- c:\windows\system32\kdoqmn.sr
2009-02-23 12:46 32,768 a------- c:\windows\system32\kei1w.an
2009-02-23 12:46 28,672 a------- c:\windows\system32\doqkm.zt
2009-02-23 12:46 77,312 a------- c:\windows\system32\rkoq.pxf
2009-02-23 12:43 578,560 ac------ c:\windows\system32\dllcache\user32.dll
2009-02-21 18:41 0 a------- c:\windows\system32\21.tmp
2009-02-21 18:41 168 a------- c:\windows\system32\15.tmp
2009-02-21 15:10 0 a------- c:\windows\system32\22.tmp
2009-02-21 15:10 168 a------- c:\windows\system32\1E.tmp
2009-02-21 14:24 0 a------- c:\windows\system32\1C.tmp
2009-02-21 14:24 0 a------- c:\windows\system32\19.tmp
2009-02-21 14:24 168 a------- c:\windows\system32\18.tmp
2009-02-21 14:09 0 a------- c:\windows\system32\11.tmp
2009-02-20 21:03 0 a------- c:\windows\system32\47.tmp
2009-02-20 19:58 0 a------- c:\windows\system32\45.tmp
2009-02-20 19:50 2,560 a------- c:\windows\system32\42.tmp
2009-02-20 19:50 0 a------- c:\windows\system32\3F.tmp
2009-02-20 19:49 208 a------- c:\windows\system32\3E.tmp
2009-02-20 18:50 2,560 a------- c:\windows\system32\32.tmp
2009-02-20 18:49 208 a------- c:\windows\system32\2D.tmp
2009-02-20 17:23 182,656 ac------ c:\windows\system32\dllcache\ndis.sys
2009-02-20 15:17 0 a------- c:\windows\system32\13.tmp
2009-02-20 09:53 0 ac------ c:\windows\system32\dllcache\chgport.exe.D0F5A1465EE6A8E8
2009-02-20 09:53 0 ac------ c:\windows\system32\dllcache\chkdsk.exe.9A4EEFEC4AB1F13F
2009-02-19 21:55 0 a------- c:\windows\system32\E2.tmp
2009-02-19 21:55 208 a------- c:\windows\system32\DB.tmp
2009-02-19 21:14 <DIR> --d----- c:\windows\ShellNew
2009-02-19 18:52 0 a------- c:\windows\system32\A2.tmp
2009-02-18 21:47 0 a------- c:\windows\system32\3A.tmp
2009-02-18 21:47 168 a------- c:\windows\system32\34.tmp
2009-02-18 17:28 0 a------- c:\windows\system32\12.tmp
2009-02-18 13:37 0 a------- c:\windows\system32\2E.tmp
2009-02-18 13:36 168 a------- c:\windows\system32\28.tmp
2009-02-17 17:49 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-17 17:44 <DIR> --d----- c:\docume~1\owner\applic~1\Malwarebytes
2009-02-17 17:43 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-02-17 17:43 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-17 17:43 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-02-17 17:43 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-02-16 19:50 <DIR> --d----- c:\docume~1\owner\applic~1\Twain
2009-02-16 19:45 <DIR> --d----- c:\program files\WebShow
2009-02-16 12:18 351 a------- c:\windows\xccwinsys.ini
2009-02-16 12:18 <DIR> --d----- c:\windows\system32\inf
2009-02-09 20:35 <DIR> --d----- c:\program files\Scholastic's Clifford
2009-02-05 15:43 <DIR> --d-h--- C:\$AVG8.VAULT$
2009-02-05 10:38 107,272 a------- c:\windows\system32\drivers\avgtdix.sys
2009-02-05 10:38 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-02-05 10:38 325,128 a------- c:\windows\system32\drivers\avgldx86.sys
2009-02-05 10:38 <DIR> --d----- c:\windows\system32\drivers\Avg
2009-02-05 09:56 <DIR> --d----- c:\program files\Unlocker
2009-02-05 09:29 <DIR> --d----- C:\tot
2009-01-29 19:04 <DIR> --d----- c:\program files\Windows Live Safety CenterRebootActions
2009-01-29 11:11 2,204 a------- c:\windows\vogxvvlw
2009-01-29 11:11 405,637 a--sh--- c:\windows\system32\PpWvCJjl.ini

==================== Find3M ====================

2009-02-25 07:51 578,560 a------- c:\windows\system32\user32.DLL
2009-02-24 06:43 10,767 a------- c:\program files\hijackthis.log
2009-02-20 17:23 182,656 a------- c:\windows\system32\drivers\ndis.sys
2009-02-20 10:03 122,880 a------- c:\windows\BCMSMMSG.exe
2009-02-20 09:52 126,976 a------- c:\windows\system32\hkcmd.exe
2009-02-20 09:51 221,184 a------- c:\windows\system32\LVCOMSX.EXE
2009-02-19 21:17 5,058 a------- c:\windows\help\hhcolreg.dat
2009-02-16 20:30 1,796 a------- c:\windows\mozver.dat
2009-01-19 10:57 5,598,390 a------- c:\windows\java\packages\MXBH77B9.ZIP
2009-01-19 10:57 4,254,721 a------- c:\windows\java\packages\W5R1R797.ZIP
2008-12-20 15:15 826,368 a------- c:\windows\system32\wininet.dll
2008-10-06 12:40 848 a--sh--- c:\docume~1\alluse~1\applic~1\KGyGaAvL.sys
2008-10-06 12:40 88 ---shr-- c:\docume~1\alluse~1\applic~1\63242E44AA.sys
2008-09-03 21:34 284 a------- c:\docume~1\owner\applic~1\ViewerApp.dat
2008-08-29 19:39 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008082920080830\index.dat

============= FINISH: 12:45:43.34 ===============

Hello


Your system is infected with a polymorphic file infector called Virut. Virut is capable of infecting all the machine's executable files (.exe) and screensaver files (.scr). However, the problem is that the virus has a number of bugs in its code, and as a result, it may misinfect a proportion of executable files and therefore, the files are corrupted beyond repair. As of now, security experts suggest that a format and clean install, or destructive recovery if you have an OEM recovery partition, is the best way to clean the infection and it is the best and safest way to return the machine to its normal working state.

Backup all your documents and important items (personal data, work documents, etc) only. DO NOT backup any executable files (softwares) and screensavers (*.scr). It attempts to infect any accessed .exe or .scr files by appending itself to the executable.

Also, avoid backing up compressed files (zip/cab/rar) files that have .exe or .scr files inside them. Virut can penetrate and infect .exe files inside compressed files too.

Recent variants also modify htm, html, asp and php files.

Do not back up to another machine, as it may become compromised. Burn to DVD/CD, or to an external drive which has nothing else on it, and which you can format should it happen to become infected from the backups.

See miekiemoes' blog for similar comments here:

http://miekiemoes.blogspot.com/2009/02/vir...s-throwing.html

Ok. Formatting the drive it will be. Thanks very much for the quick reply. I appreciate your expertise!

Rebekah

You are welcome and sorry I could not be more help.