Help needed please

[deadzone]

Ok well I have some sort of infection on my computer and I have been trying to get rid of it completely for the past like 2 weeks with no success

It all started first off when I got that win antispyware virus i used a combo of vundofix, fixvundo and my spyware doctor to delete it, I got most of it I think but it still comes back if I shut off my spy doctor.

symptoms: first computer really slow, my isp connection is constantly sending bites out at a large amount I get pop-ups once in a while and If I connect to the interent not even loading up a browser and turn off my spyware doctor vundo gets written to my pc.

Ok well anyone who can help me fix this its much appreciated i made a hijack this log at the bottom. I will be able to check this sometime later today hopefully Also please note I am computer illiterate if you could please make your idea's as easy for me as possible, anyways thanks again here is the log file

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:13:02 AM, on 8/1/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\irdvxc.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\hduiksyA.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Documents and Settings\Cody\Application Data\WinTouch\WinTouch.exe
C:\Documents and Settings\Cody\Start Menu\Programs\Startup\services.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.runescape.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
F2 - REG:system.ini: Shell=Explorer.exe
O1 - Hosts: 82.146.56.35 www.abbey.co.uk
O1 - Hosts: 82.146.56.35 abbey.co.uk
O1 - Hosts: 82.146.56.35 bankofscotlandhalifax.co.uk
O1 - Hosts: 82.146.56.35 www.volksbank.de
O1 - Hosts: 82.146.56.35 volksbank.de
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {19D9E1C4-4801-4299-8861-95F2C1BD29AE} - (no file)
O2 - BHO: (no name) - {35614885-A56B-BAE1-1A12-8E8DCA5785C3} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5A1F6C4B-C783-404C-912A-48FD471553BE} - C:\Program Files\Uninstall Information\nirytizul83122.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {9DE4CED6-2169-4F72-B112-259F5DC55FED} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\System32\jirdteeg.dll
O2 - BHO: (no name) - {DCD53738-C4F9-414A-A03C-C7405A4AC844} - C:\WINDOWS\System32\ssqnlkl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [hduiksyA] C:\WINDOWS\hduiksyA.exe
O4 - HKLM\..\Run: [MemoryManager] rundll32.exe "C:\WINDOWS\System32\gvopeqrb.dll",sitypnow
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WinTouch] C:\Documents and Settings\Cody\Application Data\WinTouch\WinTouch.exe
O4 - HKCU\..\Run: [Liwl] "C:\WINDOWS\SMANTE~1\iexplore.exe" -vt yazb
O4 - HKCU\..\Run: [Pwchpjs] "C:\Program Files\Adobe\w?nspool.exe"
O4 - Startup: services.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJ
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://www.battleon.com
O15 - Trusted Zone: http://www.operationunderground.tk
O15 - Trusted Zone: http://www.runescape.com
O15 - Trusted Zone: http://www.sythe.org
O15 - Trusted Zone: http://www.vice.co.nr
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
O16 - DPF: {AA07EBD2-EBDD-4BD6-9F8F-114BD513492C} (NeffyLauncherCtl Class) - http://disteng.nefficient.com/disteng/neffy/NeffyLauncher.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{379F9E34-1DA6-4719-A68B-00D6A9912542}: NameServer = 65.111.222.2 65.111.222.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{379F9E34-1DA6-4719-A68B-00D6A9912542}: NameServer = 65.111.222.2 65.111.222.3
O20 - AppInit_DLLs: "",
O20 - Winlogon Notify: awtqn - C:\WINDOWS\System32\awtqn.dll (file missing)
O20 - Winlogon Notify: ssqnlkl - C:\WINDOWS\SYSTEM32\ssqnlkl.dll
O20 - Winlogon Notify: ssqrs - C:\WINDOWS\System32\ssqrs.dll (file missing)
O23 - Service: Local Service - Unknown owner - C:\WINDOWS\wuaucpl.exe (file missing)
O23 - Service: Network helper Service (MSDisk) - Unknown owner - C:\WINDOWS\System32\irdvxc.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O24 - Desktop Component 0: (no name) - C:\Program Files\Messenger\vimoc.html

[pskelley]

Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.

Sorry to be the bearer of bad news but you are still very, infected and I am concerned for your safety and security because of backdoor trojans, see this:
http://fileinfo.prevx.com/adware/qq237e53211221-IRDV28056500/IRDVXC.EXE.html

If you look at your 01 - Hosts file, the number you see is this:
http://whois.domaintools.com/82.146.56.35 Unless your Bank in in Russia, I would be pulling the plug on this computer and contacting all online accounts to block any actions.

You also still have the Vundo infection and I see other junk.

A Backdoor is a software program that gives an attacker unauthorized access to a machine and the means for remotely controlling the machine without the user's knowledge. A Backdoor compromises system integrity by making changes to the system that allow it to by used by the attacker for malicious purposes unknown to the user.

One or more of the identified infections is a backdoor trojan.
This allows hackers to remotely control your computer, steal critical system information and Download and Execute files
I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.
Though the Trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
http://www.dslreports.com/faq/10451

When Should I Format, How Should I Reinstall
http://www.dslreports.com/faq/10063

Please let us know what you have decided to do in your next post.

Thanks

[deadzone]

ok well i think ill have to re do my computer and it would be best i'd think although the computer is mainly for gaming it would be best.

But how would i go about doing this. and how would i do it if i dont have any install disks for the computer at all, is there a way i can make the computer delete everything but the internet etc. and make it so its like the day i got it without any?

[pskelley]

See if this information helps:

http://spyware-free.us/tutorials/reformat/
http://www.cyberwalker.net/faqs/how-tos/reinstall-faq.html
http://helpdesk.its.uiowa.edu/windows/instructions/reformat.htm

Thanks

[deadzone]

well the problem is that i dont have any disks so if i reformat i got no way to get windows reinstalled or drivers etc.

[pskelley]

Thanks for that feedback, I can not help with that problem. Please give this some thought, then advise me as to what you wish to do.

Thanks

[pskelley]

No response since 8/02/2007. This topic ic closed, if you need it re-opened please send me or a forum staff member a private message (pm) and provide a link to the thread; this applies only to the original topic starter.

Anyone else with similar problems please start a new topic.

Thanks