Bandok_ J Trojan

If someone could help me is getting rid of this trojan. I have run all the programs that are required before posting with no luck. Panda active scan finds it but cannot remove it. It places the file "Ali.exe" in the windows system32 file. If I delete it in the registry or startup file it just reproduces itself. I first noticed it when my Norton antivirus kept saying it was scanning messages (like when I send email) every couple minutes. I closed all internet traffic with my Norton Firewall and that stopped it. Webroot Spy Sweeper finds it in the startup folder and when I have it remove it, it comes back in a few seconds. Help!

 

I forgot to atatatch the logs.I've went thru all the steps outlined. The bitdefender was saved as a .txt file 5 different times, but it looks like html to me. The attatched Panda active scan had to be taken in normal mode because in safe mode the screen resolution wouldn't let me see all of the page. I did a google search for this trojan and came up with a couple links. They are
http://www.sophos.com/virusinfo/analyses/trojbandokj.html
http://www.auditmypc.com/process/ali.asp
I really would like to get this fixed as the alternative is to reload windows.
Thanks

 

I ran HJT and fixed the 3 items you had me fix. The bupl.dll would not delete. I got an access denied. It is not writh protected so i ran task manager with the following
taskmgr.exe
Iexplore.exe
explorer.exe
svchost.exe
scchost.exe
svchost.exe
Isass.exe
services.exe
winlogon.exe
csrss.exe
system
system idel processes

Everytime I ended Iexplore.exe, it started itself up again. I didn't know what program to end to be able to delete the bupl.dll file, so it's still there. Every time I deleted the system32\ ali.exe file, it replaced itself, so I couldn't delete it. I was able to delete all the files in the Prefetch file. After I was done and returned to normal mode, I ran HJT again jus to check. Both ali.exe files were back but the 020 file was gone.
Something is restoring those files.

 

Thanks Chaslang. That seemed to keep it from starting up. On the first reboot, I got the message "windows cannot find C: Windows\system32\ali.exe" bla, bla, bla. I then rebooted again and that message didn't come up this time. I still find the ali.exe checked in the system configeration utility startup. Should I get rid of it there too? Also there is at least some remanents of bandook/ali.exe still in the registry. Can I safely remove those? Before when I removed them from the registry, they just came right back. There doesn't seem to be any reference to ali.exe in the new HJT log. How can I get rid of all the pieces left behind? Do I need to get rid of the line O4 - HKCU\..\Run: [Bandook] C:\WINDOWS\system32\ali.exe in HJT?
On another note, ever since I ran the first 1-6 required steps, when I open a web page up, it is very small. A lot smaller than before all this repair started. Is there some thing I have to change to get the pages to be like before?

 

HJT was able to remove them this time. I also went into the registry and removed the last 3 remenants of bandook/ ali.exe. Thanks so much. You have saved me the time consuming task of reloading Windows.