It's a leftover trojan. Let's remove it now.
The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. Download
CleanUp! (
Alternate Link if main link don't work) and install it. Do not run it yet.
Before doing anything, MAKE SURE that you can keep your computer on (at least until we get it fixed). This infection requires us to detect and remove it without rebooting or restarting your computer (unless the instructions say so). If you can't keep your computer on today, then I suggest that you don't get the logs yet until you are ready. With that said (when ready):
Open up HijackThis and go to Config->Misc Tools and check the first two boxes there. Now click on the
Generate StartupList log button. Post that log in your next post.
Right click on
this link and choose Save As...Save it to your Desktop. Make sure you have disabled any programs that may block/disable scripts (ex: Ad-Watch, TeaTimer, Norton, etc.). Double click on
Silent Runners to run it. This will take a few minutes. It will create a file called
Startup Programs followed by your computer name and current date. Open up that file and post all the contents here in your next post.
Download
Find-qoologic. Unzip the files to your Desktop. Open the qoologic folder and run the
qoologic.bat file. Wait a few minutes for it to finish. When the dos window disappears, go to your C: drive and open up the
log.txt file. Copy and paste the whole log in your next post.
Download
DllCompare and run it. Click on the
Locate.com button. Wait a few seconds and then click on the
Compare button. Let it run, then click on
Make a log of what was found. Post that log here. Note: If you are having problems using DllCompare (16 bit error), copy autoexec.nt from the C:\WINDOWS\repair folder to C:\WINDOWS\system32 folder. Now run DllCompare.
Download
Find It and unzip it. Open up the folder and double click on the
find.bat file. Let it run for a while. After it's finished, open up file. Copy and paste the contents to the forums.
Post all of the logs in your next post. We need them all to get a fix for this infection.