What is that? Is that for Windows Media Player? OK, we'll hold off on that problem until we get this figured out first. That should be the least of our worries here.
Please give us all these logs also. I think it's hiding again. Make sure not to restart/shutdown your computer either.
The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. Download CleanUp!
http://cleanup.stevengould.org/ (Alternate Link if main link don't work -
http://www.greyknight17.com/spy/Cleanup.exe ) and install it. Do not run it yet.
Before doing anything, MAKE SURE that you can keep your computer on (at least until we get it fixed). This infection requires us to detect and remove it without rebooting or restarting your computer (unless the instructions say so). If you can't keep your computer on today, then I suggest that you don't get the logs yet until you are ready. With that said (when ready):
Open up HijackThis and go to Config->Misc Tools and check the first two boxes there. Now click on the 'Generate StartupList log' button. Post that log in your next post.
Download FindQoologic-Narrator.zip at
http://forums.net-integration.net/in...post&id=134981 and save it to your Desktop. Create a new folder on your desktop (right click and select New->Folder) and call it FindQoologic. Now unzip the file contents of that zip file into that folder. Locate and double-click the Find-Qoologic.bat file to run it. Wait until a text file opens and post that in your next reply.
Download DllCompare
http://www.greyknight17.com/spy/DllCompare.exe and run it. Click on the 'Locate.com' button. Wait a few seconds and then click on the 'Compare' button. Let it run, then click on 'Make a log of what was found'. Post that log here. Note: If you are having problems using DllCompare (16 bit error), copy autoexec.nt from the C:\WINDOWS\repair folder to C:\WINDOWS\system32 folder. Now try running DllCompare.
Download 'Find It NT-2K-XP' at
http://www.greyknight17.com/spy/Find...20NT-2K-XP.zip for Windows NT/2000/XP. For those with Windows 98/ME, get FindIt9xME at
http://www.greyknight17.com/spy/FindIt9xME.zip instead. Once downloaded, unzip it. Open up the folder and double click on the FindNarrator.bat (Windows NT/2K/XP users) or the FindIt9xMe.bat (for Windows 98/ME users) file. Let it run for a while. This will generate a log file. Please post the entire contents of the log file here.
Post all of the logs in your next post. We need all of them to get a fix for this infection.