Winlogon popups

hi, find below my Hijack Log file.
also imy nortan antivirus is disabled cant run it throgh EXE also.
im having popups winlogon every minute.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:46:57, on 03-09-2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\Sachin\AppData\Local\Google\Update\1.3.21.65\GoogleCrashHandler.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\explorer.exe
C:\Program Files\Hitman Pro 3.5\HitmanPro35.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Sachin\Downloads\Scanner.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://axl773a18181285.directorio-w.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://me6h1qa2cu52h62.directorio-w.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://s2s551uzp81k37g.directorio-w.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://0bxvhz7241663x1.directorio-w.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://9j8i1vh5ff9xi1p.directorio-w.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://12klb7he13soi2b.directorio-w.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://284m985x5c5z06a.directorio-w.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://q187794uf1k6mz7.directorio-w.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://9t888zk38u9zv10.directorio-w.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://4646823ud79lx1c.directorio-w.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 173.201.178.105 bn.com.pe
O1 - Hosts: 173.201.178.105 www.bn.com.pe
O1 - Hosts: 190.168.112.213 iniciorapido.info
O1 - Hosts: 166.120.189.240 www.iniciorapido.info
O1 - Hosts: 155.153.90.23 buscalo.in
O1 - Hosts: 157.11.73.143 www.buscalo.in
O1 - Hosts: 52.138.68.88 buscafacil.com
O1 - Hosts: 216.158.145.115 www.buscafacil.com
O1 - Hosts: 205.190.46.154 emsisoft.com
O1 - Hosts: 78.127.101.246 antiy.net
O1 - Hosts: 100.61.42.99 gdata.es
O1 - Hosts: 91.208.182.71 jiangmin.com
O1 - Hosts: 13.136.211.174 nprotect.com
O1 - Hosts: 113.142.123.180 hacksoft.com.pe
O1 - Hosts: 172.33.7.152 anti-virus.by
O1 - Hosts: 161.66.97.191 hauri.net
O1 - Hosts: 58.50.75.1 www.emsisoft.com
O1 - Hosts: 24.103.53.67 www.antivir.es
O1 - Hosts: 26.149.36.187 www.antiy.net
O1 - Hosts: 227.125.243.75 www.quickheal.com
O1 - Hosts: 124.109.221.141 www.comodo.com
O1 - Hosts: 47.83.232.108 www.gdata.es
O1 - Hosts: 107.230.116.12 www.jiangmin.com
O1 - Hosts: 128.164.57.121 www.hacksoft.com.pe
O1 - Hosts: 188.55.130.93 www.anti-virus.by
O1 - Hosts: 15.181.193.38 www.hauri.net
O1 - Hosts: 168.234.171.104 www.emsisoft.com
O1 - Hosts: 238.92.86.224 www.anti-trojan.net
O1 - Hosts: 133.219.149.169 malwarescan.emsisoft.com
O1 - Hosts: 41.171.226.196 forum.emsisoft.com
O1 - Hosts: 30.15.127.235 www.emsisoft.net
O1 - Hosts: 100.61.42.99 www.emsisoft.it
O1 - Hosts: 183.0.106.45 www.emsisoft.de
O1 - Hosts: 91.208.182.71 www.anti-trojan-software.net
O1 - Hosts: 80.241.84.110 mamutu.com
O1 - Hosts: 150.98.254.43 www.emsisoft.es
O1 - Hosts: 45.37.62.176 malwarescan.emsisoft.de
O1 - Hosts: 209.245.138.202 ww.emsisoft.com
O1 - Hosts: 199.22.40.54 www.emsisoft.fr
O1 - Hosts: 13.136.211.174 www.emsisoft.nl
O1 - Hosts: 249.59.184.185 www.emsisoft.org
O1 - Hosts: 63.105.167.49 scan.anti-trojan.net
O1 - Hosts: 146.44.162.250 www.trojaner.info
O1 - Hosts: 113.142.123.180 blitzblank.com
O1 - Hosts: 8.81.119.126 www.emsisoft.at
O1 - Hosts: 172.33.7.152 www.emsisoft.jp
O1 - Hosts: 161.66.97.191 www.mamutu.com
O1 - Hosts: 231.179.79.56 malwarescan.emsisoft.es
O1 - Hosts: 58.50.75.1 www.mamutu.de
O1 - Hosts: 85.39.108.159 www.hackshields.com
O1 - Hosts: 74.72.9.10 www.internationalservicecheck.com
O1 - Hosts: 144.186.248.130 www.irangoals.com
O1 - Hosts: 227.125.243.75 ixomodels.com
O1 - Hosts: 135.77.64.34 www.indielisboa.com
O1 - Hosts: 124.109.221.141 www.latin-mass-society.org
O1 - Hosts: 194.223.204.5 www.arpia.be
O1 - Hosts: 89.94.200.207 www.owen.org
O1 - Hosts: 253.114.20.165 www.prdouglas.co.uk
O1 - Hosts: 242.147.178.16 www.zarya.info
O1 - Hosts: 56.4.160.137 www.willsee.com
O1 - Hosts: 139.131.156.82 halmapr.com
O1 - Hosts: 47.83.232.108 karuna-shechen.org
O1 - Hosts: 37.116.134.148 www.barder.com
O1 - Hosts: 107.230.116.12 www.antivir.es
O1 - Hosts: 190.168.112.213 www.buraka.tv
O1 - Hosts: 166.120.189.240 www.dr-bull.com
O1 - Hosts: 155.153.90.23 www.manchester-offices.co.uk
O1 - Hosts: 157.11.73.143 saverssite.com
O1 - Hosts: 52.138.68.88 canada.karuna-shechen.org
O1 - Hosts: 216.158.145.115 developmentdrums.org
O1 - Hosts: 205.190.46.154 www.imddomains.co.uk
O1 - Hosts: 19.48.29.86 cutlines.org
O1 - Hosts: 102.175.25.32 elblogdemanu.com
O1 - Hosts: 78.127.101.246 ruben.bzin.net
O1 - Hosts: 67.160.3.97 welkam.co.jp
O1 - Hosts: 69.17.173.218 www.cambridge-steiner-school.co.uk
O1 - Hosts: 220.212.237.163 naturesimages.net
O1 - Hosts: 128.164.57.121 www.1stavenuelimousines.co.uk
O1 - Hosts: 118.197.215.229 www.mtr-design.com
O1 - Hosts: 188.55.130.93 dev.depeuter.org
O1 - Hosts: 15.181.193.38 www.emeraldclassic.co.uk
O1 - Hosts: 179.201.14.65 www.peterhearnwaste.co.uk
O1 - Hosts: 168.234.171.104 etrr.co.uk
O1 - Hosts: 238.92.86.224 www.avoncourt.com
O1 - Hosts: 133.219.149.169 sarahmcconnellphotography.net
O1 - Hosts: 41.171.226.196 www.ixomodels.com
O1 - Hosts: 30.15.127.235 natsko.com
O1 - Hosts: 100.61.42.99 www.nottinghampoetryseries.com
O1 - Hosts: 183.0.106.45 www.sheffieldmind.co.uk
O1 - Hosts: 91.208.182.71 ixostore.ixomodels.com
O1 - Hosts: 80.241.84.110 www.flairweddings.co.uk
O1 - Hosts: 150.98.254.43 www.fimasys.com
O1 - Hosts: 45.37.62.176 cohartuk.com
O1 - Hosts: 209.245.138.202 qqjkw.net
O1 - Hosts: 199.22.40.54 vivo-austin.com
O1 - Hosts: 13.136.211.174 www.freeality.com
O1 - Hosts: 96.6.18.119 bestofewan.com
O1 - Hosts: 4.26.95.78 www.handwritingforkids.com
O1 - Hosts: 249.59.184.185 cowsmo.com
O1 - Hosts: 63.105.167.49 www.2xlgames.com
O1 - Hosts: 146.44.162.250 kimzimmer.net
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [3405D2E49484341435] C:\Users\Sachin\E69686361635\winlogon.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DATBE50.tmp.exe] C:\Users\Sachin\AppData\Local\Temp\DATBE50.tmp.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Sachin\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [googletalk] C:\Users\Sachin\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [3405D2E49484341435] C:\Users\Sachin\E69686361635\winlogon.exe
O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Users\Sachin\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" -inv:bootrun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{742F97D8-AC37-42CF-82DD-09351403D8D4}: NameServer = 202.56.250.5,125.47.22.125
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NitroPDFDriverCreatorReadSpool (NitroDriverReadSpool) - Nitro PDF Software - C:\Program Files\Nitro PDF\Professional\NitroPDFDriverService.exe
O23 - Service: NLS Service (nlsX86cc) - Nalpeiron Ltd. - C:\Windows\system32\NLSSRV32.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

–
End of file - 12665 bytes

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post

• Download aswMBR.exe ( 511KB ) to your desktop.
• Double click the aswMBR.exe to run it
• Click the Scan button to start scan
• On completion of the scan click Save Log, save it to your Desktop and post in your next reply

• Download OTL to your desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• Check the boxes beside LOP Check and Purity Check.
• Under Custom Scan paste this in
  
  netsvcs
  drivers32
  %SYSTEMDRIVE%\*.*
  %systemroot%\Fonts\*.com
  %systemroot%\Fonts\*.dll
  %systemroot%\Fonts\*.ini
  %systemroot%\Fonts\*.ini2
  %systemroot%\Fonts\*.exe
  %systemroot%\system32\spool\prtprocs\w32x86\*.*
  %systemroot%\REPAIR\*.bak1
  %systemroot%\REPAIR\*.ini
  %systemroot%\system32\*.jpg
  %systemroot%\*.jpg
  %systemroot%\*.png
  %systemroot%\*.scr
  %systemroot%\*._sy
  %APPDATA%\Adobe\Update\*.*
  %ALLUSERSPROFILE%\Favorites\*.*
  %APPDATA%\Microsoft\*.*
  %PROGRAMFILES%\*.*
  %APPDATA%\Update\*.*
  %systemroot%\*. /mp /s
  CREATERESTOREPOINT
  %systemroot%\System32\config\*.sav
  %PROGRAMFILES%\bak. /s
  %systemroot%\system32\bak. /s
  %ALLUSERSPROFILE%\Start Menu\*.lnk /x
  %systemroot%\system32\config\systemprofile\*.dat /x
  %systemroot%\*.config
  %systemroot%\system32\*.db
  %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
  %USERPROFILE%\Desktop\*.exe
  %PROGRAMFILES%\Common Files\*.*
  %systemroot%\*.src
  %systemroot%\install\*.*
  %systemroot%\system32\DLL\*.*
  %systemroot%\system32\HelpFiles\*.*
  %systemroot%\system32\rundll\*.*
  %systemroot%\winn32\*.*
  %systemroot%\Java\*.*
  %systemroot%\system32\test\*.*
  %systemroot%\system32\Rundll32\*.*
  %systemroot%\AppPatch\Custom\*.*
  %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
  %PROGRAMFILES%\PC-Doctor\Downloads\*.*
  %PROGRAMFILES%\Internet Explorer\*.tmp
  %PROGRAMFILES%\Internet Explorer\*.dat
  %USERPROFILE%\My Documents\*.exe
  %USERPROFILE%\*.exe
  %systemroot%\ADDINS\*.*
  %systemroot%\assembly\*.bak2
  %systemroot%\Config\*.*
  %systemroot%\REPAIR\*.bak2
  %systemroot%\SECURITY\Database\*.sdb /x
  %systemroot%\SYSTEM\*.bak2
  %systemroot%\Web\*.bak2
  %systemroot%\Driver Cache\*.*
  %PROGRAMFILES%\Mozilla Firefox\0*.exe
  %ProgramFiles%\Microsoft Common\*.*
  %ProgramFiles%\TinyProxy.
  %USERPROFILE%\Favorites\*.url /x
  %systemroot%\system32\*.bk
  %systemroot%\*.te
  %systemroot%\system32\system32\*.*
  %ALLUSERSPROFILE%\*.dat /x
  %systemroot%\system32\drivers\*.rmv
  dir /b "%systemroot%\system32\*.exe" | find /i " " /c
  dir /b "%systemroot%\*.exe" | find /i " " /c
  %PROGRAMFILES%\Microsoft\*.*
  %systemroot%\System32\Wbem\proquota.exe
  %PROGRAMFILES%\Mozilla Firefox\*.dat
  %USERPROFILE%\Cookies\*.txt /x
  %SystemRoot%\system32\fonts\*.*
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
• You may need two posts to fit them both in.