Do you mean you are using Windows Live OneCare?
Honestly, I am a bit confused here. Turning off Windows Auto update is ok, but that doesn't mean you shouldn't update, it should be done manually which is very easy to do. Many people do this. If you are not doing ANY Microsoft Updates then this would mean that the Windows Live OneCare, if that is what you are using, is not up to date either I would think, so your antivirus protection is out of date and therefore you would not be protected against new viruses that turn up nearly every day. One key to each and every security program is keeping it updated if you don't do that then why even have it on the computer?
I have no clue was to what this TeeTime software is you are talking about but really have never heard of being told NOT to do the Microsoft Updates. In fact I have not heard of a program which prohibits Microsoft Updates. Windows is your operating system, that is what runs the computer and it is vital to all other software running on the computer. But if it is out of date then eventually other programs will probably not run correctly either because they would not be able to update either sooner or later because the old Windows files would be incompatible with possible new updates for other software.
Take a look at the infected files removed....many of them first were located in this Teetime folder to begin with, what does that tell you?
As far as the ESET scanner overwriting the previous notepad file, it WOULD overwrite it because it is a new scan so the information would be new.
The other thing, many of these were located in C:\qoobox\Quarantine
Telling me that sometime combofix was run on the machine WHEN? You have made no mention of running combofix.
Also you state that I don't understand why and then it also makes me wonder, is the HJT scan actually a scan done ON the infected computer OR do you mean you are having these problems but they prohibit you from posting from the infected computer OR is the HJT scan a scan done not on the infected computer but one which was done on the computer you are posting from? If the later is the case then that HJT scan means nothing because it would only show the computer where the scan was done, not the computer where the infection is located.
You said in your original post you are back again after a year, I was not here a year ago so that wouldn't give me information plus what happened a year ago wouldn't apply, generally, to what is happening now, unless the problem was not fixed a year ago.
Can you please clarify all this for me? I really hesitate offering any possible solutions since I don't feel I have all the needed information.
Judy