We did what we could, sorry it ended in a format but as you say, a learning experience...next time don't wait so long. Hopefully though there won't be a next time!
Judy

Not AVG. Go with Avira (http://download.cnet.com/Avira-AntiVir-Personal-Free-Antivirus/3000-2239_4-10322935.html?part=dl-10322935&subj=dl&tag=button&cdlPid=11012914)

What is this "wee" problem, may be related to this one, if not then a new thread may be advised but what is the problem?
Judy

Well that showed nothing there. Go ahead and delete that Qoobox folder, especially since it is empty. Are you still having problems or do you feel all is ok now?
Judy

Smodka, earlier you said you saw a file called Qoobox in "C". Can you look and see if it is still there? If so, open it and see if there is a .txt file in there. If there is, open it and copy/paste...

Which tool are you running?

I did NOT remove YOUR link from YOUR post for the Symantec tool which is a legitmate tool and appropriate for the thread, though at this time I believe the problem is corrected but I left the link...

You understand what?

Avast is an excellent program, and as you say, it's free. I highly recommend it.

Hi welcome to daniweb, First of all, you said you all ready had Trend Micro so installing another anti-virus program was a mistake. Rule #1. ONE anti-virus program should run on a machine. Uninstall...

Post the most recent MBA-M log.

Try it once more, if it doesn't work you can delete it manually by right clicking the icon and choosing delete.

Did the program actually run a full scan when this happened?

Ritar, I have all ready told you that you must begin your own new thread. You will not receive answers in this thread. This is not your thread. We do not work with two posters on the same thread....

Looks good Lisa, now just these last steps.

You should remove HiJackThis, you don't need it any more.
You also should uninstall combofix. It basically is a "one time" fix. If a person is told to...

You need to begin your own thread, stating the steps you have taken and posting the HJT log in YOUR own thread.
Judy

PhilliePhan to the rescue!!!!

Have you tried to see if you can update and run MBA-M since the running of GMER? If not, try again.
Judy

Looking pretty good, just a few more fixes needed.
First of all go to Start, Control Panel, Admininstrative Tools, Services.
When that opens the list is in alphabetical order so scroll through...

Looks much better, just a few more steps. Your Java is way out of date and needs to be updated.
Please go HERE (http://www.java.com/en/download/manual.jsp) and download the Offline Install. Save it...

Did combofix ever show you a log when it was complete?
Did you see the screens shown in my two attachments?

Give us another HJT scan and log.

I have a question, you said:

Did you download differently than the instructions stated?

No the actual file, not the name has to be uploaded to their scanners. This IS a legitimate file but GMER has flagged it because it has been altered, probably by the rootkit.
I would like you to try...

Qoobox is combofix Quarantine file we don't want that right now. Don't worry about uninstalling combofix, that has to be done a specific way and I will give instructions for that later.
Forget...

I don't know what was the suspicious entry? Was it this same one showing from your previous logs?

You might upload it to http://virusscan.jotti.org/en and see what all those scanners say about it....

Ok, two things I want to say #1.if you want us to help you clean your machine then you have to follow the steps we give, installing SpywareTerminator would never have been one of them and a "go...

Did you notice that GMER said 79744 bytes executable <-- ROOTKIT !!! next to the entry...you need to run GMER again and no matter the name of the file if it is noted as ROOTKIT then DELETE it. This...

Did you put combofix on your desktop as originally noted? I have not seen it in a folder before as your attachment shows.
Did you open that combofix folder and see what is in it?

Have not seen...

A MUST have is SpywareBlaster (http://download.cnet.com/SpywareBlaster/3000-8022_4-10196637.html).

I wouldn't run a computer without it. Download, install, update, Enable ALL protection, including...

Just double click My Computer. When that opens Double Click "C" drive. When that opens scroll through all you see there. It should be there. Remember, after all the Folder icons, the last one you see...

Try running GMER again and when it shows these files:

C:\WINDOWS\system32\drivers\qkmazwv.sys
C:\WINDOWS\system32\drivers\str.sys

right click on them one at a time and select delete. If it...

Don't give up yet. Let's see what we can find out.

Geeze, I am so sorry. I have been consulting on Crunchie about this so I am going to have him take a look here and see what he suggests, ok?

This log will be very long. Simply copy/paste it as you have done with the others and post it here.
Again I say, you are doing very well. We ARE going to get this computer cleaned up!!!
Judy

Wow! Lot's more found than just the worm.win32.netsky!
Think you better do at least one more scan before I give any more instructions regarding your HJT log.
Please do this:
Please Run the...

Open the logs. Go up to Edit, Select All. Then the log should be in highlight. Go to Edit, Copy.
Then open a new reply here, place the cursor in the reply box, Right Click with your mouse and choose...

Your log looks clean, are you still having problems?

Did you run that Avenger Script? Did it produce a log? If so please post it here.

Hi and welcome to daniweb,
First of all do this:
Please download Malwarebytes' Anti-Malware (MBA-M) (http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html) to your Desktop.
...

Run Avenger again and in the Script window type all of this script:



Be sure there is a check mark in Scan for Rootkits and then click the Execute button.

After that completes then try...