Done all I can do...hope you guys can help!

You have both Norton and Microsoft OneCare running. You should not be doing this. This violates step 3 of the READ ME.

Uninstall the below old versions of software:
J2SE Runtime Environment 5.0 Update 9

Now install the current version of Sun Java from: Sun Java Runtime Environment


You still show signs of a few problems! One of them is a PurityScan infection. The below tool usually helps make removal of this easier.

1. Now Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Attach this log to your next reply

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

There are also a few thing from Vundo & SmitFraud left. See if you can find and delete the below files:
C:\WINDOWS\system32\wapisvsu.exe
C:\WINDOWS\system32\opnkkhf.dll
C:\WINDOWS\system32\drvmeg.dll
C:\WINDOWS\system32\kjjlm.tmp
C:\WINDOWS\system32\ijjlm.ini
C:\WINDOWS\system32\kjjlm.ini
C:\WINDOWS\system32\kjjlm.ini2
C:\WINDOWS\system32\components\flx0.dll
C:\WINDOWS\system32\components\flx10.dll
C:\WINDOWS\system32\components\flx9.dll


Now locate the below folders and delete it if found:
C:\Program Files\Common Files\{303311DF-0CE3-1033-0223-040312180001}
C:\Program Files\Common Files\{803311DF-0CE3-1033-0223-040312180001}

Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\WINDOWS\Temp
C:\Documents and Settings\Emilie Fitzgerald\Local Settings\Temp


Now attach the below new logs and tell me how the above steps went.

1. ComboFix
2. ShowNew
3. HJT

 

If Virusburster is in system restore it has not returned. We just have not emptied System Restore yet.

The C:\Qoofix folder was created by ComboFix while cleaning your malware.
I had a question about the new folder name you are referring to. It appears in your newfiles.txt log as show below:

Code:

"C:\"
DO7307~1      Dec  6 2006              "Do?"

Files and folder names with question marks in them are typically signs of PurityScan which ComboFix normally removes. I have never seen this particular folder name though and tyically the file and folder do not appear in the root folder. I see from you other message that you deleted it now anyway, so you saved me the trouble of telling you to do so..

You logs are clean otherwise and you need to get started on the below steps (which would have addressed some of your questions/findings).

If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
7. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
8. If you are running Windows XP or Windows ME, do the below:
   • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
9. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!

 

I don't know what you are referring to! What logs are disconcerting? You did not post any logs showing malware. Your system is clean based on what you posted.

 

When you said "my counterspy from this morning" I thought you were referring to a new log not an old one! The previous log was from 3 days earlier.

You're welcome!