win32.agent.qt appears again and again...

Although you now appear to be using Avast as your antivirus, you still have items from Symantec hanging around. Please run this:Norton Removal Tool (SymNRT)

Uninstall the below old versions of software:
Java 2 Runtime Environment, SE v1.4.2_05


Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

File::
C:\WINDOWS\mrofinu572.exe.tmp
 
Folder::
C:\WINDOWS\system32\dp1
C:\WINDOWS\system32\feq9
C:\WINDOWS\system32\nGpxx01
 
Registry::
[HKEY_LOCAL_MACHINE\software\Microsoft\windows\currentversion\Explorer\ShellExecuteHooks]
"{E180F496-8A4B-44E2-9FE0-0364E345DB7F}"=-
[-HKEY_USERS\S-1-5-21-2415682206-914002717-4149115087-1005\Software\Microsoft\Internet Explorer\New Windows\Allow\*.starsdoor.com]
[HKEY_USERS\S-1-5-21-2415682206-914002717-4149115087-1005\Software\Microsoft\Internet Explorer\New Windows\Allow]
"*.starsdoor.com"=-

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

You should attach the requested follow up logs so we can be sure.