Everyone read

I thought you WERE clean, I would never have given final steps if I didn't think so. I do believe you have alot of problems that are not malware related.

Run the malware removal procedures again. Attach logs when ready and I'll even get Chaslang to have a look for you.

 

You are getting into safe mode? Are you able to log into an Administrator account? Can you create a new account? What will run in safe mode? Anything?

 

Well, first off, I revisited your previous thread with Kestrell and could not find any malware in your logs. At that point, as far as I can see, your system was clean of malware.

Now, for the girlfriends computer:
Try to do as much of the cleaning as you can in safe mode. Once there, you could try creating a new user account, with admin privileges and password it. Then see if you can reboot into normal mode into that user account and run the scans. Again. if not, boot back to safe mode and run as much as you can.

Here is something you may want to try doing first:

Kaspersky Rescue Disk.

 

Let's try a few things. First, what are these:
C:\Users\jen\Desktop\fin.exe
C:\Users\jen\Desktop\SETUP2.exe

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Now copy just the bold text below to notepad (Do not include any space above the word REGEDIT). Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

Important: This task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

How to back up and restore the registry in Windows]

1. Download and then installSubInACL (SubInACL.exe)file from Microsoft.
2. Click Start, Run and enter notepad and click OK to bring up the Windows Notepad program.
3. Copy and then paste the following text into Notepad.

Code:

cd /d "%ProgramFiles%\Windows Resource Kits\Tools" 
subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f
subinacl /subdirectories %SystemDrive% /grant=administrators=f /grant=system=f
subinacl /subdirectories %windir%\*.* /grant=administrators=f /grant=system=f
secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose

4. Save this Notepad file as Reset.cmd to your desktop. Be sure the Save as type is set to all files.
5. Once you have save it properly, double-click the Reset.cmd file to run the script.

* Note This script file may take a long time to run. Additionally, you have to run this script as an administrator.

6. Now reboot your computer! You must do this before the above will take effect.

Please attach this log from MBAM:

Code:

C:\Users\jen\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs\
mb39ef~1.txt  May 26 2010         906  "mbam-log-2010-05-26 (17-38-23).txt

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\MGlogs.zip

 

Try doing the below:

Download and save the below to your PC (save it anywhere you can find it. The Desktop is fine). Then double click on it to run it.

AVPFind.bat

It should take a couple minutes to run. You will see a black command prompt window while it is running and it should close when it is finished. Once it finishes, attach the avplog.txt file that is will hopefully be created on your Desktop as long as the malware does not block the batch file from running. (See: HOW TO: Attach Items To Your Post)

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click and choose Run as Administrator


You only need to get one of them to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

1. Rkill.exe
2. Rkill.com
3. Rkill.scr
4. Rkill.pif

* Double-click on the Rkill desktop icon to run the tool.
* If using Vista or Windows 7 right-click on it and choose Run As Administrator.
* A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
* If not, delete the file, then download and use the one provided in Link 2.
* If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
* Do not reboot until instructed.
* If the tool does not run from any of the links provided, please let me know.
Once you've gotten one of them to run then try to immediately run the following.

Now download and Run exeHelper from Raktor

• Please download exeHelper to your desktop.
• Double-click on exeHelper.com to run the fix.
• A black window should pop up, press any key to close once the fix is completed.
• A log file named log.txt will be created in the directory where you ran exeHelper.com
• Attach the log.txt file to your next message.

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

If you already have them installed, be sure to update Malwarebytes and SUPERAntiSpyware before the scan!

Now run this: Using Malwarebytes Anti-Malware

Now run this: SUPERAntiSpyware - running & getting a log

Now run this: Using MGtools


Now you need to attach the below logs created while running the above scans

• exeHelper log
• Malwarebytes Anti-Malware log
• MGlogs.zip - normally it is C:\MGlogs.zip - only attach this log from MGtools.exe DO NOT attach any logs seen in the MGtools folder.

 

Let's see if you can do this. Go to start / programs / accessories / right click command prompt and select run as administrator. Then enter this:
net user administrator /active:yes

they type exit.

Now see if you can boot into the Administrator account. Tell me what happens.

 

Try this:

• Download this tool and save it to your Desktop: Inherit.exe
• It must be in your Desktop or the below fix will not work!

Now run the C:\MGtools\FixPerm.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Now see if you can run scans with Malwarebytes and SUPERAntiSpyware.

 

Did you create a password for the Administrators account? Have you just tried hitting enter without a password? Can you boot to the other account and access the Administrator account info?

Did you create the Kaspersky Rescue disc? Have you tried to boot to it?

 

Try creating this USB boot program:

BitDefender Rescue USB.

 

I need you to try running the scans again and attaching these logs:
SAS
MBAM
ComboFix
C:\MGLogs.zip

 

I am not seeing any malware in your logs. You only opted to fix one of the things found by MBAM.

I am thinking you need to post in the software forum for any other issues you are having. Possibly by doing a repair install or maybe keeping your files and personal data and doing a reformat and clean install.