Followed the Maleware removal guide but still something there

Let's start with this:

The name given by spybot is not important, what is important is the file path.

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

Now let's use ComboFix to remove a bunch of malware files.

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

KILLALL::

File::
C:\Documents and Settings\Samantha Colley\Local Settings\Application Data\zshv.vbs
C:\WINDOWS\system32\msxmph32.exe
C:\WINDOWS\system32\sdra64.exe
C:\WINDOWS\system32\lowsec
C:\WINDOWS\Temp\b.tmp         
C:\WINDOWS\Temp\c.tmp         
C:\WINDOWS\Temp\d.tmp         
C:\WINDOWS\Temp\f.tmp
C:/Documents and Settings/Samantha Colley/Local Settings/Temporary Internet Files/Content.IE5/KTLT4JAF/xjhgwgm.exe
c:\windows\TEMP\TMP0000005A80FD5D92423230B1

Folder::
C:\WINDOWS\system32\lowsec
c:\windows\TEMP\TMP0000005A80FD5D92423230B1

RegLock::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\*+ák ]
"DisplayName"=""
"DeviceDesc"=""
"ProviderName"=""
"MFG"="????????\02"
"ReinstallString"="??"
"DeviceInstanceIds"=multi:"busati.inf\00"

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ggrgj"=-
"rnamw"=-
"MSMSGS"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,"

* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the prvevious file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\ComboFix.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

 

The file is not showing in your logs. However, there is an item I need to do some consulting about. In the meantime, we need to stop BitTorrent from running at start up and opening your computer to the world:

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

 

What issues are you still having? I will get back to you asap.

 

You didn't attach anything and I need to know what windows defender is alerting you about.

Please attach a list or copy of those items and then also run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\MGlogs.zip

 

Still not seeing any malware...but I couldn't open your Word document, which is why we ask you to attach only .txt logs. Use notepad and attach that log again.

What is this:
C:\botf

 

Good, but that does not tell me the full path to the files. Those items could well be in quarantine folders.
You need to find and tell me the full path.

 

Most of what is showing is in your system restore folders. But seeing as it's been over a month since you last posted, I would suggest that you re-do all the scans and ATTACH the logs.