malware log review humbly requested

Hello,

I have run through the malware removal procedure and feel that something still isn't right. I have attached the three log files, but there is something you should know. Even after choosing "create log file after every scan:nly when threat is found" AVG did not create a new log file. Instead, I attached my first log from Jan 10.

note: I ran all of these scans on the admin account, not the infected user account. When I ran hijackThis on the user account, after all of this, it still showed many entries which point to malware. Was I suppose to run everything under the user account?

The problem with this workstation began several weeks ago. It didn't come to my attention at first because the user didn't want to be blamed. They didn't admit to anything directly, but another user informed me that they ran an online scan because they were to their system was infected. I suppose I didn't educate enough, meh.

So, popups galore. - and here I am.

I ran combofix all the way through and restarted. I wasn't expecting it to start running again and inadvertantly moved one of the windows during the 'generating log' stage after rebooting. All I know is that program didn't finish - I had to terminate it.

Thank you so very much for your time. I will rerun the AVG scan this evening in hopes of generating new logs. The problem is that AVG was one of the bad files it quarantined. I'm having trouble opening it again... wacko program, it bit itself in the a..

-Shawn

 

Ok - I'm having some trouble with the malware removal procedure.

1.) ComboFix does not entirely complete - even if I do nothing with the mouse. It gets through the whole first part, reboots, and begins running again when I log in. It opens two kmd.exe windows. This is where it stops with a blinking cursor. I've left it alone for over 30 minutes with no change. If I close one of the kmd.exe windows the remaining kmd.exe window says 'cancel batch', I put Y and it continues on to generate logs. It then freezes here with another kmd.exe window - blinking away. I let it sit and nothing.

2.) My AVG log didn't create so I went back to rerun it. However, AVG found its own executable (avgas.exe) to be infected. I found another in the main folder called avgas .exe (with a space). I'm not sure if this is a viral copy, or what.

I could use some direction.

Thanks for your time.
-Shawn

 

Thank you, Tim.

Logs attached.
However, after rebooting out of safe mode, ComboFix.exe ran some other tasks and got stuck, like before. More precisely: The main window read "Please wait... The system cannot find the file specified", there were also two kmd.exe windows open. I eventually clicked close on one of them. The other prompted "^CTerminate Batch job?" I answered yes, which allowed the process to continue.

The main "Find3M" window read "Preparing Log Report. Do not run any programs until combofix has finished." The other kmd.exe window made no progress after 15 minutes or so. I closed it to get out of the program.

-Shawn