BraveSentry removed? - problems remain

[pkraft]

You should also follow PP's instructions for using the ATF-Cleaner. Since you seem to be using Firefox be sure to use the ATF-Cleaner on the Firefox option also. If it asks if you wish to keep your Firefox passwords that is fine for you to do.
Do this in safe mode and then run another full system scan in SAFE MODE of the AVG-Anti-spy program. Have it fix everything it finds.


Another question...Do you know what THIS entry is in your HJT logs?
O4 - HKLM\..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon. exe
It has appeared in all HJT logs you have posted. Info is slim...though some refer to it when speaking of the Canon All-In-One printer. I see that you have a Dell Printer on the computer, do you also have the Canon printer?
It also is noted as a questionable file and that is the reason I am asking.

Yes, I do have a Canon printer also although not a All-In-One.

[pkraft]

NT Authority Sym???? windows/system32/sass.exe
pk

I mistyped the file name - it was lsass.exe

pk

[jholland1964]

Disconnect the computer from the internet again. Go back to the usable computer and your usb device
Download ComboFix.exe
Try again to boot the infected computer...fingers and toes crossed again.
Hopefully you will be able to run this on the infected computer...
Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window while its running. That may cause it to stall

[pkraft]

Judy: Not sure I understand how I'm to run anything with a blank desktop. I do have task manager - from there?

Thanks, pk

[jholland1964]

Well RATS! This is probably my fault because I had you run regcleaner too soon....or one of those nasties still remaining is stopping it from booting properly.
Couple of things to try, I will give them one by one let me know if or when something works. I don't want to throw too much out there at one time.

Check Task Manager and see if Explore.exe is running. If not then load it via Task Manager. If it IS running try ending it and restarting it via File, New Task

[pkraft]

It is not running. In Task Manager I browsed to C:\WINDOWS\Explore.exe, hit ok - error message:

C:\WINDOWS\Explore.exe is not a valid Win32 application.

[jholland1964]

My bad.....explorer.exe

[pkraft]

My bad also - it was windows\explorer.exe that I tried to run

pk

[jholland1964]

Did you do this?
start task manager
click new task and type in
c:\windows\explorer.exe

[pkraft]

Yes. Tried it again to be sure - same error.