Win7 almost loads desktop (after malware cleanup)

ftcnet said:

My friend brings me his Win7Pro laptop with some newish variant of the Ukash malware (Trojan.Winlock). System Restore didn't work, so I used the Admin account to run Malwarebytes scan which helped. His usual login account (Fred) has admin privs, but just before it should load the desktop, it shows a black screen with just a CMD (DOS window) at the C:\Windows\system32 prompt. Typing 'explorer' loads desktop as expected.

The Admin login goes to desktop -no problem, but Fred (admin) login stops at CMD (DOS Windows) and requires 'explorer' command to proceed to desktop.

The registry entry Computer\HKEY_CURRENT_USER\Software\Microsoft\Command Processor \
had an AUTOBOOT entry to some random named file which I removed. Apparently there's still something else I need to find.

Any suggestions or ideas on how to resolve this would be most appreciated. Thanks,

In Fred account check:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
and
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
and

HKEY_Current_User\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

display screenshot of fred's HKEY_CURRENT_USER\Software\Microsoft\Command Processor