Win7 almost loads desktop (after malware cleanup)

[ftcnet]

My friend brings me his Win7Pro laptop with some newish variant of the Ukash malware (Trojan.Winlock). System Restore didn't work, so I used the Admin account to run Malwarebytes scan which helped. His usual login account (Fred) has admin privs, but just before it should load the desktop, it shows a black screen with just a CMD (DOS window) at the C:\Windows\system32 prompt. Typing 'explorer' loads desktop as expected.

The Admin login goes to desktop -no problem, but Fred (admin) login stops at CMD (DOS Windows) and requires 'explorer' command to proceed to desktop.

The registry entry Computer\HKEY_CURRENT_USER\Software\Microsoft\Command Processor \
had an AUTOBOOT entry to some random named file which I removed. Apparently there's still something else I need to find.

Any suggestions or ideas on how to resolve this would be most appreciated. Thanks,

 

[centaur78]

Please run Autoruns and then click on File> Save.. Save the file in .arn format and upload here. Will have a look

 

[Kaktussoft]

My friend brings me his Win7Pro laptop with some newish variant of the Ukash malware (Trojan.Winlock). System Restore didn't work, so I used the Admin account to run Malwarebytes scan which helped. His usual login account (Fred) has admin privs, but just before it should load the desktop, it shows a black screen with just a CMD (DOS window) at the C:\Windows\system32 prompt. Typing 'explorer' loads desktop as expected.

The Admin login goes to desktop -no problem, but Fred (admin) login stops at CMD (DOS Windows) and requires 'explorer' command to proceed to desktop.

The registry entry Computer\HKEY_CURRENT_USER\Software\Microsoft\Command Processor \
had an AUTOBOOT entry to some random named file which I removed. Apparently there's still something else I need to find.

Any suggestions or ideas on how to resolve this would be most appreciated. Thanks,

In Fred account check:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
and
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
and

HKEY_Current_User\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

 

[Kaktussoft]

display screenshot of fred's HKEY_CURRENT_USER\Software\Microsoft\Command Processor

 

[ftcnet]

.. thanks all for the replies with useful suggestions. Fred says his boss is getting him a new laptop, so he's OK with it the way it is until the new laptop arrives in a day or so.