I ran the gmer scan.

There were two items it said it said it couldn’t access because they were in use—system folder and ntuser.dat.

Here’s the log.