We shall use FRSTScript one more time but this time we’re gonna give FRST a more force power.
Rule still applies. Do not use any USB memory device until I tell you so. Also, we shall run ComboFix as additional confirmation.

1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system


START
UNLOCK: C:\Users\maggot\AppData\Local\Temp
UNLOCK: C:\Users\maggot\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
C:\Users\maggot\AppData\Local\Temp\*.VBS
C:\Users\maggot\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.VBS
HKCU\...\Run: [MICROS~1] - C:\Users\maggot\AppData\Local\Temp\MICROS~1.VBS [152739 2013-09-25] () <===== ATTENTION
Startup: C:\Users\maggot\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MICROS~1.VBS ()
HKLM-x32\...\Run: [FAStartup] - [x]
END

2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.

THEN

Scan with Combofix:

[*] Please download ComboFix by sUBs and save it to your Desktop.
You may read how Combofix works here.

[*] Temporarily disable your AntiVirus program, usually via a right click on the System Tray icon. They may interfere with Combofix.
If you are unsure how to do this please read this or this Instruction.

[*] Run ComboFix. Click on I Agree! & follow the prompts.
Note: If you see a message like “Illegal operation attempted on a registry key that has been marked for deletion” just restart your computer.

[*] When finished, it will produce a report for you. Please attach log reports (ComboFix.txt) back to topic.
(typical log location: C:\ComboFix.txt )