Help cleaning this laptop please

Please see logs thanks

 

more logs

 

Hello vkinetic,

Fix items using OTL by OldTimer

Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Copy the text in the code box below and paste it into the text-field.

Code:

[COLOR="DarkRed"]:files[/COLOR]
C:\Users\Kathy\AppData\Roaming\Yham /d
c:\users\kathy\appdata\roaming\adobe\plugs
c:\users\kathy\appdata\roaming\adobe\shed
dir /s c:\users\kathy\appdata\roaming\adobe /c
C:\Users\Kathy\AppData\Roaming\Efohwe /d
C:\Users\Kathy\AppData\Roaming\Icaxcu /d
c:\windows\installer\{8587baeb-b89d-9e0c-6109-d43a0a9c065e}
c:\users\kathy\appdata\local\{8587baeb-b89d-9e0c-6109-d43a0a9c065e}
[COLOR="DarkRed"]:reg[/COLOR]
[HKU\S-1-5-21-2255978354-2224348373-3029155180-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Orviyvdi"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Orviyvdi"=-
[HKEY_USERS\S-1-5-21-2255978354-2224348373-3029155180-1003\Software\Microsoft\Windows\CurrentVersion\run]
"Orviyvdi"=-
[COLOR="DarkRed"]:commands[/COLOR]
[clearallrestorepoints]
[emptytemp]

Now click the button.
If the fix needed a reboot please do it.
Click the OK button (upon reboot).
When OTL is finished, Notepad will open. Close Notepad.
A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
Attach this log to your next message. (How to attach)

__

From Programs and Features (via Control Panel), please uninstall the below:

• Java(TM) 6 Update 29

__

Now install the current version of Sun Java from: here

__

Now run C:\MGtools\GetLogs.bat by right-mouse clicking it and then selecting Run as Administrator
This updates all of the logs inside MGlogs.zip.
When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)

 

Thank you thisisu - attached are the requested logs

 

Looks good for the most part. Just need to fix Windows Firewall and potentially some other services that this infection tends to break.

Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.

• Now open Repair_Windows.exe
• Go to the Start Repairs tab.
• Press the Start button
• Create a System Restore point if prompted.
• In the Repair Options window, choose the following repairs:
  • Reset Registry Permissions
  • Repair Windows Firewall
• Place a checkmark in Restart/Shutdown System When Finished
• Fill in the Restart System bubble
• Now click the Start button.
• Be patient while the tool repairs the selected items. Your computer should automatically restart when finished.

__

Please download Farbar Service Scanner and run it on the computer with the issue.

• Make sure all the options are checked
• Press Scan.
• It will create a log (FSS.txt) in the same directory the tool was run.
• Please attach FSS.txt to your next message. (How to attach)

 

Thank you - here is the requested log

 

• Download each of the 3 files below onto the desktop of the computer with the issues:
  • wuauserv.reg
  • BITS.reg
  • WinDefend.reg
• Now double-click each of them, one at a time, and allow each one to merge into the Windows registry.
• Let me know if you received a successful message for all four files.
  • If all were successful, reboot your computer and rescan with Farbar Service Scanner. Attach its latest log.
  • If they weren't successful, let me know but rescan with Farbar Service Scanner too.

 

Thank you - the three reg files sucessfully merged into the registry. The requested log file is attached

 

Perfect

If you are not having any other malware related problems, it is time to do our final steps:

• Any programs we had you download and/or install can be removed at this time.
• If we had you download and run ComboFix, here is how to uninstall it:
  • Press and hold the Windows key and then press the letter R on your keyboard.
  • This opens the Run dialog box.
  • Copy and paste the below text inside the text-field:
    • "%userprofile%\desktop\ComboFix" /uninstall
  • Now press ENTER
  • ComboFix will extract its files one last time and you should receive a notification that ComboFix has been uninstalled shortly after.
• You can re-enable your Disk Emulation software at this time via DeFogger.
• If we had you create or download a registry patch or "fix" script, these can be deleted at this time.
• Go into the C:\MGtools folder and run the MGclean.bat file to remove additional traces of our tools.
• Now we will toggle System Restore to remove any infected system restore points.
  • Read this: How to Disable And Enable System Restore
• Lastly, here is a guide to protect you from future infections: How to Protect yourself from malware!
• Be safe

 

Thank you very much for all your help thisisu - the laptop is working fine now

regards

vkinetic

 

You're welcome. Be safe.