Not sure if malware is removed

Welcome to Major Geeks!

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:


R3 - URLSearchHook: uTorrentControl_v2 Toolbar - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files (x86)\uTorrentControl_v2\prxtbuTor.dll
O2 - BHO: uTorrentControl_v2 - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files (x86)\uTorrentControl_v2\prxtbuTor.dll
O3 - Toolbar: uTorrentControl_v2 Toolbar - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files (x86)\uTorrentControl_v2\prxtbuTor.dll
O4 - HKCU\..\Run: [AdobeUpdate] wscript "C:\Users\Andre\AppData\Roaming\Adobex86\invis.vbs" "C:\Users\Andre\AppData\Roaming\Adobex86\bat.exe"
O4 - HKUS\S-1-5-21-2487167802-3491251391-1733091479-1004\..\RunOnce: [CTPostBootSequencer] "C:\Users\Andre\AppData\Local\Temp\CTPBSeq.exe" /reglaunch /self_destruct (User 'UpdatusUser')


After clicking Fix, exit HJT.


Uninstall the below program:
uTorrentControl_v2 Toolbar


Please download OTM by Old Timer and save it to your Desktop.

• Run OTM.exe by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).
• Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
  (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
  the code box

Code:

:Processes
explorer.exe
 
:Files
C:\Users\Andre\AppData\Roaming\Microsoft\Windows\Templates\vmnethcp.exe)
C:\Users\Andre\AppData\Roaming\Adobex86\invis.vbs
C:\Users\Andre\AppData\Roaming\Adobex86\bat.exe
C:\Users\Andre\AppData\Local\Temp\CTPBSeq.exe
C:\Users\Andre\AppData\Local\Temp\15829.exe
C:\Users\Andre\AppData\Local\Temp\17606.exe
C:\Windows\Prefetch\66786.EXE-C72F1FA8.pf
C:\Windows\Prefetch\17606.EXE-BC326C7F.pf
C:\Windows\Prefetch\17606.EXE-BC326C7F.pf
C:\Windows\Prefetch\17606.EXE-BC326C7F.pf
C:\Users\Andre\AppData\Local\Temp\39397.exe
C:\Users\Andre\AppData\Local\Temp\6656.exe
C:\Users\Andre\AppData\Local\Temp\82255.exe
C:\Users\Andre\AppData\Local\Temp\66786.exe
C:\Users\Andre\AppData\Local\Temp\73479.exe
C:\Users\Andre\AppData\Local\Temp\81884.exe
C:\Users\Andre\AppData\Local\Temp\15829.exe
C:\Users\Andre\AppData\Local\Temp\82255.exe
C:\Users\Andre\AppData\Local\Temp\6656.exe
C:\Users\Andre\AppData\Roaming\Adobex64\winlogin.exe
C:\Users\Andre\AppData\Roaming\Adobex86\winsvchost.exe
C:\Users\Andre\AppData\Local\Temp\*.exe
C:\Users\Andre\AppData\Local\Temp\*.*


:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AdobeUpdate"=-
:Commands
[purity]
[EmptyTemp]
[start explorer]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
  ) and choose Paste.
• Now click the large http://forums.majorgeeks.com/chaslang/images/MoveIt!.png button.
• If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
• Close OTM.

Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
this log file to your next message.

Now please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
• The tool will open and start scanning your system.
• Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Attach JRT.txt to your next message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• the C:\_OTM\MovedFiles log
• the JRT.TXTlog
• C:\MGlogs.zip

Make sure you tell me how things are working now!