I Think I have the VupdMan32 Trojan [Solved]

Hi weeman608,

Download CKScanner by askey127 from Here & save it to your Desktop.

• Doubleclick CKScanner.exe then click Search For Files
• When the cursor hourglass disappears, click Save List To File
• A message box will verify the file saved
• Double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply

CKScanner - Additional Security Risks - These are not necessarily bad scanner sequence 3.RP.11.OXNAVM —– EOF —–

Hi weeman608,

• Please download the attachment that I have placed in this reply to your Desktop and save it as CFScript.txt and change the "Save as type" to "All Files"
  
  [external image: Posted Image]
  
• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
• When finished, it shall produce a log for you. Attach the results in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-

I did the last step. Went to work, came home and the blue cmd screen says this: Rebooting windows. . . Please wait ^CTerminate batch job (Y/N)? _ It's the only thing on my screen besides my taskbar I can't type anything or hit esc or enter. I don't see a log either. :/

Hi weeman608, Go ahead and reboot your system. Check again to see if the ComboFix log was created. If you still have problems let me know.

Rebooted with no problems. Combofix came back up, gave me a log. Here it is.

Hi weeman608, While I am looking over your ComboFix log (good job getting that btw) please run another scan with GMER. If you are able to post that log here please do so…if it is too large once again go ahead and upload it to MediaFire like we did before and give me the link to give it a look over.

Here is the second GMER scan

Hi weeman608,

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan as shown below.
  
  [external image: Posted Image]
  
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

The log can also be found here:
C:\Documents and Settings\\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
———-

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

• Please go here then click on: [external image: Posted Image]

• Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:
  
  • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Now click on: [external image: Posted Image]
• The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on: [external image: Posted Image]
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
———-

In your next reply please post the logs created by Malwarebytes and ESET online scanner.

Here is the Mbam log and the ESET log.

Hi weeman608,

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  

  :file
  C:\WINDOWS\system32\drivers\redbook.sys

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Here is the log to SystemLook