Win32 Medfos.AA trojan

[cale]

I discovered this problem after a fake antiviral software popped up and told me I had problems. I already had NOD32 running so became suspicious. I ran Malaware bytes which found some problems that I then deleted. I ran a manual scan with NOD32 which found the Medfos (although it hadn't previously spotted it) but can't delete it.
So, I have run the procedure detailed on this forum and am now uploading logs. I have an XP64 bit system so didn't run Combofix or RootRepeal.

So far, there seem to be no symptoms/problems but when I reboot I get the warning from NOD32 about the virus.

I've unplugged 3 back up drives that were attached, one of which was my Dropbox folder.

Thanks for any help.

[TimW]

ComboFix runs on 64bit systems.

What is nod complaining about? The exact message, please.

[cale]

Hi Tim
thanks for your reply. I have attached a screen grab of the NOD32 message (and another warning message that appear when I boot up).

If I click on 'Delete' then I get another message saying 'Error while Deleting' and options to either 'Retry' or 'Cancel'. Selecting Retry just brings the message up again and again.

[TimW]

I am not finding a temp1 folder in your logs.

[cale]

should I re-run the tests o produce new logs or attach the NOD32 log?

[TimW]

Do a search on your system and try to find what it is reporting: ie the temp1 folder.

[chaslang]

Originally Posted by TimW

I am not finding a temp1 folder in your logs.

Yes there is. You can see even more too in newfiles.txt

d-----w                 0 2012-06-03 09:09:37  C:\temp
d-----w                 0 2012-06-03 09:33:26  C:\temp1
d-----w                 0 2011-01-05 17:06:07  C:\temp2

Note that ComboFix does not run on Windows Server 2003

[cale]

I've looked in the C:\temp1\ folder and can see the file npacsy.dll
Should I try to delete it?

The instructions page that I followed http://forums.majorgeeks.com/showthread.php?t=139313 says that combofix should not be downloaded or run on XP64 systems. If that's not the case any more should I download and run it?

[TimW]

I must have missed that when I was looking through the logs. Yes, try to delete everything in that folder.

If you can't manually delete it, then:
Download OTL to your desktop.

Double-click OTL.exe to start the program.

• Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code

:processes
:killallprocesses
:file
C:\temp1


:commands
[PURITY]
[EMPTYTEMP]
[RESETHOSTS]
[REBOOT]

• Then click the Run Fix button at the top.
• Click the OK button.
• OTL may ask to reboot the machine. Please do so if asked.
• The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


Then attach the below logs:

• C:\MGlogs.zip

[cale]

I tried to delete the contents of temp1 but some of the files wouldn't/couldn't be deleted.
I ran OTL and it did ask for a reboot.On reboot I still get the warning from NOD32.
I closed the Notepad log generated by OTL (after copying it) bit couldn't find the 'log form' you describe so I have copied the contents to a new Notepad file which I attach.

[TimW]

Odd. Let's try it again. I don't recall if Avenger will work on your system, but let's try:

Now download The Avenger by Swandog46 to your Desktop.

See the download links under this icon

1. Run avenger.exe by double-clicking on it.
2. Click OK at the warning to continue to use The Avenger
3. Do not change any of the check box options!
4. Shut down your protection software now to avoid possible conflicts.
5. Copy everything in the Quote box below, and paste it into the Input script here: part of The Avenger
   

   Files to delete:
   C:\temp1\npacsy.dll
   C:\temp1\bvmseg.dll
   
   Registry keys to delete:
   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run\bvmseg
   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run\npacsy

6. Now click the button
7. Click Yes to the prompt to confirm you want to execute.
8. Click Yes to the Reboot now? question that will appear when The Avenger finishes running.
9. Your PC should reboot, if not, reboot it yourself.
10. A log file from The Avenger will be produced at C:\avenger.txt and it will pop-up for you to view when you login after reboot.
11. Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).Make sure that you watch for the license agreement for TrendMicro HijackThis and click on the Accept button TWICE to accept ( yes twice ).

Then attach the below logs:

* C:\Avenger.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

[cale]

Unfortunately I'm getting this: "Fatal Error: unsupported version of Windows! Thos program will run only on Windows 2000, XP or Vista. Exiting Now!"

[TimW]

Download OTM by Old Timer and save it to your Desktop.

• Right-click OTM.exe And select " Run as administrator " to run it.
• Paste the following code under the area. Do not include the word Code.

:Processes
explorer.exe
:Files
C:\temp1\npacsy.dll
C:\temp1\bvmseg.dll
:Reg
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"bvmseg"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"npacsy"=-
:Commands
[purity]
[ResetHosts]
[createrestorepoint]
[emptytemp]
[start explorer]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
• Push the large button.
• OTM may ask to reboot the machine. Please do so if asked.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.

Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach this log file to your next message.

NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and attach that document back here in your next post.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below log:

• C:\MGlogs.zip

Make sure you tell me how things are working now!

[cale]

I ran OTM as instructed and it did ask for a reboot which I did. On rebooting the log file in Notepad automatically opened and I have pasted it below:


All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
DllUnregisterServer procedure not found in C:\temp1\npacsy.dll
C:\temp1\npacsy.dll moved successfully.
File/Folder C:\temp1\bvmseg.dll not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run\\bvmseg not found.
Registry value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run\\npacsy not found.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Error creating restore point.

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 27710319 bytes
->Google Chrome cache emptied: 8711230 bytes
->Flash cache emptied: 611 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LogMeInRemoteUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1086 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 35.00 mb


OTM by OldTimer - Version 3.1.19.0 log created on 06072012_215754

Files moved on Reboot...

Registry entries deleted on Reboot...




On rebooting there was no NOD32 warning about the virus but there was the dll warning (please see the screengrab in my earlier post).

The PC has been working fine and apart from the warning messages seems ok.

I have attached the MGlogs.zip

[cale]

Actually, I've noticed the attached warning when I open Firefox (throughout this process I've been using Chrome).

If I close Firefox and reopen there is no warning but if I open after a reboot there is.

This doesn't happen with Chrome or IE8

[cale]

Update:

After a couple of reboots the Firefox problem seems to have ceased.

However, if you see the attached jpg, there are now two of the dll warnings

[TimW]

Please attach your logs in the future.

It is strange that OTM is not finding these items. Let's run it again, with the same fix I gave you in my last post. Attach the new log and a new MGLogs.zip.

[cale]

Here we go. After OTM asked for reboot the two dll warnings were still there.

[TimW]

Well, the tool isn't removing them. Let's try using OTL again and if it still won't remove them, we can try doing it manually.

Double-click OTL.exe to start the program.

• Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code

:processes
:killallprocesses
:files
C:\temp1\npacsy.dll
C:\temp1\bvmseg.dll

:reg
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"bvmseg"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"npacsy"=-

:commands
[PURITY]
[EMPTYTEMP]
[RESETHOSTS]
[REBOOT]

• Then click the Run Fix button at the top.
• Click the OK button.
• OTL may ask to reboot the machine. Please do so if asked.
• The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


Then attach the below logs:

• C:\MGlogs.zip

[chaslang]

Originally Posted by TimW

Please attach your logs in the future.

Fix your boilerplate and this will not happen. You and Kestrel13! are using a boilerplate that asks for the logs to be pasted in.