Win32 Medfos.AA trojan

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by cale, Jun 3, 2012.

  1. cale

    cale Private E-2

    I discovered this problem after a fake antiviral software popped up and told me I had problems. I already had NOD32 running so became suspicious. I ran Malaware bytes which found some problems that I then deleted. I ran a manual scan with NOD32 which found the Medfos (although it hadn't previously spotted it) but can't delete it.
    So, I have run the procedure detailed on this forum and am now uploading logs. I have an XP64 bit system so didn't run Combofix or RootRepeal.

    So far, there seem to be no symptoms/problems but when I reboot I get the warning from NOD32 about the virus.

    I've unplugged 3 back up drives that were attached, one of which was my Dropbox folder.

    Thanks for any help.
     

    Attached Files:

  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    ComboFix runs on 64bit systems.

    What is nod complaining about? The exact message, please.
     
  3. cale

    cale Private E-2

    Hi Tim
    thanks for your reply. I have attached a screen grab of the NOD32 message (and another warning message that appear when I boot up).

    If I click on 'Delete' then I get another message saying 'Error while Deleting' and options to either 'Retry' or 'Cancel'. Selecting Retry just brings the message up again and again.
     

    Attached Files:

  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not finding a temp1 folder in your logs.
     
  5. cale

    cale Private E-2

    should I re-run the tests o produce new logs or attach the NOD32 log?
     
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Do a search on your system and try to find what it is reporting: ie the temp1 folder.
     
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes there is. You can see even more too in newfiles.txt
    Code:
    d-----w                 0 2012-06-03 09:09:37  C:\temp
    d-----w                 0 2012-06-03 09:33:26  C:\temp1
    d-----w                 0 2011-01-05 17:06:07  C:\temp2

    Note that ComboFix does not run on Windows Server 2003
     
  8. cale

    cale Private E-2

    I've looked in the C:\temp1\ folder and can see the file npacsy.dll
    Should I try to delete it?

    The instructions page that I followed http://forums.majorgeeks.com/showthread.php?t=139313 says that combofix should not be downloaded or run on XP64 systems. If that's not the case any more should I download and run it?
     
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I must have missed that when I was looking through the logs. Yes, try to delete everything in that folder.

    If you can't manually delete it, then:
    Download OTL to your desktop.

    Double-click OTL.exe to start the program.

    • Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code

    Code:
    :processes
    :killallprocesses
    :file
    C:\temp1
    
    
    :commands
    [PURITY]
    [EMPTYTEMP]
    [RESETHOSTS]
    [REBOOT]
    
    
    • Then click the Run Fix button at the top.
    • Click the OK button.
    • OTL may ask to reboot the machine. Please do so if asked.
    • The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:

    • C:\MGlogs.zip
     
  10. cale

    cale Private E-2

    I tried to delete the contents of temp1 but some of the files wouldn't/couldn't be deleted.
    I ran OTL and it did ask for a reboot.On reboot I still get the warning from NOD32.
    I closed the Notepad log generated by OTL (after copying it) bit couldn't find the 'log form' you describe so I have copied the contents to a new Notepad file which I attach.
     

    Attached Files:

  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Odd. Let's try it again. I don't recall if Avenger will work on your system, but let's try:

    Now download The Avenger by Swandog46 to your Desktop.

    See the download links under this icon [​IMG]

    1. Run avenger.exe by double-clicking on it.
    2. Click OK at the warning to continue to use The Avenger
    3. Do not change any of the check box options!
    4. Shut down your protection software now to avoid possible conflicts.
    5. Copy everything in the Quote box below, and paste it into the Input script here: part of The Avenger
    6. Now click the [​IMG] button
    7. Click Yes to the prompt to confirm you want to execute.
    8. Click Yes to the Reboot now? question that will appear when The Avenger finishes running.
    9. Your PC should reboot, if not, reboot it yourself.
    10. A log file from The Avenger will be produced at C:\avenger.txt and it will pop-up for you to view when you login after reboot.
    11. Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )


    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).Make sure that you watch for the license agreement for TrendMicro HijackThis and click on the Accept button TWICE to accept ( yes twice ).

    Then attach the below logs:

    * C:\Avenger.txt
    * C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
  12. cale

    cale Private E-2

    Unfortunately I'm getting this: "Fatal Error: unsupported version of Windows! Thos program will run only on Windows 2000, XP or Vista. Exiting Now!"
     
  13. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Download OTM by Old Timer and save it to your Desktop.


    • Right-click OTM.exe And select " Run as administrator " to run it.
    • Paste the following code under the [​IMG] area. Do not include the word Code.


    Code:
    :Processes
    explorer.exe
    :Files
    C:\temp1\npacsy.dll
    C:\temp1\bvmseg.dll
    :Reg
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
    "bvmseg"=-
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
    "npacsy"=-
    :Commands
    [purity]
    [ResetHosts]
    [createrestorepoint]
    [emptytemp]
    [start explorer]
    [Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
    • Push the large [​IMG] button.
    • OTM may ask to reboot the machine. Please do so if asked.
    • Copy everything in the Results window (under the green bar), and paste it in your next reply.


    Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach this log file to your next message.

    NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and attach that document back here in your next post.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below log:

    • C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
  14. cale

    cale Private E-2

    I ran OTM as instructed and it did ask for a reboot which I did. On rebooting the log file in Notepad automatically opened and I have pasted it below:


    All processes killed
    ========== PROCESSES ==========
    No active process named explorer.exe was found!
    ========== FILES ==========
    DllUnregisterServer procedure not found in C:\temp1\npacsy.dll
    C:\temp1\npacsy.dll moved successfully.
    File/Folder C:\temp1\bvmseg.dll not found.
    ========== REGISTRY ==========
    Registry value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run\\bvmseg not found.
    Registry value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run\\npacsy not found.
    ========== COMMANDS ==========
    C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
    HOSTS file reset successfully
    Error creating restore point.

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 27710319 bytes
    ->Google Chrome cache emptied: 8711230 bytes
    ->Flash cache emptied: 611 bytes

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: LogMeInRemoteUser
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 1086 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 35.00 mb


    OTM by OldTimer - Version 3.1.19.0 log created on 06072012_215754

    Files moved on Reboot...

    Registry entries deleted on Reboot...




    On rebooting there was no NOD32 warning about the virus but there was the dll warning (please see the screengrab in my earlier post).

    The PC has been working fine and apart from the warning messages seems ok.

    I have attached the MGlogs.zip
     

    Attached Files:

  15. cale

    cale Private E-2

    Actually, I've noticed the attached warning when I open Firefox (throughout this process I've been using Chrome).

    If I close Firefox and reopen there is no warning but if I open after a reboot there is.

    This doesn't happen with Chrome or IE8
     

    Attached Files:

  16. cale

    cale Private E-2

    Update:

    After a couple of reboots the Firefox problem seems to have ceased.

    However, if you see the attached jpg, there are now two of the dll warnings
     

    Attached Files:

  17. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please attach your logs in the future.

    It is strange that OTM is not finding these items. Let's run it again, with the same fix I gave you in my last post. Attach the new log and a new MGLogs.zip.
     
  18. cale

    cale Private E-2

    Here we go. After OTM asked for reboot the two dll warnings were still there.
     

    Attached Files:

  19. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Well, the tool isn't removing them. Let's try using OTL again and if it still won't remove them, we can try doing it manually.

    Double-click OTL.exe to start the program.

    • Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code

    Code:
    :processes
    :killallprocesses
    :files
    C:\temp1\npacsy.dll
    C:\temp1\bvmseg.dll
    
    :reg
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
    "bvmseg"=-
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
    "npacsy"=-
    
    :commands
    [PURITY]
    [EMPTYTEMP]
    [RESETHOSTS]
    [REBOOT]
    
    
    • Then click the Run Fix button at the top.
    • Click the OK button.
    • OTL may ask to reboot the machine. Please do so if asked.
    • The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:

    • C:\MGlogs.zip
     
  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Fix your boilerplate and this will not happen. :-D You and Kestrel13! are using a boilerplate that asks for the logs to be pasted in. ;)
     
  21. cale

    cale Private E-2

    All done. The 2 dll warnings are still coming up on reboot
     

    Attached Files:

  22. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    The tools are not removing them. Boot into safe mode and find the C:\temp1\npacsy.dll. Manually delete it.

    Then go to start / run / and type:
    regedit

    When that opens, scroll down to :
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run] bvmseg and delete that value.
    Then also find:
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run] npacsy and delete that value.

    Tell me what issues you have with that.
     
  23. cale

    cale Private E-2

    Hi TimW
    I looked for the npacsy.dll in the C:\temp1 folder but it wasn't there.
    So I went onto regedit and deleted the two values as instructed. I've just rebooted (twice to be safe) and the two warning signs have gone.

    It appears that my PC is 'clean'. Many thanks!
     
  24. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good to know.

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.


    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    10. After doing the above, you should work thru the below link:


    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0
     
  25. cale

    cale Private E-2

    Thanks again

    I've followed the final steps as you directed and have kept Malawarebytes and SuperAntiSpyware (also added them to my laptop!)

    Can't thank you enough for your time.
     
  26. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome. Safe surfing. :)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds