MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Reply
 
Thread Tools Display Modes
  #1  
Old 06-03-12, 07:30
cale cale is offline
Private E-2
 
Join Date: May 2010
Posts: 13
Thanks: 2
Thanked 0 Times in 0 Posts
Default Win32 Medfos.AA trojan

I discovered this problem after a fake antiviral software popped up and told me I had problems. I already had NOD32 running so became suspicious. I ran Malaware bytes which found some problems that I then deleted. I ran a manual scan with NOD32 which found the Medfos (although it hadn't previously spotted it) but can't delete it.
So, I have run the procedure detailed on this forum and am now uploading logs. I have an XP64 bit system so didn't run Combofix or RootRepeal.

So far, there seem to be no symptoms/problems but when I reboot I get the warning from NOD32 about the virus.

I've unplugged 3 back up drives that were attached, one of which was my Dropbox folder.

Thanks for any help.
Attached Files
File Type: log SUPERAntiSpyware Scan Log - 06-03-2012 - 09-52-56.log (575 Bytes, 5 views)
File Type: txt mbam-log-2012-06-03 (13-22-26).txt (1.8 KB, 4 views)
File Type: zip MGlogs.zip (160.8 KB, 8 views)
Reply With Quote
Sponsored links
  #2  
Old 06-03-12, 13:24
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,702
Thanks: 449
Thanked 4,652 Times in 4,391 Posts
Default Re: Win32 Medfos.AA trojan

ComboFix runs on 64bit systems.

What is nod complaining about? The exact message, please.
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #3  
Old 06-04-12, 03:08
cale cale is offline
Private E-2
 
Join Date: May 2010
Posts: 13
Thanks: 2
Thanked 0 Times in 0 Posts
Default Re: Win32 Medfos.AA trojan

Hi Tim
thanks for your reply. I have attached a screen grab of the NOD32 message (and another warning message that appear when I boot up).

If I click on 'Delete' then I get another message saying 'Error while Deleting' and options to either 'Retry' or 'Cancel'. Selecting Retry just brings the message up again and again.
Attached Images
File Type: jpg nod32_warning.jpg (81.7 KB, 7 views)
Reply With Quote
  #4  
Old 06-04-12, 14:26
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,702
Thanks: 449
Thanked 4,652 Times in 4,391 Posts
Default Re: Win32 Medfos.AA trojan

I am not finding a temp1 folder in your logs.
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #5  
Old 06-04-12, 14:46
cale cale is offline
Private E-2
 
Join Date: May 2010
Posts: 13
Thanks: 2
Thanked 0 Times in 0 Posts
Default Re: Win32 Medfos.AA trojan

should I re-run the tests o produce new logs or attach the NOD32 log?
Reply With Quote
Sponsored links
  #6  
Old 06-04-12, 15:57
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,702
Thanks: 449
Thanked 4,652 Times in 4,391 Posts
Default Re: Win32 Medfos.AA trojan

Do a search on your system and try to find what it is reporting: ie the temp1 folder.
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #7  
Old 06-04-12, 21:41
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,439
Thanks: 62
Thanked 7,684 Times in 4,144 Posts
Default Re: Win32 Medfos.AA trojan

Quote:
Originally Posted by TimW View Post
I am not finding a temp1 folder in your logs.
Yes there is. You can see even more too in newfiles.txt
Code:
d-----w                 0 2012-06-03 09:09:37  C:\temp
d-----w                 0 2012-06-03 09:33:26  C:\temp1
d-----w                 0 2011-01-05 17:06:07  C:\temp2

Note that ComboFix does not run on Windows Server 2003
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
  #8  
Old 06-05-12, 03:23
cale cale is offline
Private E-2
 
Join Date: May 2010
Posts: 13
Thanks: 2
Thanked 0 Times in 0 Posts
Default Re: Win32 Medfos.AA trojan

I've looked in the C:\temp1\ folder and can see the file npacsy.dll
Should I try to delete it?

The instructions page that I followed http://forums.majorgeeks.com/showthread.php?t=139313 says that combofix should not be downloaded or run on XP64 systems. If that's not the case any more should I download and run it?
Reply With Quote
  #9  
Old 06-05-12, 14:22
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,702
Thanks: 449
Thanked 4,652 Times in 4,391 Posts
Default Re: Win32 Medfos.AA trojan

I must have missed that when I was looking through the logs. Yes, try to delete everything in that folder.

If you can't manually delete it, then:
Download OTL to your desktop.

Double-click OTL.exe to start the program.
  • Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code

Code:
:processes
:killallprocesses
:file
C:\temp1


:commands
[PURITY]
[EMPTYTEMP]
[RESETHOSTS]
[REBOOT]
  • Then click the Run Fix button at the top.
  • Click the OK button.
  • OTL may ask to reboot the machine. Please do so if asked.
  • The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


Then attach the below logs:
  • C:\MGlogs.zip
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #10  
Old 06-06-12, 01:39
cale cale is offline
Private E-2
 
Join Date: May 2010
Posts: 13
Thanks: 2
Thanked 0 Times in 0 Posts
Default Re: Win32 Medfos.AA trojan

I tried to delete the contents of temp1 but some of the files wouldn't/couldn't be deleted.
I ran OTL and it did ask for a reboot.On reboot I still get the warning from NOD32.
I closed the Notepad log generated by OTL (after copying it) bit couldn't find the 'log form' you describe so I have copied the contents to a new Notepad file which I attach.
Attached Files
File Type: txt OTL_log.txt (1.8 KB, 3 views)
File Type: zip MGlogs.zip (178.2 KB, 5 views)
Reply With Quote
Sponsored links
  #11  
Old 06-06-12, 12:43
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,702
Thanks: 449
Thanked 4,652 Times in 4,391 Posts
Default Re: Win32 Medfos.AA trojan

Odd. Let's try it again. I don't recall if Avenger will work on your system, but let's try:

Now download The Avenger by Swandog46 to your Desktop.

See the download links under this icon
  1. Run avenger.exe by double-clicking on it.
  2. Click OK at the warning to continue to use The Avenger
  3. Do not change any of the check box options!
  4. Shut down your protection software now to avoid possible conflicts.
  5. Copy everything in the Quote box below, and paste it into the Input script here: part of The Avenger
    Quote:
    Files to delete:
    C:\temp1\npacsy.dll
    C:\temp1\bvmseg.dll

    Registry keys to delete:
    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run\bvmseg
    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run\npacsy
  6. Now click the button
  7. Click Yes to the prompt to confirm you want to execute.
  8. Click Yes to the Reboot now? question that will appear when The Avenger finishes running.
  9. Your PC should reboot, if not, reboot it yourself.
  10. A log file from The Avenger will be produced at C:\avenger.txt and it will pop-up for you to view when you login after reboot.
  11. Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )


Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).Make sure that you watch for the license agreement for TrendMicro HijackThis and click on the Accept button TWICE to accept ( yes twice ).

Then attach the below logs:

* C:\Avenger.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #12  
Old 06-06-12, 15:54
cale cale is offline
Private E-2
 
Join Date: May 2010
Posts: 13
Thanks: 2
Thanked 0 Times in 0 Posts
Default Re: Win32 Medfos.AA trojan

Unfortunately I'm getting this: "Fatal Error: unsupported version of Windows! Thos program will run only on Windows 2000, XP or Vista. Exiting Now!"
Reply With Quote
  #13  
Old 06-07-12, 13:49
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,702
Thanks: 449
Thanked 4,652 Times in 4,391 Posts
Default Re: Win32 Medfos.AA trojan

Download OTM by Old Timer and save it to your Desktop.

  • Right-click OTM.exe And select " Run as administrator " to run it.
  • Paste the following code under the area. Do not include the word Code.


Code:
:Processes
explorer.exe
:Files
C:\temp1\npacsy.dll
C:\temp1\bvmseg.dll
:Reg
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"bvmseg"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"npacsy"=-
:Commands
[purity]
[ResetHosts]
[createrestorepoint]
[emptytemp]
[start explorer]
[Reboot]
  • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
  • Push the large button.
  • OTM may ask to reboot the machine. Please do so if asked.
  • Copy everything in the Results window (under the green bar), and paste it in your next reply.


Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach this log file to your next message.

NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and attach that document back here in your next post.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below log:
  • C:\MGlogs.zip

Make sure you tell me how things are working now!
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #14  
Old 06-07-12, 16:13
cale cale is offline
Private E-2
 
Join Date: May 2010
Posts: 13
Thanks: 2
Thanked 0 Times in 0 Posts
Default Re: Win32 Medfos.AA trojan

I ran OTM as instructed and it did ask for a reboot which I did. On rebooting the log file in Notepad automatically opened and I have pasted it below:


All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
DllUnregisterServer procedure not found in C:\temp1\npacsy.dll
C:\temp1\npacsy.dll moved successfully.
File/Folder C:\temp1\bvmseg.dll not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run\\bvmseg not found.
Registry value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run\\npacsy not found.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Error creating restore point.

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 27710319 bytes
->Google Chrome cache emptied: 8711230 bytes
->Flash cache emptied: 611 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LogMeInRemoteUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1086 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 35.00 mb


OTM by OldTimer - Version 3.1.19.0 log created on 06072012_215754

Files moved on Reboot...

Registry entries deleted on Reboot...




On rebooting there was no NOD32 warning about the virus but there was the dll warning (please see the screengrab in my earlier post).

The PC has been working fine and apart from the warning messages seems ok.

I have attached the MGlogs.zip
Attached Files
File Type: zip MGlogs.zip (179.9 KB, 3 views)
Reply With Quote
  #15  
Old 06-07-12, 16:20
cale cale is offline
Private E-2
 
Join Date: May 2010
Posts: 13
Thanks: 2
Thanked 0 Times in 0 Posts
Default Re: Win32 Medfos.AA trojan

Actually, I've noticed the attached warning when I open Firefox (throughout this process I've been using Chrome).

If I close Firefox and reopen there is no warning but if I open after a reboot there is.

This doesn't happen with Chrome or IE8
Attached Images
File Type: jpg nod32_warning_02.jpg (51.9 KB, 3 views)
Reply With Quote
Sponsored links
  #16  
Old 06-07-12, 16:33
cale cale is offline
Private E-2
 
Join Date: May 2010
Posts: 13
Thanks: 2
Thanked 0 Times in 0 Posts
Default Re: Win32 Medfos.AA trojan

Update:

After a couple of reboots the Firefox problem seems to have ceased.

However, if you see the attached jpg, there are now two of the dll warnings
Attached Images
File Type: jpg rundll_warnings.jpg (59.6 KB, 5 views)
Reply With Quote
  #17  
Old 06-08-12, 12:04
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,702
Thanks: 449
Thanked 4,652 Times in 4,391 Posts
Default Re: Win32 Medfos.AA trojan

Please attach your logs in the future.

It is strange that OTM is not finding these items. Let's run it again, with the same fix I gave you in my last post. Attach the new log and a new MGLogs.zip.
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #18  
Old 06-08-12, 12:29
cale cale is offline
Private E-2
 
Join Date: May 2010
Posts: 13
Thanks: 2
Thanked 0 Times in 0 Posts
Default Re: Win32 Medfos.AA trojan

Here we go. After OTM asked for reboot the two dll warnings were still there.
Attached Files
File Type: log 06082012_181824.log (4.0 KB, 2 views)
File Type: zip MGlogs.zip (181.7 KB, 1 views)
Reply With Quote
  #19  
Old 06-08-12, 14:27
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,702
Thanks: 449
Thanked 4,652 Times in 4,391 Posts
Default Re: Win32 Medfos.AA trojan

Well, the tool isn't removing them. Let's try using OTL again and if it still won't remove them, we can try doing it manually.

Double-click OTL.exe to start the program.
  • Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code

Code:
:processes
:killallprocesses
:files
C:\temp1\npacsy.dll
C:\temp1\bvmseg.dll

:reg
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"bvmseg"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"npacsy"=-

:commands
[PURITY]
[EMPTYTEMP]
[RESETHOSTS]
[REBOOT]
  • Then click the Run Fix button at the top.
  • Click the OK button.
  • OTL may ask to reboot the machine. Please do so if asked.
  • The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


Then attach the below logs:
  • C:\MGlogs.zip
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #20  
Old 06-08-12, 20:41
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,439
Thanks: 62
Thanked 7,684 Times in 4,144 Posts
Default Re: Win32 Medfos.AA trojan

Quote:
Originally Posted by TimW View Post
Please attach your logs in the future.
Fix your boilerplate and this will not happen. You and Kestrel13! are using a boilerplate that asks for the logs to be pasted in.
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
Sponsored links
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
win32/olmarik.ajl trojan and trojan:dos/alureon a ktaz Malware Removal 5 03-21-11 16:46
Trojan-Downloader.Win32.Small.ivp and Trojan-PWS.tanspy jaimej78 Malware Removal 16 08-16-08 15:32
Trojan.Klone.H, Win32:Dialer-gen13 or Trojan.Downloader.Small.CML lanche Malware Removal 11 11-07-06 22:21
New Trojan Trojan-Downloader.Win32.Agent.cf alonge Malware Removal 3 05-03-05 00:16
win32/trojan downloader.ISTbar.EN trojan; win32/trojan dropper.bridge.A trojan vlatko27 Software 1 05-27-04 08:40


All times are GMT -5. The time now is 08:48.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


All content Copyright MajorGeeks.com source code Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger