Follow:

 

Win32/Medfos


Microsoft security software detects and removes this family of threats. 

These threats install malicious Internet browser extensions and redirect your search results. This means that if you search using Google, Bing, or Yahoo, for example, the site returns normal search results. However, if you click on any of the results, instead of going to the correct website, you might be redirected to a different website.

These threats can also be used for click-fraud.

Variants of Win32/Medfos can be installed by other malware, including variants of the Trojan:Win32/Necurs family.

Find out ways that malware can get on your PC.

 



What to do now

Use the following free Microsoft software to detect and remove this threat:

You should also run a full scan. A full scan might find other, hidden malware.

Remove browser add-ons

You may need to remove add-ons from your browser:

You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.

If you’re using Windows XP, see our Windows XP end of support page.

Threat behavior

Installation

The main component (DLL file)

When run, variants of Win32/Medfos copy themselves as a DLL file with a random name to the %APPDATA% folder. In the wild we have observed variants using the following file names:

If you are logged on as an administrator, Win32/Medfos modifies the following registry entry so that it runs each time you start your PC:

In subkey: HKLM\Software\Microsoft\Windows\Currentversion\Run
Sets value: "<name of DLL file, without the extension>", for example "pcpat"
With data: "rundll32.exe <name of DLL file>,<random export name>", for example "rundll32.exe pcpat.dll,AInputStream"

If you are not logged on as an administrator, the malware modifies the following registry entry so that it runs each time you start your PC:

In subkey: HKCU\Software\Microsoft\Windows\Currentversion\Run
Sets value: "<name of DLL file, without the extension>", for example "pcpat"
With data: "rundll32.exe <name of DLL file>,<random export name>", for example "rundll32.exe pcpat.dll,AInputStream"

Once it has installed itself on your PC, it connects to "78.140.131.158" to report the infection.

The payload files (search redirection components)

The malware can download and run a DLL file from "78.140.131.158" with a random name to the %TEMP% folder, for example %TEMP%\bdylut.dll.

This file is detected as Trojan:Win32/Medfos.B, which is the search-engine redirection component of the Win32/Medfos family.

If you are logged on as an administrator, Win32/Medfos modifies the following registry entry so that it runs each time you start your PC:

In subkey: HKLM\Software\Microsoft\Windows\Currentversion\Run
Sets value: "<name of DLL file>", for example "bdylut"
With data: "rundll32.exe %TEMP%\<downloaded file>,<random export name>", for example "rundll32.exe C:\Users\<user name>\AppData\Local\Temp\bdylut.dll,ExceptionMatches"

If you are not logged on as an administrator, the malware modifies the following registry entry so that it runs each time you start your PC::

In subkey: HKCU\Software\Microsoft\Windows\Currentversion\Run
Sets value: "<name of DLL file>", for example "bdylut"
With data: "rundll32.exe %TEMP%\<downloaded file>,<random export name>", for example "rundll32.exe C:\Users\<user name>\AppData\Local\Temp\bdylut.dll,ExceptionMatches

The malware injects the downloaded file into Internet Explorer processes to enable its Internet search-redirection payload.

Win32/Medfos may install a search-engine hijack extension for Mozilla Firefox. This extension is also part of Trojan:Win32/Medfos.B, and may be detected as Trojan:JS/Medfos.A.

The extension is installed as %LOCALAPPDATA%\{<random unique identifier>}\chrome\content\browser.xul, for example %LOCALAPPDATA%\{535C840F-E52A-11E1-8270-B8AC6F996F26}\chrome\content\browser.xul.

In the wild we have observed the Firefox extension with the following names:

  • Mozilla Safe Browsing 2.0.14
  • Traqnslate This! 2.0

It also installs an extension for Google Chrome as %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\cdjbnddbclciabnckgeahmneohjlahdm.

This file is detected as Trojan:JS/Medfos.B and can have the name ChromeUpdateManager:

Payload

Redirects Internet search results

Win32/Medfos monitors the searches you make with the following search engines:

  • AOL
  • Ask
  • Bing
  • Google
  • Yahoo

The malware sends your search queries and their results to a remote server.

We have observed variants of Win32/Medfos connecting to the following remote servers:

  • 85.17.132.53
  • 4.clickfeedbestppc.com

When you click the search result, the malware redirects you to a URL that it has retrieved from the remote server.

You could be redirected to advertisements or to the actual search result. In the wild, we observed that search results were redirected to "googleads.l.doubleeclick.net".

Generates click fraud

Win32/Medfos , specifically, Trojan:Win32/Medfos.X, creates a hidden iexplore.exe process to connect to the server at "46.165.221.199".

Once connected, it gets HTML data that generates hidden clicks to a specified website. This is to generate clicks for the website, which may result in profit for the site owner.

Related encyclopedia entries

Blacole exploit kit

TrojanDownloader:Win32/Beebone

Win32/Sirefef

Trojan:Win32/Medfos.B

Trojan:JS/Medfos.A

Trojan:JS/Medfos.B

Analysis by Shawn Wang


Symptoms

System changes

The following system changes may indicate the presence of this malware:

  • Internet search results may redirect you to websites you did not intend to visit
  • The presence of the following files:
     
    %APPDATA%\pcpat.dll
    %APPDATA%\tpleto.dll
    %LOCALAPPDATA%\{535C840F-E52A-11E1-8270-B8AC6F996F26}\chrome\content\browser.xul
    %TEMP%\bdylut.dll
     
  • The presence of the following registry modifications:

    In subkey: HKLM\Software\Microsoft\Windows\Currentversion\Run
    Sets value: "<name of DLL file, without the extension>", for example "pcpat"
    With data: "rundll32.exe <name of DLL file>,<random export name>", for example "rundll32.exe pcpat.dll,AInputStream"

    In subkey: HKCU\Software\Microsoft\Windows\Currentversion\Run
    Sets value: "<name of DLL file, without the extension>", for example "pcpat"
    With data: "rundll32.exe <name of DLL file>,<random export name>", for example "rundll32.exe pcpat.dll,AInputStream"

    In subkey: HKLM\Software\Microsoft\Windows\Currentversion\Run
    Sets value: "<name of DLL file, without the extension>", for example "bdylut"
    With data: "rundll32.exe %TEMP%\<downloaded file>,<random export name>", for example "rundll32.exe C:Windows\TempXXXXX\bdylut.dll,ExceptionMatches"

    In subkey: HKCU\Software\Microsoft\Windows\Currentversion\Run
    Sets value: "<name of DLL file, without the extension>", for example "bdylut"
    With data: "rundll32.exe %TEMP%\<downloaded file>,<random export name>", for example "rundll32.exe C:Windows\TempXXXXX\bdylut.dll,ExceptionMatches"
 

Prevention


Alert level: Severe
This entry was first published on: Sep 07, 2012
This entry was updated on: Aug 21, 2014

This threat is also detected as:
  • TR/Midhos (Avira)
  • Trojan.Win32.Midhos (Kaspersky)
  • Win32/Medfos (ESET)
  • Medfos (McAfee)
  • Trojan/Win32.Midhos (AhnLab)
  • Trojan.Win32.Medfos (Ikarus)