Trojan:Win32/Medfos.B
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Ranking: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Ranking: | 591 |
| Threat Level: | 20 % (Normal) |
| Infected Computers: | 81,793 |
| First Seen: | April 17, 2012 |
| Last Seen: | September 20, 2023 |
| OS(es) Affected: | Windows |
The Trojan:Win32/Medfos.B Trojan was first detected in late March of 2012 and constitutes a severe threat to an infected computer system. The main payload of Trojan:Win32/Medfos.B involves taking over the victim's web browser, in particular Internet Explorer and Mozilla Firefox, and redirecting its traffic to particular websites. Trojan:Win32/Medfos.B is a malware infection known as a browser hijacker because of this. Criminals use browser hijackers for a variety of purposes; Trojan:Win32/Medfos.B in particular is used to direct computer users to various pay per click advertising websites. These are basically websites that contain numerous links and advertisements that generate revenue for their creators whenever a particular link or advertisement is linked.Trojan:Win32/Medfos.B is designed to direct computer users to any of the following pay per click advertising web pages: theppcfeed.com, marketingppcfeed.com, googleppcfeed.com, livefeedstream.com, highfeedstream.com, payviaclick.com or ppcstream.com. All of these websites seem to have been set up exclusively to take advantage of browser hijacker infections. If you find that your web browser is directing you to any of these websites over and over again, this is a categorical sign of a Trojan:Win32/Medfos.B Trojan infection. This requires immediate action and removal with a reliable anti-virus application.
How Trojan:Win32/Medfos.B Attacks a Computer System
Trojan:Win32/Medfos.B is installed with other malware in the Medfos family and is present as a Dynamic Link Library, or DLL, file located in the TEMP folder. As part of its installation process, Trojan:Win32/Medfos.B makes changes to the Windows Registry so that it will load the malicious DLL file automatically whenever Windows starts up. The main payload of Trojan:Win32/Medfos.B involves taking over Internet Explorer and Mozilla Firefox. Basically, Trojan:Win32/Medfos.B waits until the victim carries out an online search and then redirects the results to one of the websites listed above.
Trojan:Win32/Medfos.B can cause redirects after the victim entered search terms into a search engine or after entering a web address into the navigation bar. To take over Mozilla Firefox, Trojan:Win32/Medfos.B installs a malicious extension or plug-in for this web browser. This add-on will show up as "Translate This! 2.0" and carries out the same types of redirects as in Internet Explorer. Attempts to remove this add-on through normal means will result in "Translate This! 2.0" being reinstalled automatically or in an application crash. To remove this malicious add-on, Trojan:Win32/Medfos.B must be removed with a reliable anti-malware program.
URLs
Trojan:Win32/Medfos.B may call the following URLs:
| tobaitsie.com |
Submit Comment
Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.