About “Trojan:WinNT/Mediyes.A” infection

The Trojan:WinNT/Mediyes.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:WinNT/Mediyes.A virus can do?

The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Trojan:WinNT/Mediyes.A?


File Info:
name: C7C7580993A7CB7940EF.mlw
path: /opt/CAPEv2/storage/binaries/79cfb49504a9ea4e5415ca9bb7fe21b7b665556a4ca9e8d88da8877450b09fb6
crc32: 20533B9C
md5: c7c7580993a7cb7940efcf5a58846d1e
sha1: d616ead402cd237e342201f7d9d8066d6a21e15d
sha256: 79cfb49504a9ea4e5415ca9bb7fe21b7b665556a4ca9e8d88da8877450b09fb6
sha512: 8496b51cb60c8fcb1d51fd6ded820d7962677dba2c69f196671267307daa2cc0ea0f27c0145fb04fb52f9de404b45fa35de19365af256031c40ed43ac641f332
ssdeep: 12288:MT+yZ2o9TMZpR27zPfrKCYymuT6kZcylAmhhXKA1deaXcYno4u:aDr9TMZpR27zPDKCzX6kZt3XKA1Malm
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T121C402117E47C173F19E813E88D0CBA89BBE6A1267B6E0D7F76827061C242D026743DB
sha3_384: 6f81eb37c95c5d636a3cc0e2d1c0469981d70fde53169e9b37bfae91f7adb1067b041845b5be1c198dc4d4b21ec906e3
ep_bytes: 837c2408017505e8e4300000ff742404
timestamp: 2010-04-16 07:15:45

Version Info:
FileDescription: supdate Dynamic Link Library
FileVersion: 1, 0, 0, 1
InternalName: supdate
LegalCopyright: Copyright (C) 2008
OriginalFilename: supdate.dll
ProductName: supdate Dynamic Link Library
ProductVersion: 1, 0, 0, 1
Translation: 0x0409 0x04b0

Trojan:WinNT/Mediyes.A also known as:

Bkav	W32.Common.34D9F1A0
Lionic	Trojan.Win32.Mediyes.5!c
DrWeb	Trojan.Mediyes.62
MicroWorld-eScan	Gen:Variant.Tedy.529673
FireEye	Generic.mg.c7c7580993a7cb79
Skyhigh	BehavesLike.Win32.Generic.hc
McAfee	Artemis!C7C7580993A7
Zillya	Trojan.Generic.Win32.1047947
Sangfor	Rootkit.Win32.Mediyes.V24v
Alibaba	Rootkit:Win32/Mediyes.06529d6f
CrowdStrike	win/malicious_confidence_60% (W)
Symantec	Hacktool.Rootkit
ESET-NOD32	a variant of Generik.GRNXSCL
TrendMicro-HouseCall	TROJ_GEN.R002C0DB124
Kaspersky	Rootkit.Win32.Mediyes.pel
BitDefender	Gen:Variant.Tedy.529673
NANO-Antivirus	Trojan.Win32.MlwGen.lialx
Avast	Win32:Mediyes-H [Trj]
Tencent	Win32.Rootkit.Mediyes.Rqil
Emsisoft	Gen:Variant.Tedy.529673 (B)
F-Secure	Trojan.TR/PWS.Sinowal.Gen
VIPRE	Trojan.GenericKD.71459804
TrendMicro	TROJ_GEN.R002C0DB124
Sophos	Mal/Generic-S
Ikarus	Trojan-Spy.Sinowal
MAX	malware (ai score=100)
Jiangmin	Rootkit.Mediyes.aj
Google	Detected
Avira	TR/PWS.Sinowal.Gen
Kingsoft	malware.kb.a.961
Microsoft	Trojan:WinNT/Mediyes.A
Xcitium	Malware@#20bwu5kmqptra
Arcabit	Trojan.Tedy.D81509
ZoneAlarm	Rootkit.Win32.Mediyes.pel
GData	Gen:Variant.Tedy.529673
Cynet	Malicious (score: 99)
VBA32	BScope.Trojan.Mediyes
ALYac	Trojan.GenericKD.71459804
Cylance	unsafe
Rising	Trojan.Mediyes!8.BCB (TFE:5:BQTp0GlVREP)
Yandex	Trojan.Agent!NxHNTzecqzA
Fortinet	W32/Dx.WDK!tr
AVG	Win32:Mediyes-H [Trj]
DeepInstinct	MALICIOUS
alibabacloud	Rootkit:Win/Mediyes.pel

How to remove Trojan:WinNT/Mediyes.A?

Trojan:WinNT/Mediyes.A removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X