Jump to content

Win32:Delf-GD [Trj] Please help!

xexys

By xexys
in Resolved Malware Removal Logs

 Share

Recommended Posts

xexys

xexys

Posted
Posted

So avast keeps detecting a file named "Win32:Delf-gd [Trj]"

When it detects it I put it in the virus chest, but if I run another scan after that it detects it again.

The file seems to be duplicating itself and I cant get rid of it.

I've run multiple full scans with Malwarebytes but it doesn't detect anything. Though, I found where the virus is duplicating itself. So I scanned the folder of where the virus is located on Virustotal:https://www.virustot...sis/1342656751/

Avast seems to be the only one detecting this.

Could this be a false positive or am I actually infected?

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Welcome to the forum, please start at the link below:

http://forums.malwar...?showtopic=9573

Post back the 2 logs.....DDS.txt and Attach.txt

<====><====><====><====><====><====><====><====>

Next.......

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Please go to your control panels add/remove programs and uninstall all of these:

Anti-phishing Domain Advisor

Ask Toolbar

Ask Toolbar Updater

Spam Free Search Bar

Fantapper Player

Fantapper Updater

------------------------------------------

Reboot and .....

Please download OTL from one of the links below:

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com (<---renamed version)

Save it to your desktop.

Double click on the icon on your desktop.

Click the Scan All Users checkbox.

Push the Quick Scan button.

The scan will take about 10 minutes...depends on your hard drive size.

Two reports will open, copy and paste them in a reply here: (or attach them as .txt files)

OTL.txt <-- Will be opened

Extra.txt <-- Will be minimized

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Using OTL....Please do this:

Run OTL

  • Under the Custom Scans/Fixes box at the bottom, paste in the following 

    :OTL
    IE - HKU\S-1-5-21-1420321240-3689312425-3269942117-1000\..\URLSearchHook: {687578b9-7132-4a7a-80e4-30ee31099e03} - No CLSID value found
    IE - HKU\S-1-5-21-1420321240-3689312425-3269942117-1000\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = http://blekko.com/?source=c3348dd4&tbp=rbox&toolbarid=blekkotb&u=2012022162D940498435C9467BF5A315&q={searchTerms}
    O2:[b]64bit:[/b] - BHO: (Privacy Safeguard BHO) - {1036AD63-AEAC-460B-9060-C96005D4DC86} - C:\Program Files\PrivacySafeGuard\PrivacySafeGuard-x64.dll File not found
    O2:[b]64bit:[/b] - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found.
    O2:[b]64bit:[/b] - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
    O2 - BHO: (no name) - {1036AD63-AEAC-460B-9060-C96005D4DC86} - No CLSID value found.
    O3 - HKU\S-1-5-21-1420321240-3689312425-3269942117-1000\..\Toolbar\WebBrowser: (no name) - {687578B9-7132-4A7A-80E4-30EE31099E03} - No CLSID value found.
    O3 - HKU\S-1-5-21-1420321240-3689312425-3269942117-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
    O3 - HKU\S-1-5-21-1420321240-3689312425-3269942117-1000\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
    O4 - HKU\S-1-5-21-1420321240-3689312425-3269942117-1000..\Run: [AdobeBridge]  File not found
    O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
    O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
    [2012/07/19 01:50:35 | 002,920,410 | ---- | M] () -- C:\Users\admin\Desktop\blekkotb.rar

    :Files
    C:\Users\admin\AppData\Local\Temp\XTMP1MC3VE
    :Commands
    [EMPTYJAVA]
    [emptytemp]


  • Then click the Run Fix button at the top
  • Let the program run unhindered, when done it will say "Fix Complete press ok to open the log"
  • Please post that log in your next reply. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

MrC

Link to post
Share on other sites
xexys

xexys

Posted
  • Author
Posted

Hopefully I did this right. Though the log file appeared on my desktop named "desktop.ini" and there are two files of it.

I had to forcefully shutdown my system and boot it back up because a little after I had clicked Run Fix I got a message saying "Windows had encountered a critical problem and will restart in one minute". I waited awhile and nothing happened and OTL had froze.

But hopefully this is what you're looking for:

[.ShellClassInfo]

LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21799

[LocalizedFileNames]

Enable 3D Vision Discover.lnk=@%ProgramFiles(x86)%\NVIDIA Corporation\3D Vision\nvstlink.exe,-2001

Disable 3D Vision Discover.lnk=@%ProgramFiles(x86)%\NVIDIA Corporation\3D Vision\nvstlink.exe,-2002

Enable 3D Vision.lnk=@%ProgramFiles(x86)%\NVIDIA Corporation\3D Vision\nvstlink.exe,-2004

Disable 3D Vision.lnk=@%ProgramFiles(x86)%\NVIDIA Corporation\3D Vision\nvstlink.exe,-2005

Enable Windowed Mode.lnk=@%ProgramFiles(x86)%\NVIDIA Corporation\3D Vision\nvstlink.exe,-2009

Disable Windowed Mode.lnk=@%ProgramFiles(x86)%\NVIDIA Corporation\3D Vision\nvstlink.exe,-2010

Enable Stereoscopic Desktop.lnk=@%ProgramFiles(x86)%\NVIDIA Corporation\3D Vision\nvstlink.exe,-2011

Disable Stereoscopic Desktop.lnk=@%ProgramFiles(x86)%\NVIDIA Corporation\3D Vision\nvstlink.exe,-2012

3D Vision Photo Viewer.lnk=@%ProgramFiles(x86)%\NVIDIA Corporation\3D Vision\nvstlink.exe,-2003

NVIDIA Stereoscopic 3D Video Player.lnk=@%ProgramFiles(x86)%\NVIDIA Corporation\3D Vision\nvstlink.exe,-2006

3D Vision preview pack 1.lnk=@%ProgramFiles(x86)%\NVIDIA Corporation\3D Vision\nvstlink.exe,-2008

Set up 3D Vision.lnk=@%ProgramFiles(x86)%\NVIDIA Corporation\3D Vision\nvstlink.exe,-2013

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

That's not it and I don't know where that came from.

Here's the script again in blue, carefully copy and paste it in:

:OTL

IE - HKU\S-1-5-21-1420321240-3689312425-3269942117-1000\..\URLSearchHook: {687578b9-7132-4a7a-80e4-30ee31099e03} - No CLSID value found

IE - HKU\S-1-5-21-1420321240-3689312425-3269942117-1000\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = http://blekko.com/?s...q={searchTerms}

O2:64bit: - BHO: (Privacy Safeguard BHO) - {1036AD63-AEAC-460B-9060-C96005D4DC86} - C:\Program Files\PrivacySafeGuard\PrivacySafeGuard-x64.dll File not found

O2:64bit: - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found.

O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found

O2 - BHO: (no name) - {1036AD63-AEAC-460B-9060-C96005D4DC86} - No CLSID value found.

O3 - HKU\S-1-5-21-1420321240-3689312425-3269942117-1000\..\Toolbar\WebBrowser: (no name) - {687578B9-7132-4A7A-80E4-30EE31099E03} - No CLSID value found.

O3 - HKU\S-1-5-21-1420321240-3689312425-3269942117-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.

O3 - HKU\S-1-5-21-1420321240-3689312425-3269942117-1000\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.

O4 - HKU\S-1-5-21-1420321240-3689312425-3269942117-1000..\Run: [AdobeBridge] File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

[2012/07/19 01:50:35 | 002,920,410 | ---- | M] () -- C:\Users\admin\Desktop\blekkotb.rar

:Files

C:\Users\admin\AppData\Local\Temp\XTMP1MC3VE

Let me know, MrC

Link to post
Share on other sites
xexys

xexys

Posted
  • Author
Posted

It worked this time.

Heres the log:

========== OTL ==========

Registry value HKEY_USERS\S-1-5-21-1420321240-3689312425-3269942117-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{687578b9-7132-4a7a-80e4-30ee31099e03} not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{687578b9-7132-4a7a-80e4-30ee31099e03}\ not found.

Registry key HKEY_USERS\S-1-5-21-1420321240-3689312425-3269942117-1000\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1036AD63-AEAC-460B-9060-C96005D4DC86}\ deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1036AD63-AEAC-460B-9060-C96005D4DC86}\ deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\ deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1036AD63-AEAC-460B-9060-C96005D4DC86}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1036AD63-AEAC-460B-9060-C96005D4DC86}\ not found.

Registry value HKEY_USERS\S-1-5-21-1420321240-3689312425-3269942117-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{687578B9-7132-4A7A-80E4-30EE31099E03} not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{687578B9-7132-4A7A-80E4-30EE31099E03}\ not found.

Registry value HKEY_USERS\S-1-5-21-1420321240-3689312425-3269942117-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.

Registry value HKEY_USERS\S-1-5-21-1420321240-3689312425-3269942117-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}\ not found.

Registry value HKEY_USERS\S-1-5-21-1420321240-3689312425-3269942117-1000\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge not found.

64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.

File C:\Users\admin\Desktop\blekkotb.rar not found.

========== FILES ==========

C:\Users\admin\AppData\Local\Temp\XTMP1MC3VE folder moved successfully.

OTL by OldTimer - Version 3.2.54.0 log created on 07192012_131252

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

That looks better.....next,

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Link to post
Share on other sites
xexys

xexys

Posted
  • Author
Posted

Updated and ran a quick scan with MBAM

The log:

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org

Database version: v2012.07.19.11

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

admin :: HUGE_ASUS [administrator]

Protection: Enabled

7/19/2012 2:09:03 PM

mbam-log-2012-07-19 (14-09-03).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 213323

Time elapsed: 2 minute(s), 55 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

My computer looks to be running fine. Am I fully clean now?

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Yes, Looks Good thumbsup.gif

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

cf2.jpg

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

---------------------------------

Please download OTL from one of the links below: (you may already have OTL on the system)

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, etc....

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

Link to post
Share on other sites
LDTate

LDTate

Posted
Posted

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.