Infected With Trojan.win32.delf.amk

Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

BleepingComputer.com > Security > HijackThis Logs and Virus/Trojan/Spyware/Malware Removal

Forum Guidelines

Read this topic before posting a log.

DO NOT post a ComboFix log unless requested to.

Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.

When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.

Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.

Infected With Trojan.win32.delf.amk, Do not know how to remove it.

Options

Billy O'Neal View Member Profile	Jun 19 2008, 09:22 AM Post #2
Look buddy -- I'm an Engineer Group: HJT Team Coach Posts: 8,602 Joined: 17-January 08 From: Northfield, Ohio Member No.: 184,215	Hello mammal. to BleepingComputer.com My name is Billy O'Neal and I will be helping you. (Billy or Bill is fine, if you like.) Please give me some time to look over your computer's log(s). Please take note of the following: In the meantime, please refrain from making any changes to your computer. Also, even if things appear to be running better, there is no guarantee that everything is finished. Please continue to check this forum post in order to ensure we get your system completely clean. We do not want to clean you part-way up, only to have the system re-infect itself. If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken. Finally, please reply using the button in the lower left hand corner of your screen. See you soon, Billy3 -------------------- The forum is always a busy place. In the event I fail to reply within twenty-four hours, feel free to send me a PM. Have I helped you? If so, please consider a donation (by clicking this link). And that means I solve problems. Not problems like "What is beauty?" .. 'cause that would fall under the purview of your conundrums of philosophy....

Billy O'Neal View Member Profile	Jun 21 2008, 11:29 AM Post #3
Look buddy -- I'm an Engineer Group: HJT Team Coach Posts: 8,602 Joined: 17-January 08 From: Northfield, Ohio Member No.: 184,215	Hello, mammal Your system is infected with a Flash Drive infector Warning: Any flash / jump drives you have connected to this system since your infection have been compromised by a flash drive infector. We are going to run a tool as part of the following fix which will disinfect your machine, as well as clean any flash drives connected to the system. It is advised you connect any flash drives that have been connected to this machine during this time frame to this system for the following fix, in order to disinfect them. Please let owners of other machines to which you have connected any flash media or drives that their machines may now be infected. You have the WareOut infection. Please follow these steps to remove it: Please download FixWareout from one of these mirrors, and save it to your desktop: Mirror 1 Mirror A Double click on the downloaded file. Click Next, then Install, make sure "Run fixit" is checked and click Finish. The fix will begin; Please follow the on screen instuctions. Then you will be asked to reboot your computer; please do so. Note: Your system may take longer than usual to load; this is normal. Once the desktop loads please post the text that will open (report.txt) and a new Hijackthis log. We need to remove the Flash Drive infector Please download Flash_Disinfector.exe by sUBs and save it to your desktop. Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear. The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well. Wait until it has finished scanning and then exit the program. Reboot your computer when done. Note: Flash_Disinfector will create a hidden file named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder. It will help protect your drives from future infection. We need to move some files.. Please download the OTMoveIt2 by OldTimer. Save it to your desktop. Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator). Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): CODE BOCDRIVE <delete service> Profos <delete service> Trufos <delete service> Ravsvrs <delete service> Windows Networks <delete service> HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wineil32 F:\ntde1ect.com Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the yellow bar) and choose Paste. Click the red Moveit! button. Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply. Close OTMoveIt2 Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter .log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles* folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post. In your next reply, please make sure the following reports are present: The FixWareOut report The OTMoveIt2 report A new DSS Main.txt (In the event you lost your copy, you can download a new one from here: Deckard's System Scanner) Good luck, Billy3 -------------------- The forum is always a busy place. In the event I fail to reply within twenty-four hours, feel free to send me a PM. Have I helped you? If so, please consider a donation (by clicking this link). And that means I solve problems. Not problems like "What is beauty?" .. 'cause that would fall under the purview of your conundrums of philosophy....

Billy O'Neal View Member Profile	Jun 21 2008, 06:20 PM Post #5
Look buddy -- I'm an Engineer Group: HJT Team Coach Posts: 8,602 Joined: 17-January 08 From: Northfield, Ohio Member No.: 184,215	Is your internet service provider "Uganda Telecom"? Billy3 -------------------- The forum is always a busy place. In the event I fail to reply within twenty-four hours, feel free to send me a PM. Have I helped you? If so, please consider a donation (by clicking this link). And that means I solve problems. Not problems like "What is beauty?" .. 'cause that would fall under the purview of your conundrums of philosophy....

mammal View Member Profile	Jun 22 2008, 04:27 AM Post #6
Member Group: Members Posts: 19 Joined: 21-March 07 Member No.: 118,853	Yes Billy, it is Uganda Telecom. Is there any particular reason why you are asking? I'm just curious. Thanks for the help so far, I am beginning to realize changes and I know I am not imagining them. :-)

Billy O'Neal View Member Profile	Jun 22 2008, 09:42 AM Post #7
Look buddy -- I'm an Engineer Group: HJT Team Coach Posts: 8,602 Joined: 17-January 08 From: Northfield, Ohio Member No.: 184,215	Hello, Mammal. That got most of it, but there are still some leftovers to cleanup . QUOTE Is there any particular reason why you are asking? I'm just curious. Yes Take this line: O17 - HKLM\System\CCS\Services\Tcpip\..\{0BADDEC2-6297-4A30-A777-DC2FC188A108}: NameServer = 81.199.21.94,81.199.31.33 Note the two IP Addresses on the end. If I put 81.199.21.94, for example, into a whois service (such as http://whois.domaintools.com/) it gives information about who owns that IP. Because this forum operates in the United States, most of our members are from the States. The company/servers pointed to by that line should be located (within reason) near where you live, because those services are generally provided by your ISP. Some types of malware change this value to their private servers in order to redirect your internet pages . So when I saw one as far away as Urganda, I had to verify it wasn't some malware writer trying to hijack you. I hope that answers your question.... if it was confusing let me know We need to move some files Please download the OTMoveIt2 by OldTimer. Save it to your desktop. Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator). Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): CODE HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2cdeeedb-5dfe-11dc-9e03-00123fec166e} HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{32a8f637-992f-11dc-9eaf-00123fec166e} HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3783971a-04db-11db-be24-00123fec166e} HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3783971c-04db-11db-be24-00123fec166e} HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3783971d-04db-11db-be24-00123fec166e} HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6deb68bc-75a6-11dc-9e2c-00123fec166e} HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7918313e-50eb-11dc-9df8-00123fec166e} Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the yellow bar) and choose Paste. Click the red Moveit! button. Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply. Close OTMoveIt2 Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter .log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles* folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post. It appears that your FSecure Firewall is disabled. Please re-enable it! It appears your FSecure Anti-Virus is out of date. Please update it! Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update: Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop. Scroll down to where it says "Java Runtime Environment (JRE)6 Update 6...allows end-users to run Java applications". Click the "Download" button to the right. Select your Platform: "Windows". Select your Language: "English". Read the License Agreement, and then check the box that says: "Accept License Agreement". Click Continue and the page will refresh. Click on the link to download Windows Offline Installation and save the file to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java. Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Follow the onscreen instructions for the Java uninstaller. Repeat as many times as necessary to remove each Java version. Reboot your computer once all Java components are removed. Then from your desktop double-click on jre-6u6-windows-i586-p.exe Follow the on screen instructions to install the latest Java version. I would like to check our work. Please go to ESET OnlineScan (NOD32) You will then see the Terms of Use, tick the check-box infront of YES, I accept the Terms of Use Now click Start Should you face a Security Warning that asks if you want to install and run a file called "OnlineScanner.cab", click Yes Click Start Note: (the Onlinescanner will now prepare itself for running on your pc) To do a full-scan, tick: "Remove found threats" and "Scan potentially unwanted applications" Press Scan The Onlinescan will now start and scan your pc (this could take a while) When the scan has finished, it will show a screen with two tabs "overview" and "details" and the option to get information or buy software, just close the window Click Start >> Run... >> type: C:\Program Files\EsetOnlineScanner\log.txt The Scanresults will now open in Notepad Click into the text area, right-click and chose "select all" (or use <Control>+A) Right-click again and chose "Copy" (or <Control>+C) Close/Exit Notepad Navigate to this thread and post your log along with anything else requested from us, by right-clicking and "paste" (or ctrl+v) in the text area of the reply post you just created. Note: For Vista Users: Eset is compatible but Internet Explorer must be run as Administrator. To do this, right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select "Run as Administrator" from the context menu.) In your next reply, please make sure the following reports are present: OTMoveIt2's log ESET's log A new DSS Main.txt (In the event you lost your copy, you can download a new one from here: Deckard's System Scanner) Good luck, Billy3 -------------------- The forum is always a busy place. In the event I fail to reply within twenty-four hours, feel free to send me a PM. Have I helped you? If so, please consider a donation (by clicking this link). And that means I solve problems. Not problems like "What is beauty?" .. 'cause that would fall under the purview of your conundrums of philosophy....

Billy O'Neal View Member Profile	Jun 24 2008, 08:44 PM Post #9
Look buddy -- I'm an Engineer Group: HJT Team Coach Posts: 8,602 Joined: 17-January 08 From: Northfield, Ohio Member No.: 184,215	Hello, mammal Please run Deckard's System Scanner again, this time using these instructions: (In the event you lost your copy, you can download a new one from here: Deckard's System Scanner) Click on Start, click on Run Copy and paste the following in the open window and then click OK: CODE "%userprofile%\desktop\dss.exe" /config This will open up DSS configuration Click on Check All. Click Scan. DSS will now run again. Please post back both logs that open in notepad. Main.txt and Extra.txt Billy3 -------------------- The forum is always a busy place. In the event I fail to reply within twenty-four hours, feel free to send me a PM. Have I helped you? If so, please consider a donation (by clicking this link). And that means I solve problems. Not problems like "What is beauty?" .. 'cause that would fall under the purview of your conundrums of philosophy....

Billy O'Neal View Member Profile	Jun 25 2008, 12:23 PM Post #11
Look buddy -- I'm an Engineer Group: HJT Team Coach Posts: 8,602 Joined: 17-January 08 From: Northfield, Ohio Member No.: 184,215	Hello, Mammal We need to remove ComboFix Click START then RUN Now type or copy Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there. Please do an online scan with Kaspersky WebScanner. Please visit the Kaspersky Online Scanner website. Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan. Click on the Accept button and install any components it needs. The program will install and then begin downloading the latest definition files. After the files have been downloaded on the left side of the page in the Scan section select My Computer This will start the program and scan your system. The scan will take a while, so be patient and let it run. Once the scan is complete, click on View scan report Now, click on the Save Report as button. Save the file to your desktop. Copy and paste that information in your next post. Billy3 -------------------- The forum is always a busy place. In the event I fail to reply within twenty-four hours, feel free to send me a PM. Have I helped you? If so, please consider a donation (by clicking this link). And that means I solve problems. Not problems like "What is beauty?" .. 'cause that would fall under the purview of your conundrums of philosophy....

mammal View Member Profile	Jun 28 2008, 03:56 AM Post #12
Member Group: Members Posts: 19 Joined: 21-March 07 Member No.: 118,853	Hello Billy, Windows could not find Combofix on my computer and I typed the command correctly. Afetr the long scan, no viruses were found. I have pasted the log below: KASPERSKY ONLINE SCANNER 7 REPORT Saturday, June 28, 2008 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Friday, June 27, 2008 15:39:33 Records in database: 890203 Scan settings Scan using the following database extended Scan archives yes Scan mail databases yes Scan area My Computer C:\ D:\ E:\ F:\ G:\ H:\ Scan statistics Files scanned 102899 Threat name 0 Infected objects 0 Suspicious objects 0 Duration of the scan 02:28:45 No malware has been detected. The scan area is clean. The selected area was scanned. Thanks.

Billy O'Neal View Member Profile	Jun 28 2008, 09:15 AM Post #13
Look buddy -- I'm an Engineer Group: HJT Team Coach Posts: 8,602 Joined: 17-January 08 From: Northfield, Ohio Member No.: 184,215	Mammal, you now appear to be clean. Congratulations! Your AV is disabled. Please reenable it. You should remove this from Add/Remove Programs: Java 2 Runtime Environment, SE v1.4.2_03 We need to clean up our tools. Please download OTMoveIt2 by OldTimer and save it to your desktop. Click the Clean Up button. Accept any prompts. This will remove any tools we used, including OTMoveIt, and will require a reboot. Please take the time to tell us what you would like to be done about the people who are behind all the problems you have had. We can only get something done about this if the people that we help, like you, are prepared to complain. We have a dedicated forum for collecting these complaints: Malware Complaints. Just find your country room and register your complaint. The infections you had were "flash drive infectors." Below are some steps to follow in order to dramatically lower the chances of reinfection. You may have already implemented some of the steps below, however you should follow any steps that you have not already implemented. Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state. IF YOU USE WINDOWS XP: You can view a video of the following instructions. Go to Start > Programs > Accessories > System Tools and click "System Restore". Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore. Then go to Start > Run and type: Cleanmgr Click "OK". Click the "More Options" Tab. Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one. Note: You should only do this once! IF YOU USE WINDOWS VISTA: Go to Start -> Control Panel -> System and Maintenance -> System. Select "System Protection" in the upper left hand corner. Click the button marked "Create" in the bottom of the window. Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore. Open Vista's Searchbox (on your start menu) and type in "cleanmgr.exe" Click "OK". Click the "More Options" Tab. Click "Clean Up", and then "Delete" in the "System Restore and Shadow Copies" section to remove all previous restore points except the newly created one. Note: You should only do this once! Make sure you install all the security updates for Windows, Internet Explorer & Microsoft Office Whenever a security problem in its software is found, Microsoft will usually create a patch for it. After the patch is installed, attackers can't use the vulnerability to install malicious software on your PC, so keeping up with these patches will help to prevent malicious software being installed on your PC Go here to check for & install updates to Microsoft applications. Note: The update process uses ActiveX, so you will need to use Internet Explorer for it, and allow the ActiveX control that it wants to install. Keep your non-Microsoft applications updated as well Microsoft isn't the only company whose products can contain security vulnerabilities, to check for other vulnerable programs running on your PC that are in need of an update, you can use the Secunia Software Inspector - I suggest that you run it at least once a month. Make Internet Explorer more secure Click Start -> Run Type "Inetcpl.cpl" (without quotes) & click OK. Click on the Security tab. Click "Reset all zones to default level" Make sure the Internet Zone is selected & click "Custom level" In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls") to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable". Click OK, then Apply, then OK to exit the Internet Properties page. Install SpywareBlaster & make sure to update it regularly SpywareBlaster sets killbits in the registry to prevent known malicious ActiveX controls from installing themselves on your computer. If you don't know what ActiveX controls are, see here You can download SpywareBlaster from here. Install and use Spybot Search & Destroy Instructions are located here Make sure you update, reimmunize & scan regularly. Make use of the HOSTS file included with Spybot Search & Destroy Every version of Microsoft Windows includes a hosts file. A hosts file is a bit like a phone book: it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites. Spybot Search & Destroy has a good HOSTS file built in. To enable it, Run Spybot Search & Destroy Click the Mode button on the toolbar, and then place a tick next to Advanced mode. Click Yes. In the left hand pane of Spybot Search & Destroy, click on "Tools", and then on Hosts File. Click on "Add Spybot-S&D hosts list" Note: On some PCs, having a custom HOSTS file installed can cause a significant slowdown. Following these instructions should resolve the issue Click Start -> Run. Type "services.msc" (without quotes) & click OK. In the list, find the service called "DNS Client" & double click on it. On the dropdown box, change the setting from "Automatic" to "Manual". Click OK. Exit/close the Services window For a more detailed explanation of the HOSTS file, click here. Install a-squared Free & update and scan with it regularly a-squared free is a product from Emsi Software provided free for private use that can detect and remove a variety of malicious software. You can get it here Note: If you have a dialup internet connection, you may also like to install a-squared Anti-Dialer which provides some real time protection against premium rate dialers *Finally I am trying to make one point very* clear. It is absolutely essential to keep all of your security programs up to date!** Billy3 -------------------- The forum is always a busy place. In the event I fail to reply within twenty-four hours, feel free to send me a PM. Have I helped you? If so, please consider a donation (by clicking this link). And that means I solve problems. Not problems like "What is beauty?" .. 'cause that would fall under the purview of your conundrums of philosophy....

don77 View Member Profile	Jul 4 2008, 08:50 AM Post #14
Forum Regular Group: HJT Team Posts: 3,212 Joined: 12-July 04 From: Boston Mass Member No.: 1,374	This thread will now be closed. If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you. Include the address of this thread in your request. If you should have a new issue, please start a new topic. This applies only to the original topic starter. Everyone else please begin a New Topic.

« Next Oldest · HijackThis Logs and Virus/Trojan/Spyware/Malware Removal · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Display Mode: Standard · Switch to: Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

Lo-Fi Version

Time is now: 9th February 2010 - 02:28 PM

Advertise \| About Us \| Terms of Use \| Privacy Policy \| Contact Us \| Site Map \| Chat \| Tutorials \| Uninstall List
Discussion Forums \| The Computer Glossary \| Resources \| RSS Feeds \| Startups \| The File Database \| Virus Removal Guides