topic Re: Win32 Trojan Dropper Delf in Norton Internet Security / Norton AntiVirus

Win32 Trojan Dropper Delf

Johncdaley — Sat, 18 Jul 2009 16:35:39 GMT

On running Ad-Aware, it found this trojan and then claimed to have removed it after being told to do so. I then re-booted and ran Norton 2009, which reported having removed all threats. I then re-ran Ad-Aware and it found the same trojan still there. I can't find a reference to a trojan with this exact name in the Norton threat finder, but I feel there must be some malware present in my PC for Ad-Aware to make this report. Ad-Aware support is no help! Does anyone have any suggestions?

Re: Win32 Trojan Dropper Delf

delphinium — Sat, 18 Jul 2009 16:40:50 GMT

Johncdaley:

Is this an older free version of Adaware or a newer one with real-time antivirus scanning?

Also, please see if you can run a GMER log. Check all boxes. You will be able to attach the log using the "add attachments" link just below the post button. It always pays to check.

Please advise if you have NIS2009 or NAV2009 Or N360

Re: Win32 Trojan Dropper Delf

Johncdaley — Sat, 18 Jul 2009 21:32:55 GMT

I have the newer version of AdAware with realtime virus scanning.

I am using NAV2009.

Please pardon my ignorance, but what is a GMER log?

Re: Win32 Trojan Dropper Delf

delphinium — Sat, 18 Jul 2009 21:43:51 GMT

Oops sorry Johncdaley:

I forgot the link

http://www.gmer.net/

When you have two real time scanners at the same time, it often causes conflicts, some of which are not obvious, but leave you more vulnerable than 1 real time and 1 or 2 on demand. It is recommended that Adaware be removed before we begin the repair as some anitivirus programs actually prevent the removal of the malware. If you have any other real time scanner on your machine, please remove it.

If you have trouble with the scan, all boxes checked, you do it in separate scans, half at a time, or attempt to get a scan in safe mode.

Re: Win32 Trojan Dropper Delf

Johncdaley — Sun, 19 Jul 2009 13:43:46 GMT

Does that include removing NAV2009?

Re: Win32 Trojan Dropper Delf

delphinium — Sun, 19 Jul 2009 17:11:40 GMT

Hi Johncdaley:

Leave Norton installed. Since this is a Norton forum, you need at least one Norton product, and it does seem to limit some of the actions of the malware. Leave whatever firewall you use installed as well provided it is a stand-alone firewall without an antivirus engine. That will also cause problems.

Re: Win32 Trojan Dropper Delf

Johncdaley — Tue, 21 Jul 2009 01:09:15 GMT

Here is the GMER log. In Wordpad format for simplicity.

And, by the way, thanks for your interest.

Re: Win32 Trojan Dropper Delf

delphinium — Tue, 21 Jul 2009 03:42:50 GMT

Johncdaley:

Could you please run a Sysprot scan for us. That is one unusual GMER. You will need to disable the auto protect in Norton for it to run.

Choose the report or log tab and HD and scan.

http://homepages.slingshot.co.nz/~crutches/SysProt

Also, can you please advise the name of the file that Adaware detected?

Re: Win32 Trojan Dropper Delf

Johncdaley — Tue, 21 Jul 2009 17:15:47 GMT

I am unable to find where I made a note of the names of the two files AdAware found. One was in %SYSTEMROOT% and the other in Win32.

I reinstalled AdAware and ran a scan so as to retrieve the names, but now AdAware finds no malicious objects.

So is there still any reason to run a Sysprot scan? Is there something in the GMER log that is of concern?

Re: Win32 Trojan Dropper Delf

delphinium — Tue, 21 Jul 2009 18:56:08 GMT

Hi Johncdaley:

You have an abnormal GMER. It shows an abnormal termination in the ntoskrnl.exe, which might or might not be related to

a rootkit. Adaware might pick up some of the rootkit files which it has definitions for, which you are going to find in the systemroot and the system32, but it isn't going to be able to necessarily find or remove an active rootkit.

If we confirm that you do have one, Quads wll have to provide information and tools for you to accomplish it.

It's your call Johncdaley, it isn't as if we have a shortage of rootkits to remove.:smileywink:

Re: Win32 Trojan Dropper Delf

Johncdaley — Wed, 22 Jul 2009 20:34:20 GMT

Don't get me wrong - I am absolutely eager to do whatever is needed to get rid of whatever is wrong. I just don't want to waste the time of people that are helping me. (You.)

Trying to run SysProt:- There is no Report tab, so I chose Log. This gave me a row of checkboxes with the same names as the tabs. Also a checkbox called "Hidden Objects Only" and a button labelled "Create Log and an OK. Nothing I could identify as HD and no Scan. Where do I go from here?

Re: Win32 Trojan Dropper Delf

delphinium — Wed, 22 Jul 2009 22:00:20 GMT

Hi Johncdaley:

We don't mind "wasting our time" to make sure that you are secure. Choose the log tab. When you get to where the boxes need to be checked, down at the bottom of that screen should be a box all by itself called HD. Check that. Do not check hidden items only.

Save the scan to your desktop when you are done so it is easier to find and then post it using the "add attachments" link

Re: Win32 Trojan Dropper Delf

Johncdaley — Thu, 23 Jul 2009 18:08:03 GMT

I just checked again (on two different workstations) and there is definitely no box labelled HD in the Log tab.

Re: Win32 Trojan Dropper Delf

delphinium — Thu, 23 Jul 2009 18:41:47 GMT

Well, send us what you have Johncdaley. There is no accounting for computers and software sometimes.

Re: Win32 Trojan Dropper Delf

Johncdaley — Thu, 23 Jul 2009 21:06:26 GMT

I checked all boxes and here is the log I got

Re: Win32 Trojan Dropper Delf

delphinium — Thu, 23 Jul 2009 21:27:08 GMT

Hi Johncdaley:

I don't see anything to worry about in the log. As long as Adaware and Norton are happy about the state of your system, you are good to go. I must warn you again that two real time scanners at the same time are not as effective as one with on-demand scanners.

Best wishes

Re: Win32 Trojan Dropper Delf

Johncdaley — Thu, 23 Jul 2009 21:56:05 GMT

Thanks for your trouble.