Also detected as:
Win32/Delf.ODS trojan (ESET),
Alerts from your security software may be the only symptom.
Microsoft security software detects and removes this threat.
This threat can download and run files on your PC.
The following Microsoft security software detects and removes this threat:
Even if we've already detected and removed this particular threat, running a full scan might find other malware that is hiding on your PC.
VirTool:Win32/DelfInject drops itself using a random file name (such as "xpxnqdv.exe") in the %APPDATA%\Microsoft\Windows folder.
It modifies the following registry entry so that it runs each time you start your PC:
In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\RunSets value: "<random value>" (for example, "B5XWlRZ5/ql2chDjTA")WIth data: "%AppData%\microsoft\windows\xpxnqdv.exe"
It then runs the legitimate file "<system folder>\rundll32.exe" and injects a thread into it to delete its originally running EXE file.
Before it runs, VirTool:Win32/DelfInject checks your PC for certain security software. If any are found, it stops running.
VirTool:Win32/DelfInject injects code into "svchost.exe" so it can connect to certain servers and download files. One of the servers that it is known to connect to is "cate<removed>ksys.info".
At the time of this analysis the files are not available for download.
Analysis by Mihai Calota
Take these steps to help prevent infection on your computer.
I want to...
Note: Your feedback is very important to us, however, we do not respond to individual submissions through this channel.
If you require support, please visit the
Safety & Security Center.