Trojan:Win32/Delf.GL

Trojan:Win32/Delf.GL is installed by TrojanDropper:Win32/Delf.DY, a trojan that may be disguised as an Internet chat application (QIP 2005) installer program. Win32/Delf.GL deletes Internet cookies and may send details about the trojan installation to a remote Web server.

Trojan:Win32/Delf.GL is installed by TrojanDropper:Win32/Delf.DY, a trojan that may be disguised as a QIP 2005 installer program and may be present as the following:

 

%windir%\system32\mmá.exe (or mmß.exe) - Trojan:Win32/Delf.GL

Trojan:Win32/Delf.GL drops and runs a batch script as "<system folder>\delcookes.bat" - this dropped script deletes all cookies from the Internet temporary files folder. When Internet cookies are deleted, users may then be required to enter credentials when logging onto Web sites. This is a benefit to malware that captures key strokes.

 

Trojan:Win32/Delf.GL may contact the remote Web server "katomka.net.ru" to send installation notifications to an attacker.