VirTool:Win32/DelfInject.gen!CS

This threat is a generic detection for malicious files that are hidden to protect them from detection or analysis.

The malicious file is usually encrypted or compressed and stored inside another program. This program decodes the malicious file and loads it. The malicious program can be injected into a clean process or loaded in a new process of its own. Unlike a dropper, the malicious program is never written to disk as a separate file.

VirTool:Win32/DelfInject.gen!CS has been used with a variety of different malware, especially several families of Instant Messaging (IM) spreading Internet Relay Chat (IRC) bots such as Worm:Win32/Scrimge, Worm:Win32/Slenfbot and Worm:Win32/Pushbot. We have also seen other malware families such as Win32/Rimecud, Win32/Zbot and Win32/Hamweq using Delfinject.