Plagued by Dropper.delf.3.L Please help

Hello. Every evening at precisely the same time AVG warns that a trojan has been found. This has been going on for a week now and I have done everything I can to try to resolve the issue.
Such as: shutting off system restore, running, spybot, adaware, spysweeper, avg, the list goes on.
The trojan gets detected and supposedly removed but returns the following evening again.
It created a temp folder under C: with installer2.exe in it the first cpl nites, now it is creating various folders with different names each time....tricky little pest.

Can anyone please help me to get rid of this pest?
Appreciate your assistance.

LadySox

http://www.experts-exchange.com/Appl..._21158904.html

btw: do you know if the viruses is located in C:/System VOlume information ? some AV's can't remove it from there because the folder is system protected...

honestly I have no idea

as instructed on symantec site, I ran their test and of course it came up with Infected warning. Yet all it tells me is
" Search for the name of the virus(s) listed below on the Symantec Security Response site for removal information. "
"C:\Documents and Settings\Name\Local Settings\Temporary Internet Files\Content.IE5\4BLJAAND\WindowsUpdate00592[1].exe is infected with Trojan Horse "

It is not telling me which trojan horse??????????????

Lady:

Go here and download HijackThis. Run it, save the log, (don't fix anything yet) and then post the log here as a text file attachment and I'll take a look, (or someone else will if I'm slow).

Before you try Hijack This I suggest you go to start and then Run and type "msconfig" without quotes. Click on the "startup" tab and look for anything suspicious. If you find anything suspicious google it and try to determine if it's safe yourself, if you can't then tell us what you found here and we will try and help you. Once you know that something is not safe then uncheck it and click ok, you will probably need to restart your computer. If this does not work then try everything else that everyone is telling you to do.

Try the online scanner at the link below. You will have the option to clean, which you do not with symantecs online scan:
http://housecall.trendmicro.com/

Then post a hijackthis log.

Before you run HijackThis,

Get updates for your Antivirus and AdAware/SpyBot etc.

Boot into safe mode and empty your browser cache and history. Go into Windows Explorer and find your Windows Temp file..delete everything it will let you (it only moves them to the recycle bin).

Now run your antivirus, antispyware, antitrojan etc software, also in safe mode.

Then reboot and run HijackThis

You might as well get rid of as much rubbish as you can before setting about the stubborn ones :D

Ya know.... I'm sat here just having a beer.... Lady was online... It would have been a 5 minute job..... But you all want to butt in and confuse the **** outta the poor lass..... :rolleyes:

She'll end up having to post the HijackThis log anyway..... Live with it.........

Quote:

---

Ya know.... I'm sat here just having a beer

---

In my best Homer voice, "hhhhaaa bearrrrrrr". Sorry Tiger, can't be where you are. Unless you are importing it :D

Imported all 12 miles from Canada.... What can I say.... It's the best draught I can get..... ;)

You out there Lady.... I can't stay here all night......

Here is a Hijack for you Tiger.

(Will go well with your beer)

Edit> OK, I fixed it Tiger....had it in rich text and zipped, now it is in notepad.

Mox:

Seen it.... Too funny...... But it didn't seem to come through right.... I just recognize the title...

are you there, I am sorry but couldn't get back online till now. REading all these posts and not sure where I should start!!!!!!! yikes

As requested I have hijack this but need some instructions as to what I need to do. Sorry to be such a pest everyone, but sincerely appreciate you help!

Well since Tiger is not online right now, you could get Spybot S&D, AdAware, and a good trojan cleaner and the run them in safe mode. Then get hijack this and put it in its own folder and create a text file of the log it generates and post it here as a text attachment, Some one will then get a chance to look it over in the next couple of days and post back what you should remove.

Also you can go to Trend microsystems site and run their online scanner ' Housecall'....it is very good.

If you need the links for any of these, just ask and I will get them for you. (or google them)

I have run Spybot, adaware, pest patrol etc but the darn little thing comes back every evening. I will see if I can figure out how to post the hijack log.

Have you run them in 'Safe Mode'?
And I would suggest (highly) going to Trend and running 'Housecall': http://housecall.trendmicro.com/hous...start_corp.asp

hopefully I have done this correctly

no, these were not run in safe mode, just with system restore shut down...I will run over to trend and do that then reboot in safe mode and follow your suggestions....then check back again. Thank you!

Just finished up running Housecall and it found nothing. Going to reboot into safe mode and run the others suggested. Wondering if you could advise as to the "good trojan cleaner" . Will check back again. Thanks!

There a 3 different trojan cleaners that I would recommend.
The best is the 'Cleaner by Moosoft' http://www.globalshareware.com/Utili...ofessional.htm it is a pay program, but does have a 30 day evaluation period with it.
Then there is Swatit http://swatit.org/ , it is a free program and very good, but it is slow but in depth (and has an ugly GUI (LOL)).
The next is A-Squared which I don't have a link for (server is down or something) it is also free.

I would suggest trying the 30 day trial of the cleaner and also adding either Swatit or A-squared for later use when the evaluation period of the 'Cleaner' runs out, if you don't wish to buy it. (If you do buy it, it will be all you should need)

well ran all in safe mode and came up empty.
I am certainly at a loss of ideas, but it is definately still there as it activated at precisely the same time again this evening.

Try the 'Cleaner'. Your hijack logs have several items I would question, but I am not the person to be able to tell you just what is bad on them. There are several others, including Tiger, who are much better at it than I probably will ever be. So on the hijackthis logs you will have to wait untill someone competent comes online and has a chance to look them over.

thanx moxnix...appreciate your advise! actually just ran the cleaner and nothing surfaced with it either. really baffles me.

OK....I just found this.

Quote:

---

What it did, was to place the trojan in a temp folder on my C drive every time the PC was restarted, and none of the more common solutions for trojans and adware were working. Every time I would delete the file, and every time it would come back.

I found the solution is actually very simple, or at least it was in my case, running WinXP home edition.

I went to add/remove programs, scrolled down, and lo and behold, there it was. Windows SyncroAd.

I uninstalled it, then I went to my C drive, found the folder (it was named "temp", right there on the main level of the C) and completely removed it using shift-delete.

After that, I restarted my PC, and I've yet to see a return of SyncroAd, the temp folder, or the trojan horse.

---

this is from http://computercops.biz/postitle79405-0-0-.html
Try that and see if it has any similarities to what you have....it was also named Dropper.Delf.3.L

Edit> here is another thread that outlines a means to fix the same problem http://www.cybertechhelp.com/forums/...ad.php?t=55231

Lady:

I think I see your problem.....

C:\Program Files\Win Comm\WinComm.exe
C:\Program Files\Win Comm\WinLock.exe

This is a version of AgoBot.

It probably won't work but open Task Manager and see if you can end the processes. (If not boot to safe mode and do the following things). If it does work take steps below in normal mode.

1. right click My Computer - Manage - Services and Apps. - Services
2. Locate the services they may be starting under (WinLock and WinComm) and disable then.
3. In Explorer navigate to c:\Program files and rename the folder \Win Comm to \Trojan Agobot
4. Restart the PC in normal mode let it's boot cycle run to completion, log in and wait about a minute.
5. Rerun HijackThis
6. If both these files no longer appear then you can just delete the \Trojan Agobot folder
7. If they do appear repost the HiJackThis log please.....
8. Turn off all autoprotect AV stuff and navigate to C:\Documents and Settings\Name\Local Settings\Temporary Internet Files\Content.IE5 and delete everything under that folder - not everything will disappear - don't worry.

Good day Tiger Shark.
I am in "services" but I am not finding windomm or winlock....can u give any further advise how to try to located these items?

thank u

I think the time difference between us is getting in the way! lol

just rename the folder.... In safe mode if necessary then repost a new hijack this log

I am not seeing it now....here is new hijack this file...and I guess we'll see tonight at 10:47 if it happens again. Thank u so much TigerShark!!

OK...

Now I want you to check this line in HijackThis and tell it to Fix it.

O4 - HKLM\..\Run: [Win Comm] C:\Program Files\Win Comm\WinComm.exe

The restart and see if it comes back

ok I don't see it now.
I am also noticing that everytime I reboot my system, it is telling me my network cable is unplugged (when of course it is not) and it takes from 1-5 min to come back up. ????

posting another log just in case.

once again, thanks Tigershark

That might have something to do with the fact you have:-

AVG Antivirus and Zonealarm, 2 Pest patrol, (PPMemcheck & PPControl), and Spybot tea Timer running at startup. They are probably all fighting to do their stuff at startup.

I would disable them all except ZoneAlarm and restart. If it is better then I would have AVG and ZoneAlarm only start up. Keep the spyware stuff for periodic checks rather than having it running all the time.

Tiger, for her to use the Spybot Teatimer, it has to start at startup.

I wondered if that had something to do with it, yet I have tried to disable them from starting and they keep returning.
sorry to be such a pest TigerShark.

Check these two in Hijack this and say Fix.... That'll stop them.... ;)

O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe

You might want to get rid of Tea Timer, (I've never used it), but I thoroughly recommend the free version of WinPatrol found here. It will also give you an easy way to disable/enable/remove processes you don't want starting and does a good job of protecting your startup items from bad programs.... You could install this first and disable the Pest Patrol stuff with it if you like.

O2 - BHO: (no name) - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - (no file)
O3 - Toolbar: (no name) - {22F89834-FEF4-2A13-1146-9CA988499AD9} - (no file) Evening All,

Lady, the two lines i have highlighted above pertain to spyware. They originaly would have pointed to a dll, but they have been dealt with by one of the scans you have done. You should check those items and have hijackthis fix them.

Edit

Check and fix the following also.

http://h30043.www3.hp.com/sj/en/check/qdiagh.cab?322

There maybe other entries will post back as i find them.

Edit

Thank you everyone for all of the help. I beleive we have had success as I did not get the usually annoyance this everning!!!!!!!!!!!!
I do really appreciate it!

Thank you,
LadySox