Delf.V is a mass-mailing worm that sends out FIFA World Cup (Football/Soccer) related emails. It contains subjects such as "Soccer fans killed five teens" and "Crazy soccer fans".
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest detection database updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
NOTE If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note You need administrative rights to change the settings.
Delf.V is a mass-mailing worm that sends out FIFA World Cup (Football/Soccer) related emails.
Delf.V copies itself to the Windows system folder as a file named: msctools.exe.It Installs the following registry launch points:
%SysDir% represents the Windows System Folder.The mutex used by Delf.V is named "dezas".
Delf.V collects email addresses from the following list of file extensions:
Addresses are discarded if they contain one of the following keywords:
The harvested addresses are saved as two files named cats.jpg and cats2.jpg.
Delf.V tries to post the addresses to [***]traf.com/ms/count.php. It also tries to download and execute a file from http://couple[***].com/tumbs/dianaimg.exe.
Delf.V email contains the following characteristics: