Virus:W32/Delf.BO
Summary
Virus:W32/Delf.BO is malware that connects to malicious websites. Virus:W32/Delf.BO may download files, or get instructions for its malicious acts.
Removal
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
- Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
- Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
- Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Technical Details
Once Virus:W32/Delf.BO has been executed, it will display a non-malicious file. Typically, office documents, text files, or log files. The clean file is dropped into the following folder:
- %temp%\PrgStart
Virus:W32/Delf.BO drops the following malicious file component in the Windows directory:
- reloc32.exe
- svhst32.exe
It also drops the following files in the Windows System Directory:
- updates.exe
- wandrv.exe
Moreover, it also drops the following file in the Startup folder:
- SQLNET.exe
Malicious drop files may use the following parameters to execute:
- -O
- -RS
- -A
- -V
To enable its automatic execution upon boot up it adds the following autostart registry entries:
- HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce "Install part II" = "%sysdir%\updates.exe -o"
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\ "Memory relocation service" = "%windir%\reloc32.exe -rs"
- HKLM\Software\Microsoft\Windows\CurrentVersion\Run "Microsoft Server Process" = "%windir%\svhst32.exe -a"
Delf.BO modifies the default entry for the program used to open the clean file and executes itself upon opening the same file extension of the clean file.
Example for .TXT files:
- HCR\txtfile\shell\open\command Original data: %sysdir%\NOTEPAD.EXE %1 New data: %sysdir%\notepd.exe "-v" "%1"
Along with adding or modifying registry entries for its autostart technique, it also adds the following entry in "%windir%\win.ini"
- "%sysdir%\wandrv.exe"
This is under the following criteria:
- Name = "windows"
- Key = "run"
It may connect to the following domain to download other files:
- ibrahi5834.0catch.com
- idalpi.freehostia.com
- iggywal.bravehost.com
- igor28.0catch.com/g[blocked].jpg
Note: As of this writing the domains above are unavailable. It checks for Internet connection by querying the following site:
- www.google.de
It has a backdoor/proxy server functionality that may use the following commands:
- HEAD
- POST
- OPTIONS
- TRACE
- PUT
- CONNECT
Virus:W32/Delf.BO also connects to the following URL:
- 23.66.199.15
More Support
Community
Ask questions in our Community.
User guides
Check the user guide for instructions.
Contact Support
Chat with with or call an agent.
Submit a Sample
Submit a file or URL for analysis.