RE: Microsoft Search Assistant and Trojan Downloader Delf

From: bill the cat (billthecat_at_discussions.microsoft.com)
Date: 01/16/05 

Date: Sun, 16 Jan 2005 07:41:01 -0800

I have managed a TEMPORARY workaround the Trojan Downloader Delf Spywaree
Trace described in the other ticket and briefly mentioned above

By changing my internet search properties from Search Assistant to Search
Companion I am no longer getting the Trojan Downloader DELF version 1 trace
in my temporary internet file. I want to make it clear that I consider this
only a TEMPORARY SOLUTION.

If I DO USE SEARCH ASSISSTANT. THE TRACE APPEARS 100% of the time.
Spysweeper can remove the trace , but not what caused it, EVEN in SAFE MODE.
Other computers in my home Network also show this trace. Adaware, spybot,
panda, norton , mcaffee, spysubtract, sysclean, Hijack This and even the new
Software Beta from Microsoft do not detect this threat in either Normal or
Safe mode.

I need to determine if either :

1. This is a false trace

2. There is a hidden bug with unknown properties somewhere where a standard
or even safe mode scan can't reach it

3. The Trojan is being pulled from the internet evertime I use the Search
Assisstant by some malicious code that invisably is redirecting my browser

4. The online search services such a MSN or Overture may themselves be
infected in some way

Myt computer is a HP Pavillian 430n with an Athlon XP processor, 512 MB RAM,
Home XP 2 SP 2, it is bundled with imaging software from HP as well as
something called overture

I have Norton Antivirus, Webroot Spysweeper, Spybot permanently installed
Norton and Webroot are always runing

"bill the cat" wrote:

> I have detected a spyware trace called Trojan Downloader Delf version 1 in my
> temprorary internet files everytime i use the internet Explorer 6 Search
> Assistant
>
> Webroot Spysweeper detected it and quaranteened it /removed it but reappears
> everytime i use the search assisstant. Safe mode sweeps do not stop it.
>
> Only Webroot Spysweeper 3.5 detects this trace.
>
> Anyone else have this happen?
>
> I have an HP Pavillion with Home XP SP 2
>
> False signiture? Or should i worry?

Relevant Pages

  • RE: Search Assistant Trojan Vulnerbility
    ... I have managed a TEMPORARY workaround the Trojan Downloader Delf Spywaree ... By changing my internet search properties from Search Assistant to Search ... Companion I am no longer getting the Trojan Downloader DELF version 1 trace ... I have Norton Antivirus, Webroot Spysweeper, Spybot permanently installed ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Packet Sniffing and Virus help
    ... When starting a trace, ... you may want to disable some of the options dealing ... allow explorer access to the Internet - even if I ... >> internet for mIRC, with the same filename. ...
    (comp.security.firewalls)
  • Re: what is the scam?
    ... Even if we buy new SIMs they can trace the IMEI ... Russian bank account. ... I won't be sending the phishing emails myself, but I need some internet ...
    (uk.telecom.mobile)
  • Re: Peter Stewarts Book Reviews
    ... we can all see that you go searching absurdly on the internet for ... > any trace of me, or even of other writers in Australia who happen to be my ...
    (soc.genealogy.medieval)
Quantcast