Win32:Delf-ADO [Trj]

I am receiving the following trojan when I do a scan with Avast 4.7 Home edition. File version 0627-3.

c:\windows\syswow64\inicfg32.dll
Win32:Delf-ADO [Trj]
Trojan Horse
0627-3, 07/07/2006

I cannot move it or rename it as it says the file is in use. When I delete the file (If necessary do so on next system start) but it just comes back over and over again.

I turned off system restore. What else can I do to get rid of it completely?

Windows xp64 (64 bit version of windows). 2003 Service pack 1.
Dell Precision PWS670. Dual Xeon CPUs. 6 gigs ram. scsi drives.

Any help would be appreciated.

Dave

Try Unlocker (http://ccollomb.free.fr/unlocker/) or Delete FXP (http://www.jrtwine.com/).
See more info: http://forum.avast.com/index.php?topic=15680.0
You could use the “Advanced File Remover” feature in RejZoR’s avast! External Control available from http://www.excessive-software.tk/

You could schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot.

  1. Clean your temporary files.
  2. Schedule a boot time scanning with avast as above or use a-squared or ewido (trojan removers).

Currently as far as I’m aware you can’t do a boot-time scan with the winXP64, which you would usually use to overcome a file in use warning. I assume that there is a safe mode in winXP64, if so you could try to run avast once in safe mode and try another scan.

There are a lot of google hits for inicfg32.dll, so you might want to do a google search and see if there is a workable solution for winXP64 as I don’t know if HiJackThis, AdAware or Ewido will work in winXP64.

Hi DavidManvell,

You can remove this trojan from here
http://www.spywareguide.com/onlinescan.php
(before running it backup the registry).
änd abou the vulnerability that led up to this infection, and what updates to get to be protected against it, you can read here:
http://www.securitylab.ru/notification/265483.php

polonus

Thanks all. Got it removed finally.

Couple of notes:

You could schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot.

Windows XP64 does not seem to have the boot scan available or at least if it does it does not work with this software. the option does not show up on my menu. Closest i have to it is to do a delete on next startup which did not work.

Hi DavidManvell,

You can remove this trojan from here
http://www.spywareguide.com/onlinescan.php
(before running it backup the registry).
änd abou the vulnerability that led up to this infection, and what updates to get to be protected against it, you can read here:
http://www.securitylab.ru/notification/265483.php

polonus

This is only a spyware removal program and does nothing for trojans. I did run it and it did find a couple of questionable spyware issues but nothing major.

I assume that there is a safe mode in winXP64, if so you could try to run avast once in safe mode and try another scan.

This is what did the trick. Thanks DavidR. I had some issues with it though. When i went to reboot i had trouble figuring out which keys to get into safe mode. Turned out to be F1. Once into safe mode I had to manually run Avast and when i did the program did not show up on my screen. i am thinking it was centered off of my desktop and nothing I could do would over-ride it. i ended up using Taskmanager to see it and right clicked on it. I selected Maximize Avast and that allowed me to bring up the program. Extending your desktop does not seem to work while in safe mode unfortunately.

Anyway I scanned my puter, had it find it and move/rename it and then restarted. System came up normally and I rescanned the entire computer one more time to be sure.

Thanks to all for the advice.

One last mote. There is a lot of stuff that does not work with Windows XP64. McAfee and Norton refuse to load as well as every webcam on the market, Federal EXpresses/Kinkos printing software, My Car Garmin Navigator software and others as well. It’s been a real pain finding anything that will work with this OS as far as drivers and utilities. Thanks for making this program work.

:slight_smile:

Glad that I could help, welcome to the forums.

Safe mode on XP 32 bit is a pain also with its 600 X 800 graphics, I have a 20.1" TFT (1680 X 1050) boy does that look weird in 600 X 800.

Unfortunately there are very limited applications, drivers, etc. for winXP64 one of the prices you end up paying for being an early adopter. Fortunately avast works under winXP64, but since the boot system is somewhat different the avast boot-time scan wont work under it.

Yeah I am at 1920 x 1200 and it really sucked when all my desktop icons would not even fit on that small screen. It even turned off the second monitor. Oh well it’s fixed and I am happy.

Funny thing is it started with spyware on my system (Something called Stopzilla seems to work with this OS). Once I got that straightened out with that software I figured I would do a search and see what virus programs worked as all the onces I have bought so far have failed. A random forum post brought me to Avast and I am so much more the happier now. Virus and spyware free again!

Dave