Malware type: Trojan

Aliases: Trojan.Win32.Delf.gm (Kaspersky), Generic Delphi (McAfee), W32.Meetot (Symantec), TR/Delf.GM.8 (Avira), Troj/BDDelf-A (Sophos), Trojan:Win32/Delf (Microsoft)

In the wild: Yes

Destructive: No

Language: English

Platform: Windows 95, 98, ME, NT, 2000, XP

Encrypted: No

Description: 

This Trojan is a Visual Basic (VB) compiled executable that is installed manually by a user or downloaded from a Web site. Upon execution, it drops a copy of itself as the file SYSNOTE.EXE in the Windows system folder.

It needs an MS Access database file named LIDB2.EXE in order for it to execute completely. Without this database file it cannot execute its routines. It has a GUI that the user can interact with.

It creates a registry entry to ensure its automatic execution at every system startup.

It runs on Windows 95, 98, ME, NT, 2000, and XP.

For additional information about this threat, see:
Solution
Technical Details

Description created: Jan. 2, 2005 10:05:47 AM GMT -0800
Description updated: Jan. 2, 2005 10:25:45 AM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.