Trojan-Clicker.Win32.Delf.qt

[Desert Rat]

Using FSecure with up to date defs. Today it flagged a downloaded
program (WordWeb) as infected with Trojan-Clicker.Win32.Delf.qt.
FSecure was unable to delete it but I was able to using Win Explorer.
FSecure now shows a .exe file in one of the System Restore files as
having the same infection. I have looked extensively at all the AV
vendor's sites for any info on this variation but nothing is listed.
The closest I've found is a Trojan-Clicker.Win32.Delf.cl listed on
Kasperky's site. I can remove it I'm sure by turning of System Restore
and then rebooting but I'm reluctant to do this if it's just a false
positive. Anybody have any info on this?

 

[David H. Lipman]

From: "Desert Rat" <[email protected]>

| Using FSecure with up to date defs. Today it flagged a downloaded
| program (WordWeb) as infected with Trojan-Clicker.Win32.Delf.qt.
| FSecure was unable to delete it but I was able to using Win Explorer.
| FSecure now shows a .exe file in one of the System Restore files as
| having the same infection. I have looked extensively at all the AV
| vendor's sites for any info on this variation but nothing is listed.
| The closest I've found is a Trojan-Clicker.Win32.Delf.cl listed on
| Kasperky's site. I can remove it I'm sure by turning of System Restore
| and then rebooting but I'm reluctant to do this if it's just a false
| positive. Anybody have any info on this?

I truly doubt uit is a False Positive.

If YOU are not sure...


Please submit a sample to Virus Total --
http://www.virustotal.com/flash/index_en.html
The submission will then be tested against many different AV vendor's scanners.
That will give you an idea what it is and who recognizes it. In addition, unless told
otherwise, Virus Total will provide the sample to all participating vendors.

You can also submit a suspect, one at a time, via the following email URL...
mailto:[email protected]?subject=SCAN

When you get the report, please post back the exact results.