Troj/Delf-KQ

Please follow the instructions for removing Trojans.

You should also check your Internet Explorer settings using Tools|Internet options|General for any modifications made by the Trojan.

Troj/Delf-KQ is a Trojan for the Windows platform.

Troj/Delf-KQ includes functionality to access the internet and communicate with a remote server via HTTP.

When first run Troj/Delf-KQ copies itself to the Windows folder as XPsys.exe.

Troj/Delf-KQ will attempt to download the file 24997.exe to the Windows folder
and run it.

The following registry entry is created to run XPsys.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
XPsys
<Windows folder>\XPsys.exe

The following registry entries are set, affecting internet security:

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
1200
3

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
1201
3

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
1400
3

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
1406
3

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
1C00

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
1200
3

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
1406
3

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
1C00

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
1200
3

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
1201
3

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
1406
3

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
1C00

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
1200
3

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
1C00