Some Of The Folder Are Changed Into .exe Extension Automatically

[khaled.pasha]

Friend s in my computer some folders are changed automatically in to .exe files and these folders are not able to open , they are not opening , and when i scan with avast antivirus it is showing((( win32:delf-krs [trj]))) how can i delete this trojan , please help me

[TheGreatOne]

Trojan.Win32.Delf Removal Instructions

• Kill the following processes
  1.exe, 47d2374c33a84eab66a507d770b985a5.exe, arsystem.exe, c1cd6954bd2d1e309faee31106489324.exe, creeper.exe, ppime.exe, editor.exe, lo.exe, msn.exe, project1.exe, ras51d.exe, rundll32.exe, hipewr5.exe, jj78208.exe, jw09tin.exe, upyyjl.exe, trojan.win32.delf.ak.exe, trojan.win32.delf.al.exe, trojan.win32.delf.bf.exe
  
  
• Unregister the following DLLs and reboot
  6219309d.dll.
  9qbqe.dll, lj7i5x.dll, regsvrac32.dll in Windows\system32\
  
  
• Delete these registry entries
  HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce\hipewr5.exe
  HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce\hipewr5.exe
  HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce\jw09tin.exe
  
  
• Remove the following files
  -+-+.htm, 1.exe, 47d2374c33a84eab66a507d770b985a5.exe, 6219309d.dll, antimicr0.txt, arsystem.exe, c1cd6954bd2d1e309faee31106489324.exe, creeper.exe, editor.exe, lo.exe, log.txt, msn.exe, msn.exe-37e087d2.pf, msn.txt, msnclone.html, msnclone.html.lnk, msnkeylogger.txt, mytest.html, mytest.html.lnk, ppime.exe-14335b1c.pf, ppime.txt, project1.exe, ras51d.exe, read.txt, readme.txt, rundll32.exe, rundll32.exe-268bff96.pf, trojan.win32.delf.ak.exe, trojan.win32.delf.al.exe, trojan.win32.delf.bf.exe.
  ppime.exe in Desktop\
  restsrv32a.sys in Documents and Settings\UserName\local settings\temp\
  restsrv32a.sys in Windows\
  9qbqe.dll, hipewr5.exe, jj78208.exe, jw09tin.exe, lj7i5x.dll, regsvrac32.dll, restsrv32a.sys, upyyjl.exe in Windows\system32\
  
  
• Remove the following directories
  Documents and Settings\UserName\nethood\bs_backup on badboy

Note: Do at your own risk. It is good to try this before going to reformat.

[Jimmy24]

Trojan.Win32.Delf belongs to Nuker spyware category.
It's presense means that your computer is infected with malicious software and is insecure.

This Nuker is also known as:

• Dialer.LW - named by Panda.
• Trojan Horse - named by Panda.
• Trojan.Win32.Delf.av - named by Kaspersky.
• Win32/Delf.k!Trojan - named by Computer Associates.

You should remove this immediately with the help of some spyware removal tool. If its not removed properly, you can try above manual steps which must remove it completely. But you must have fair knowledge of registries before doing this and should do it extremely carefully. If still not able to remove, then format is the last option to be at a safe side.