English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Trojan.Win32.Slefdel.fpk

Detected Jan 01 2011 09:38 GMT
Released Jan 01 2011 16:14 GMT
Published Mar 24 2011 14:27 GMT

Technical Details
Payload
Removal instructions

Technical Details

This Trojan delivers a malicious payload to the user's computer. It is a Windows application (PE EXE file). It is 13 312 bytes in size. It is written in Delphi.


Payload

The Trojan creates a file named "Deleteme.bat" in its working directory and launches it for execution:

%WorkDir%\Deleteme.bat
The launched file deletes the Trojan's original body and deletes itself. The Trojan also attempts to delete its original body and ceases running.


Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

  1. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
  2. Delete the following files:
    %WorkDir%\Deleteme.bat
  3. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).


Bookmark and Share
Share
Trojan

This type of behaviour covers malicious programs that delete, block, modify, or copy data, disrupt computer or network performance, but which cannot be classified under any of the behaviours identified above.

This classification also covers “multipurpose” Trojan programs, i.e. those that are capable of conducting several actions at once and which demonstrate several Trojan behaviours in a single program. This means they cannot be indisputably classified as having any single behaviour.


Other versions

Aliases

Trojan.Win32.Slefdel.fpk (Kaspersky Lab) is also known as:

  • Trojan: Generic.dx!vmc (McAfee)
  • Mal/Generic-L (Sophos)
  • Generic Trojan (Panda)
  • W32/Trojan4.VVK (FPROT)
  • Trojan.Delfdel.1 (DrWeb)
  • Win32/Delf.PVD trojan (Nod32)
  • Trojan.Generic.KD.98246 (BitDef7)
  • Trojan.Slefdel!1lF5qfAHb50 (VirusBuster)
  • Win32:Malware-gen (AVAST)
  • Trojan.Win32.Slefdel (Ikarus)
  • Generic20.BLJE (AVG)
  • BackDoor.Graybird (NAV)
  • NseCheckFile2() returned 0x00010018 (Norman)
  • Trojan.Win32.Generic.5256C596 (Rising)
  • TROJ_SLEFDEL.EL (TrendMicro)
  • Trojan.Slefdel!1lF5qfAHb50 (VirusBusterBeta)