Help, Win32: Delf-GD [Trj] comes back after data file deletion

[John896]

Got into Bios.  no legacy option, just on or off and data rate.  Both were right. 

Tested removing hubs and changing power options.  Tried reinstalling driver, reset, adding hubs without devices, reinstalling hub drivers, and did not find any fixes for power management option.

I usually use gogoanime.com, stoptazmo.com, and a paid anime download site for fun.  Otherwise shop at Amazon, and other big name sites.  Visit manufactorer sites for new hardware.  AVS software installed for video work.  Nero 8 also.  added freemake video software this year.  use spybot, windows defender, and Avast with windows firewall. have dropbox.

Will upgrade IE to high security after this visit for a  little while. Usually use medium.

Have turned on avast protection of IE.  Also teatimer and related spybot protection. 

Can get MS virus scanning software to try to find anything.  Also have access to Sy norton suite from comcast.  Could download Avira free.  Also have tried to install a free one year copy of Kaspersky Anti-virus on the laptop, but removed it when it did not install right with the firewall.  Stopped all other access to internet.  Found some suggestions for fixing it later, but did not have windows firewall access set up right at the time to do any of them.  Not sure if it will allow installation on a different machine.

Been using Avast without the mail shield working for a year.  Figured out how to get my thunderbird and Avast to work right last weekend.  Also found out the MS Live mail and a hotmail account can not be done in avast that I use on my laptop for now.  Trying out live for the first time there. 

I will also remove the anti-phishing domain advisor, have not seen any results of it running.

I need to remove the remainder of spyhunter that is running.  I uninstalled it, and it seems to have left something behind.  It could be my infection.

[John896]

Most computer programs are working normally.  No errors.  Long time issue with incomplete installation of DAP.  Dap installed completely on the laptop with same OS.  Just deleted some new files on searchcom location.  Freemaker installation had some adware that was a problem several months ago.  Also keyboard boot problem started then.  Tried Spyhunter due to that about that time.  Avast had been finding some infections in the java cach.  Boot time scans were best at clearing them.  Otherwise both boot time and standard full system scans did not find this problem until Jul 19.  Last full system scan before that was Jul 5.

I expect to remove the OTL moved files when you give approval.
I did a repair of Avast which fixed the boot problem.
Let me know when I should start further clean up attempts without you.
Thanks,
John

[essexboy]

OK I will remove the tools but you should clear out all the other stuff

Freemaker installation had some adware that was a problem several months ago

That probably came bundled with the Becko toolbar

Subject to no further problems   

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems 

Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :Commands
  [resethosts]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done

Remove ComboFix

• Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
  
• In the Run box, type in ComboFix /Uninstall (Notice the space between the "x" and "/") then click OK
  
  
  
  
• Follow the prompts on the screen
• A message should appear confirming that ComboFix was uninstalled

Run OTL and hit the cleanup button.  It will remove all the programmes we have used plus itself. 

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Go to control panel
• Select folder options (Appearance > Folder options in category view)
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
  
• Click Yes to confirm.
• Click OK.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.

 Upgrading Java:

• Go to this site  and click Do I have Java
  
• It will check your current version and then offer to update to the latest version

SPRING CLEAN

To manually create a new Restore Point
 

• Go to Control Panel and select System
  
• Select System
  
• On the left select System Protection and accept the warning if you get one
  
• Select System Protection Tab
  
• Select Create at the bottom
  
• Type in a name i.e. Clean
• Select Create
  

Now we can purge the infected ones

• GoStart > All programs > Accessories > system tools
  
• Right click Disc cleanup and select run as administrator
  
• Select Your main drive and accept the warning if you get one
  
• For a few moments the system will make some calculations
• Select the More Options tab
  
• In the System Restore and Shadow Backups select Clean up
  
• Select Delete on the pop up
  
• Select OK
• Select Delete

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Malwarebytes.  Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

• Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide  How did I get infected in the first place ?

Keep safe  :wave:

[John896]

Used your script to take off the programs on both desktop and laptop.  Have a few little items left, but mostly done.  I ran OTL for 180 days back files before removing it.  Attaching log for your info.  Still seeing files generated on searchcom_001.  Removed a lot of unused software that was running in background. 

I failed to mention that a program that I installed to backup data from my cell phone (sony Erik..) had been identified as virus by avast much later than when the installation was done.  Only the install program was identified.  However the program was pulling a different program from the web since the manufactorer had dropped support called Sony PC Suite.  That unusal practice might have made the identification.  Came from Cnet2 which I thought was ok site.  I submitted it from the virus chest to avast for review as false positive, but have not heard anything back.  I also sent the searchcom_001 infected file for review.

The Java site passed my configuration without any recommendations, but I reviewed removing old versions on the site, did so, and it still passed as complete.

[essexboy]

Do you use Speedbit ?

[essexboy]

OK that revealed an old Blekko data entry

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  
  

  :Files
  ipconfig /flushdns /c
  C:\ProgramData\blekko toolbars
  
  :Commands
  [emptytemp]
  [CREATERESTOREPOINT]
  [Reboot]
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done

[John896]

I think speedbit comes with DAP which I use.  I have Dap on both computers, but have avoided speedbit as much as possible.  In clearing software, I removed DAP programs from the desktop.  Do you want a new scan for the changes made before I do that fix?

[essexboy]

No run the fix as is please

[John896]

OK, ran fix and followed with 180 day scan with otl.  attaching results.  size of each will require multiple posts.

[John896]

180 day scan results after blecko fix run.  Sorry size is 272KB and is not being allowed to be posted.  Program said some data was lost in ANSI version. 

I had speedbit on as a result of errors in downloading DAP.  When I forgot to uncheck download of speedbit, it would also change my homepage to speedbit search page.  I do not like that, so try not to download it.  I was letting a copy of speed bit run as an alternative search on IE for several months.  Does Speedbit do high risk data mining of personal data?

Thanks,
John

[essexboy]

No but speedbit has been known to send you to the wrong site sometime

Could you cut the OTL log in two ?

[John896]

When I opened it and looked close, found a lot of junk on host1 entry.  Deleted most and saved in ansi windows format from Wordperfect.  Notepad seemed to get lost when trying to edit it.  File much smaller.  Attached below.

[essexboy]

I can see nothing remaining now

[John896]

ok, so far have not seen reappearance of infected list files from scans.  Will run cleanup on otl again and other finishing actions from earlier post again.  Will continue with heightened monitoring for about a week.

I deleted javafx 2 as old version, but see it was installed on my new laptop too.  I did not see that FX version show up in the download choices, but is it useful?

Thanks,
John

[essexboy]

Do you use a lot of Java games or do Java development ?  If not then it is not really required