Worm/delf.eyr

[jacqui]

I have 2 computers XP pro on a home network.They were behaving very
strangely and slow etc. AVG free has found worm/delf.eyr in both and shows
as 1. c:\drivers\video\HKCMH.EXE Back up copy infected 2. C:\System Volume
Information\_restore {numbers here}\RP1187\A0130456.EXE Back up copy
infected.
What do I do now. Can I just empty the virus vault.

 

[Malke]

jacqui wrote:
> I have 2 computers XP pro on a home network.They were behaving very
> strangely and slow etc. AVG free has found worm/delf.eyr in both and shows
> as 1. c:\drivers\video\HKCMH.EXE Back up copy infected 2. C:\System Volume
> Information\_restore {numbers here}\RP1187\A0130456.EXE Back up copy
> infected.
> What do I do now. Can I just empty the virus vault.
>
Delf infections are extremely difficult to remove and you will need
guided help. Simply emptying the Virus Vault will not do it. Go to one
of the specialty forums listed below, register, read the posting FAQ,
and post a HijackThis log there (not here).

http://aumha.org/downloads/hijackthis.zip
http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Merijn
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42 -
another tutorial
http://aumha.net/ - Click on the HijackThis forum. Read the announcement
and the stickies *first*.
http://www.atribune.org/forums/index.php?showforum=9
http://aumha.net/viewforum.php?f=30
http://www.bleepingcomputer.com/forums/forum22.html
http://castlecops.com/forum67.html
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

 

[jacqui]

thank you malke for direction.

"Malke" wrote:

> jacqui wrote:
> > I have 2 computers XP pro on a home network.They were behaving very
> > strangely and slow etc. AVG free has found worm/delf.eyr in both and shows
> > as 1. c:\drivers\video\HKCMH.EXE Back up copy infected 2. C:\System Volume
> > Information\_restore {numbers here}\RP1187\A0130456.EXE Back up copy
> > infected.
> > What do I do now. Can I just empty the virus vault.
> >
> Delf infections are extremely difficult to remove and you will need
> guided help. Simply emptying the Virus Vault will not do it. Go to one
> of the specialty forums listed below, register, read the posting FAQ,
> and post a HijackThis log there (not here).
>
> http://aumha.org/downloads/hijackthis.zip
> http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Merijn
> http://www.bleepingcomputer.com/forums/index.php?showtutorial=42 -
> another tutorial
> http://aumha.net/ - Click on the HijackThis forum. Read the announcement
> and the stickies *first*.
> http://www.atribune.org/forums/index.php?showforum=9
> http://aumha.net/viewforum.php?f=30
> http://www.bleepingcomputer.com/forums/forum22.html
> http://castlecops.com/forum67.html
> http://www.dslreports.com/forum/cleanup
> http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
> http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
>
> Malke
> --
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic!"
> MS-MVP Windows - Shell/User
>