win32/delf.PTN

[SunRui]

Hi, anyone can help that if my file server is a windows 2008 64Bit OS, and one of my share folder nonstop to be hided, and some .EXE files with folder icon nonstop to be created. ESET constantly to alert them. what should I do for this? I guess it must be some infected machine in my local network, but how cut the spread?

[yongsua]

Originally Posted by SunRui

Hi, anyone can help that if my file server is a windows 2008 64Bit OS, and one of my share folder nonstop to be hided, and some .EXE files with folder icon nonstop to be created. ESET constantly to alert them. what should I do for this? I guess it must be some infected machine in my local network, but how cut the spread?

If you are not sure whether the file is infected,try this:http://www.virustotal.com/

Upload it and you will know whether is false positive or not.

[tony_m]

Hi SunRui,

Here are some recommendations:

1. Change the password of the account on all affected computers.

2. Close any open network shares or those accessible with weak passwords.

3. Now the best way to clean out the infection on a network would be unplugging all potentially infected computer from network and running a full system scan through ESET from a clean media.

I'd recommend to use ESET SysRescue for this. Below you'll find all necessary steps:

How do I use ESET SysRescue to create a bootable USB flash drive, CD or DVD?

How do I use my ESET SysRescue CD or USB flash drive to scan and clean my system?

4. Once disinfected, you can plug the PC to the network again, create network shares with strong passwords, etc.

Hope this helps.