Trojan Horse Virus problem? D: Win32:Delf-MZG?

Question

Trojan Horse Virus problem? D: Win32:Delf-MZG?

Answer 1

This is happening for any .exe file that you try to run. Its false and Avast is working on it.

Answer 2

Avast and at least one other anti-virus vendor are having a problem with false positives for Win32:Delf-MZG and Win32:Zbot-MKK. Take a look at http://virusscan.jotti.org/ and run the file through there. If only Avast and G Data show that it is infected, then I would temporarily disable Avast and check for updates every 30 minutes or so. (Note: It is never wise to have a Windows based computer on the internet without an anti-virus.)

Answer 3

Yep, my copy of Avast has gone mental - right across the home network. Picking up multiple problems in Spybot and an MS Word add-in (PDF Complete) that came pre-packaged with the computer two years ago!



Everything's suddenly started flagging. Would second what earlier person suggested re: waiting until the next update, then restoring the flagged items from the chest - presuming that you moved them there.



EDIT: They just released a VPS file update. Appears to have cleared the problem up. May require an OS shut-down/restart if programmes were critically disabled.

Answer 4

Avast is detecting a lot of things right now on my system,Like Skype,Note Tab and My Web store software. It shows Win32:Delf-MZG [Trj]. Its something in an update for Avast i think.

Answer 5

Issue



On Thursday 3.12. 2009 avast! had a bad false positive issue. At around 00:15 AM GMT we released VPS update 091203-0 which started flagging hundreds of innocent files as a 'Win32:Delf-MZG' Trojan (or, in less common cases, as 'Win32:Zbot-MKK'). Among the files affected were high-profile programs produced by Adobe, Realtek, sound card drivers, various media players etc.



Solution



On Thursday 3.12. 2009 at 5:50 AM GMT, another VPS update 091203-1 was released, fixing the issue (for both 'Win32:Delf-MZG' and 'Win32:Zbot-MKK'). If you're still using the bad VPS 091203-0 we recommend to invoke a VPS update immediately. To restore false positive files from avast! Virus Chest please follow the instruction in the following article:



Restoring false positive file from Virus Chest



Those who have not used their computers between 00:15 AM GMT and 5:50 AM GMT will most likely not be affected.



We deeply apologize for any inconvenience this has caused.



ALWIL Software

Answer 6

I had the same problem this morning and I panicked when I found 187 files had been infected. I thought it was something I installed yesterday evening. After reading these messages I realize it must have been the update I got last night.

This morning I installed a program update from Avast.

Answer 7

I had the same issue 2nite. I ran a thorough scan using avast and it reported dozens of files affected with the same issue as you. I could not download without a virus alert. Many are reporting this issue. I hope this eases your thought process. I think we'll be ok.

Answer 8

I have just instaled Skype again since avast reported it as a virus, and again when skype added ezPMUtils.dll and skypePM.exe, avast reported them as viruses witch there is no way that they are, there was no time and they are cleane right from freshly downloaded skype instalation file,



was there any official anounsment from avast about this crap?





Avast ahs just updated and fixed the problem !!!

you can turn it on again and update it

Answer 9

At this time (Thursday December 3th / 5:36 CET) the latest VPS (virusdatabase) update of Avast is flawed. It marks various files as Win32:Delf-MZG. They are false positives.

Answer 10

The Internet is full of messages that have appeared in the past two hours. Seems the most current Avast! update has a glitch, and is giving false positives. I have the same problem. Not a problem.



Avast! should fix this within 24 hours, or in their next update. If you do a Google search, you will see a bunch of links that have all been detected by Google in the past few hours.



For the time being, don't delete all your files. Send an email to Avast! and tell them about the issue. They should advise you when it is fixed.

Answer 11

First of all. you only run ONE av propgram at a time, in real time. If it misses anything, Most peeps use these two.. free. http://www.malwarebytes.org/mbam.php

http://www.superantispyware.com/download.html

Lose all but one av program.. no. 1 is avast. http://freebies.about.com/od/securityfreebies/tp/best-antivirus.htm

Lose spybot, this is better. http://www.superantispyware.com/download.html @



Edit : If you do not know,,antivirus,and antimalware and antspyware are different. You have too many av programs. You can have more than one antimalware, and more than one antispyware, but , only one antivirus.Get the terms right.

Answer 12

If you are using Avast and it detected Win32 DELF-MZG Trojan today it is a false positive. Avast is detecting programs written in the programming language DELPHI as having the virus.

Your Avast program will move these detected files to the "CHEST".



The files have not been deleted !!!!!

Unless you selected them to be deleted upon detection.



But if Avast detects a virus it usually moves it to the chest. You can recover your "infected" files from the chest. To do this, left click on the "a" inside the blue ball down by your clock in the task bar. Select "start avast! Anti-virus". Once the program is open look for the button that looks like a little treasure chest, depending on the skin you have chosen. Click on the chest and you will see your files. There is an option to recover and that will put them back where they came from. But I suggest you wait until Avast has fixed this problem before you recover them. Also make sure that you only recover files that were detected today to be sure you do not re-infect your computer with an older virus. If you are not sure don't panic. Avast should detect any old viruses and move them back to the chest. If you are having trouble you can email me and I can help you out. But do yourself a favor - Don't run any of the suggested spyware/malware/ adware removal programs. Its not necessary. Avast will fix this soon.

Answer 13

2

Answer 14

I just started having the same issue today 12/13/09. I've got a lot of installer programs on a seperate D: drive which I'm sure are pretty clean of viruses (I know this because I scan them thourougly first, a best practice for an average computer user, which you do too), now im getting a lot of notifications from my AVAST HOME EDITION about these files being infected and started moving them to the chest, I just realized that there were too many of these files that were infected to be true, I'm thinking Avast is experiencing a false positive where they're falsely detecting clean files as infected ones, which happens oftenly every now and then. But then of course I could still be wrong, have'nt done much research on it yet. my advice.. keep those files in the chest, I really think there's something wrong with Avast right now.

Answer 15

Win32:Delf-MZG[trj]



I first ran into this trojan threat when trying to verify a file integrity. Avast! antiviral told me that my Filealyzer was infected. I quarantined the trojan and uninstalled Filealyzer. I then ran a standard scan, and found that it had also apparently infected a eyeLook.dll in X-Lite, an audio deck patch, something in vinyl deck, and four restore files. I went online to try to find out more about this trojan and found speculation about false positives, so I restored the files from quarantine. This morning I updated the Avast! iAVS to current version 091203-1, re-ran the scan, and found ten infected files, (the original seven, plus three more in the windows restore system). The fact that McAfee and Kaspersky's databases don't have anything on this backdoor trojan doesn't mean it's not real. Trojans do stuff like this. I don't think that this is a false positive!

Answer 16

Its very simple really. Avast says its a sample of the trojan horse detected, but why take chances on a Code that may have been cracked by hackers. Ive had to repair manySpy-Botters, aka virus removal, and it isnt pretty. Good thing I do it cheap unlike some other Companies I know. Anyway, my Avast caught it in SpyBot and Lavasofts Adware. So, I deleted both programs after Aembeddeds done scanning. In a nut shell, if Avast is coming up with false positives then there will be an update to fix it. If there is a Trojan embeded in the codes of the mentioned programs, then youll see an updated release from them.



To delete the now incomplete programs of Spy-Bot or whatever... Go into youre C: Drive or whatever drive your operating system is on, program files, scroll to the Spy-Bot folder, Right click, Delete. Then go to Start, Control Panel, Add Remove Programs and remove Spy-Bot. Delete Spy-Bot off your desk-top (if you have it there) Right click, Delete. Go to start, Programs, Spy-Bot, Right click, Delete.



Side Note... I have 4 running computers in my house. If this was a false positive, I wouldnt get a different number of the same Trojan detected, I would have had an equal amount. But, I didnt. 56 on one, 108 on another, 85 and so on.

Answer 17

Okay....same problem. It's obviously an Avast issue and some people said that Avast is working on it. However, that doesn't solve your problem because like me, you deleted some necessary files.



Here is a quick fix to the problem.



Go to "start" then "search".

Click "all files and folders"

In the "name" box, type "restore"

When the search results show "System Restore", hit the "stop search" button.

Double-click on the "system restore" link in the search results.



System restore will now walk you through the next steps. Select the restore date closest to the time this problem started.....for me, it was easy....it started today, at 11pm, so I selected yesterday's restore point.



Let restore do its thing and restore and restart your system.



Now......once you're up and running again, open "Avast" and allow it to run through its start-up process. It WILL sound the alarm during start-up, but just ignore it and hit the "continue" button and keep doing it until it finishes start-up.



Once it is done, click on the "resident scanner" button and push it all the way back until it reads "disabled".



This will prevent Avast from reading files without your permission and stop the interruptions.



Keep it that way until Avast alerts you that they have solved the problem.



Good luck!

Answer 18

A lot of people are saying things like "Hey I've been using this software for years, it's never been a virus you stupid Avast!". But your beloved software could have been infected just hours ago...so it doesn't mean anything whether you've used it for years or not.



As for the current problem with Avast!, indeed it looks like the new virus database recognize too many softwares as Trojan horses. I need to pause Avast! each time I want to use MySQL Query Browser (which I checked on http://www.virustotal.com et http://www.kaspersky.com/scanforvirus before using it, just in case) and then I resume it.



Of course, DON'T REMOVE ANY FILE UNLESS YOUR 100% SURE IT'S A VIRUS!!! Also don't start removing exe or dll files, as it'll most probably make your software not work anymore. Antiviruses are not Gods, they never know for sure whether a file is a virus or not, so use your common sense before doing any dangerous thing.

Answer 19

hi, spy bot is not! I repeat not a trojan, virus or anything it is a legit program hell I have been using it for going on 3 and a half years, this crap just started today about 3 hours or less after avast automatically updated the virus definitions and signatures.. it also tryed to flag online armer, and skype 4.0 which I have installed over a month ago and its just now telling me? I seriously think alwil software is in hot watter, and needs to resolve this quick there are thousands if not millions of people that use avast, spy bot and skype as well as online armer although the latter I haven't herd much about. I myself am a blind user so this is a pain in the *** for me being as some times my screen reader crashes! so its quite irritating. at first I thought it was something I did or downloaded or installed, so the majority of my day for the past 2 hours has been sorting this mess out! hth

Answer 20

My friends we all have come under FRIENDLY FIRE.



WARNING - AVAST has a tendency to go crazy from time to time.



If you're anyway like me - someone who cares a lot about their computer and would do anything to rid any Virus, Trojan and the likes - I listened to AVAST and started to "CHOP" the files reported by AVAST - but incidentally, last night the computer did behave badly. But I deleted many so called good programs that Avast reported but then again the data is more important then the software itself.



Just re-installed the non-functioning programs and you will get back the software and the data.



Just shows one how much we live in fear of loosing our things...damn evil world.

Answer 21

I got the same for many programs that i've been using since long time ago and many files that existed on my pc also long time ago.



i searched online and it seems like it's a false positive and something was wrong with the last avast update, i think i read somewhere that a fix has already been released but I'm not sure if this is true or if the fix is yet to be released in the next 24-36 hours. I'm now updating my avast, so i suggest you also update yours and see if this stupid false positive goes away.



this really sucks from avast although i liked them a lot. i hope they won't ruin their reputation.

Answer 22

I had the same problem today. I ran Avast. When the warning popped up, I clicked the "Move to Chest" button. After the virus check was done, I opened up the chest, highlighted all the files that were contaminated and deleted them. Then I was able to uninstall SpyBot.

Answer 23

G-Data has the same problem because it also uses the Avast! detection engine along with the engine from BitDefender.



If G-Data has your files in Quarantine just leave them there and update the virus definitions. Once this completes, open the Quarantine, select a few of the quarantined files from the list and then click Disinfect. I recommend only doing a few files at a time as this process can be time consuming depending upon the size of the files. I had 220....

Answer 24

Don't panic, we are all experiencing this problem with Avast.



what you can do is just turn it off and wait for a go signal if avast is already ok with a new update.



I think we all got this "Win32:Delf-MZG" problem because of the last update, and because of this, there are a lot of false positive hits (my kmplayer and TuneUp utilities got a false positive, and I've been using these for quite some time now). Let's just hope that they will fix it in the next one.



Oh and if you think you're not ok with turning your antivirus off, just don't do anything extra today. or you can install another antivirus/antimalware.



EDIT:



It's ok now. there was an update a few minutes ago and those false positives will go away.

Answer 25

Seeing the same thing. Create a system restore and start backing up your files just in case.



Stop on-protection from Avast by right clicking on the icon and clicking the stop on-protection. This is a false positive.



I've noticed this on both my XP and Vista-64 machines. On my Vista-64, it was triggered by opening SpyHunter. Avast is now disabled until they fix this.



Keep in mind, if you select delete or move-to-chest after Avast gives you alerts, it will affect those programs that it is scanning. You have to stop Avast, otherwise your programs that it touches will not work.

Answer 26

Same problem here. Avast going haywire. It's gone balls to the wall anal on my Spybot, Ad-Aware, Ares Lite, freaking Studio 8 which I bought from Best Buy not some obscure website, and even part of the hot coffee package for my Grand Theft Auto: San Andreas.



It happened on my desktop PC. And I know it's all hooey because the same happened to my laptop now, which I haven't turned on in over a week. Just wait for further updates.

Answer 27

ITS A FALSE POSITIVE.. NOT A VIRUS.

in Avast!'s most recent update, (currently being downloaded by all Avast users all over the world) avast marked all programs written in with Delphi programing such as Skype, Spybot, online armor and others, as a virus.

Then Avast proceeds to remove all these programs, and mark them as viruses as you boot up your computer. This can cause a crippling effect on your system, as my dad learned earlier today.

The update was sent out earlier this morning and was most likely downloaded a couple hours ago by all avast users.

We thought that someone had downloaded WIN32: DELF-MZG (TRJ) and it was spreading over our other computers. Luckily I run a mac which there isnt a version of Avast for. My dad lost all his business files since a lot of them were programed in Delphi.



THE ONLY THING YOU CAN DO (Until Avast! fixes this error):

1. Turn off computer and reboot in safe mode by holding F8.

2. Log in as Admin,

3. REMOVE AVAST completely from computer, do not allow it to run anymore scans.

4. Get a new anti-virus until Avast teams fix this problem.



All i can say now is that shame on you Avast for crippling all 5 PCs in my house and causing ireplacable damage to files and directories.



i hope you can catch this b4 it does to your PCs what it did to mine.

Answer 28

The Best way to Remove all kind of Virus,Trojans,Malware,Spyware,

Worm,Pop Up Advertisements ,Hijack Web browser rootkit and all Rogue Fake

Anti-virus in you Computer is Restart You Computer Safe Mode with Networking



1. Log out and reboot your machine.



2. When the machine starts the reboot sequence, press the F8 key repeatedly.



3. Select Safe Mode with Networking from the resulting menu.



4. Login. If the malware has changed your password, try logging in as

Administrator. By default, Administrator has no password.



5. The machine will continue booting, but the Windows desktop will look different.



Then in The Safe With Networking .Download and Scan By Using Malwarebytes’ Anti-Malware http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?tag=contentBody;mostPopTwoColWrap&cdlPid=10997763

Download and Scan By Using Super Anti-Spyware Press here http://www.superantispyware.com/



Download and Scan By using Norman Malware Cleaner Press here http://majorgeeks.com/downloadget.php?id=5450&file=1&evp=6980e63d4e482f0670e991265b3250e7



Download ATF is a new, freeware, temporary file cleaner for Windows, IE, Firefox and Opera with a simple, easy-to-use interface.



The main screen allows the user to either clean all temporary files, or select files for cleaning. The program also knows if Firefox and or Opera is being used, and gives the option of cleaning the temporary files associated with those applications.



ATF Cleaner provides the user with a window showing the total bytes freed upon completion. The program is small (36kb), quick to run and no installation required. to Download ATF Cleaner press this link http://majorgeeks.com/ATF_Cleaner_d4949.html



6. When you're finished Remove Virus, Malware, Trojan, Worm,

rogue

virus rootkit and

Spyware log out and reboot back into normal mode

Answer 29

I uninstalled Avast as it took quite a few of my programs out and installed AVIRA free anti-virus until they fix AVAST. One of the posts I saw advised this so I did and all is fine now after having to install the programs it messed up back onto my hard drive. It even went into programs that I have had for years, like free Star Download. What a headache and I hope they fix it soon as I do like the program.

Answer 30

This is happening to me, too. I'm getting this trojan warning from avast opening a program that I've run for years with no problem until today. So I tried to open CA Yahoo! Anti-Spy, and got the message as well. When I hit "No Action", it still wouldn't let me open the program, and Windows Vista said that it couldn't find the file.



It's aggravating as heck! I hope Avast fixes this soon.

Answer 31

Same thing is happening to me. Got the Delf-MZG when I tried to open spybot...now I get same cannot remove problem. Also has done this with 6-7 other programs and now none of them work. seems like evry program I try to open I get the Trojan pop up and then the program does not work

Answer 32

WAIT FOR A NEW UPDATE BEFORE DOING ANYTHING DRASTIC LIKE DELETING FILES !!!



AVAST must have had a bad update...



I have this happening on my system right now as well.



I have checked most of the reported files, and there was a lot of files reported as being infected, on a site called - http://virscan.org/ -



This site reports from 37 different virus scanners. It tells me that pretty much ALL the AVAST reported infected files are reported by them alone, or them and Gdata.



NONE of the other large anti-virus companies are reporting my files as infected.

Answer 33

It is definitely a malfunction within Avast and related to the latest Avast definitions update that many of us, auto received this evening. Our computer programs and software are just fine. Avast is investigating and working to resolve this issue which is proving to initiate false positives on numerous windows and program files. "Perhaps, it's Avast that has the Virus...within" LOL

Answer 34

My desktop is showing the same virus when one click maintenance (Tune Up utilities 2008) runs and I have been running this program for 1.5 years no probs. My laptop has Bitdefender however and nothing has been detected with THAT version of Tune Up 2008.... I suspect this is an Avast problem not a virus with our software. i chose to take no action at this stage as it would only let me delete my program and not 'move to chest'



Good Luck

Answer 35

Hey buddy, sorry to burst your bubble, but antiviruses don't remove adwares. Since you're facing problems with frequent pop-up ads, I suggest you to run an anti-spyware in your computer and perform a full scan in safe mode so that you can get rid of all the existing adwares. Some of the best adware removal softwares, according to their market popularity, are listed below for your reference:



1. Comodo anti-malware BOClean

2. Bitdefender

3. Kaspersky

4. Norton

5. F-Secure

Answer 36

Avast fixed it. Just do an iAVS update and everything will be back to normal.

Sometimes glitches like these do happen, and they've done a good job by fixing the problem in such a short notice. I say we don't need to go down too hard on them, after all we're not paying them to protect our home computers, especially when they've done a good job all these years.

Answer 37

This seems to be a bug in the latest update. today is the 5th of december (1st time i started this computer since sunday the 19th nov) in australia and it took a while to update, and i installed winx hd video converter then it had the false trojan. then it did IZarc dll file so i got suspicious. What went wrong with Avast!?

Answer 38

I have the same false positive here. Avast was flagging C:\Program Files\Logitech\SetPoint\KEMMAPI.DLL as having Win32:Delf-MZG TROJAN.



I just update the program and the definition file and false positive is gone.

Answer 39

Problem Solved!!!



Avast just released a new VPS file which has stopped the false-positive. I've re-scaned my chest and it turns out that none of my files are infected! Update your avast and it should help!

Answer 40

Press F8 during boot, log in as Admin and go to "Add/Remove Programs", remove Avast, and restart. Avast almost destroyed my computer!

Answer 41

A new update was issued a couple of minutes ago and the problems seem to be cleared up. Everything on my system that was showing as a virus is now working as before.

Answer 42

You obviously can't remove spy bot because you deleted some necessary files for the uninstalation.Check the trash bin and return the file...if u emptied the bin you will probbably have to delete all the Spybot files on computers disk(s) and in registry.I personally would bet on false positive ,but im not shure....I got it in spy bot and tuneup utilities also......we'll see

Answer 43

Yeah the update happened yesterday or today.

It already destroyed a bunch of my programs and my key board is acting up.

What a bunch of idiots they got working over at Avast !

Don't they bother to check their sh!t before they send it out ?

Answer 44

My computer is doing the exact same thing! I have Avast too btw. Hopefully it's just a bug with Avast and not an actual virus......

Answer 45

Lol yeah we're all getting them - check out avast forums,the stupid things going crazy.It was the last update with some bug in it,don't scan anything else,don't download anything with avast running.You're not infected - just restore everything from the chest once it's sorted out.

Answer 46

If you have downloaded your software from reliable source you don't have to worry about. Chances for false positive are 99.9%.



All we have to do is to wait for another iAVS update for Avast and click NO ACTION when action is required.

Answer 47

EASY FIX!!!





Right Click on the Avast Icon in your taskbar, click updating and update iAVS.





Thats all you need to do

Answer 48

My laptop is doing the same thing! Odd that my desktops don't have a problem though, and they both are running the same version of avast that my laptop is. Hmmm....hope they get this straightened out.



And btw xyz87, sometimes the D: drive is a second hard drive, where the CD drive would be the E: drive...might help to know what you're talking about before you talk about it. ;)

Answer 49

This could be another software bug or a false-positive detection which is very common to antivirus programs update and patches. This is according to this forum.

http://www.precisesecurity.com/trojan/win32delf-mzg-trj/

Answer 50

It was a false positive, but now (13:46 GMT) it's solved.

Answer 51

Trojan horse sucks! i had it i had to send my computer they had to scrub my hardrive be very careful and i would call tech support if its bad like mine was then u might have to send it away for experts get new memory if u want u could clear ur whole hardrive. i think you are infected. not sure but restart it well duh. and keep pressing delete then clear your recycling bin!!! CLEAR IT!! make sure to!

Answer 52

Well, does this only occur when you try to uninstall Spybot? I could help you but I would need some more information. Also what would work better if I could see the problem you were having. If you would like my expertise in this, then feel free to visit me at: http://crossloop.com/nickstonica

Answer 53

well sorry but your F**ked you need too reset your whole computer , with a disk of what ever os your runing on (N)

Answer 54

I too have the same problem and my system just stopped at welcome screen itself so i have no option other than deleting my files.

Answer 55

lmao false alarm

i cant open my zoom player, which have always being working fine

Answer 56

thanks kaayo lord abi nako ako ra naka experience ani!!! the problem is in the new updates of avast. cheerz!!!

Answer 57

thats what happens when you use too many antivirus and too many spyware on same computer. You are using avast, avg, avira, comodo, malware bytes and spybot all the same time. it is obvious you'll have computer problem.



Oh and drive D is not even the hard drive. Its the place where CD rom is.

Answer 58

run boot time scan wit ur avast...... thn it ll b alright........ bcz i tried it ..... it worked fr me.....

Answer 59

thanks so much, i was browsing my droid and found this, thankfully i stopped before doing too much damage