trojan :Trojan-PSW.Win32.OnLineGames.dad

Risk level: Medium

virus Description

The sample was used “UPX” packers way in an attempt to evade signature scanning, the size after packed “36,864 bytes”, icon ““, virus extension “exe”, mainly through the “file bundle”, “download Tools download “,” page linked to horse “, etc. to spread, the viruses for the primary purpose of forcing the user to access the specified URL viruses, advertising and promotion to increase their website traffic and hits.
After the user’s computer was infected, the computer will appear to run Slow, the network speed is reduced, a large number of unknown processes, a large number of open IE browser pop-up ads, windows error and so on for no reason.

Infection in the operating system

Windows 2000/Windows XP / Windows 2003

Transmission

Trojan, file bundle, download manager

Manual Solution:
1, manually delete the following files:

% Temp% \ elementgj.dll
[Game installation directory] \ element \ sysGTH.dll
[Game installation directory] \ element \ CPWGame.dll
[Game installation directory] \ element \ comres.dll

Variable declaration:

% SystemDriver% system where the partition, usually “C: \”
% SystemRoot% WINDODWS directory, usually “C: \ Windows”
% Documents and Settings% user file directory, usually “C: \ Documents and Settings”
% Temp% temp folder, usually “C: \ Documents and Settings \ current user name \ Local Settings \ Temp”
% ProgramFiles% system program the default installation directory, typically: “C: \ ProgramFiles”

Virus

(1) traversal process, the end of the game process
(2) by looking at the Registry for the game installation path, copy C: \ WINDOWS \ system32 \ comres.DLL as sysGTH.dll, and then release the game installation directory and comres.dll dynamic library CPWGame.dll
(3) re-iterate the process, if found avp.exe and KVMonXP.exe process, create a batch delete itself
(4) If no avp.exe and KVMonXP.exe process, the release of% Temp% \ elementgj.dll, then load, and set the hook, create a batch delete itself
(5) intercepted a user name and password information sent to the specified URL

Virus to create a file:

% Temp% \ elementgj.dll
[Game installation directory] \ element \ sysGTH.dll
[Game installation directory] \ element \ CPWGame.dll
[Game installation directory] \ element \ comres.dll