Content

PWS-Mmorpg.gen!2B5B9C80

Type
Trojan
SubType
Password
Discovery Date
06/12/2008
Length
131208
Minimum DAT
5316 (06/12/2008)
Updated DAT
5316 (06/12/2008)
Minimum Engine
5.1.00
Description Added
06/12/2008
Description Modified
06/12/2008 11:27 PM (PT)
Risk Assessment
Corporate User
Low
Home User
Low

Tab Navigation

Characteristics

File Property Property Value
File Name 11.exe
McAfee Detection PWS-Mmorpg.gen
Length 131,208 bytes
CRC32 2B5B9C80
MD5 9B73E3FBDBFCE40CE7D9822FAEAC3160
SHA1 7E6908920F5FFD334EE6D34BD5F252EA30C61D93

Other Common Detection Aliases

Company Name Detection Name
AVG (GriSoft) PSW.OnlineGames.AD
BitDefender Packer.Nsanti.1.Gen
Dr.Web ~Win32.Besso
eSafe (Alladin) suspicious Trojan/Worm [101]
FortiNet W32/OnLineGames.fam!tr.pws
F-Prot ~W32/Onlinegames.gen
Microsoft PWS:Win32/OnLineGames.DL!dll
Rising Packer.Win32.Mian007.a
Sophos Mal/EncPk-DH
Symantec Packed.Generic.61
Trend Micro PAK_Generic.005
Vet (Computer Associates)
 Win32/Lineage!generic

Avert® Labs has observed the following system activities:

Activity Risk Level
Modifies Memory of Other Processes
 High
Enumerates open windows
 Low
Writes Executable in the Windows Folder
 Low
Registers DLLs Informational

System Changes

These are general defaults for typical path variables. (Although they may differ, these examples are common.):
%WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

The following files have been added to the system:

  • %WINDIR%\help\eb6c4499b05f.dll
  • %WINDIR%\help\eb6c4499b05f.exe

    The following registry elements have been created:

  • HKEY_LOCAL_MACHINE\software\classes\clsid\{1dbd6574-d6d0-4782-94c3-69619e719765}\
    • (default) = ssuudl
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{1dbd6574-d6d0-4782-94c3-69619e719765}\inprocserver32\
    • (default) = c:\windows\help\eb6c4499b05f.dll
    • threadingmodel = apartment

    Symptoms

    This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.

    Method of Infection

    Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.

    Removal

    AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

    Additional Windows ME/XP removal considerations

    Variants

    Variants

      N/A

    All Information

    Overview -

    This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include e-mail, malicious or hacked Web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

    Characteristics

    Characteristics -

    File Property Property Value
    File Name 11.exe
    McAfee Detection PWS-Mmorpg.gen
    Length 131,208 bytes
    CRC32 2B5B9C80
    MD5 9B73E3FBDBFCE40CE7D9822FAEAC3160
    SHA1 7E6908920F5FFD334EE6D34BD5F252EA30C61D93

    Other Common Detection Aliases

    Company Name Detection Name
    AVG (GriSoft) PSW.OnlineGames.AD
    BitDefender Packer.Nsanti.1.Gen
    Dr.Web ~Win32.Besso
    eSafe (Alladin) suspicious Trojan/Worm [101]
    FortiNet W32/OnLineGames.fam!tr.pws
    F-Prot ~W32/Onlinegames.gen
    Microsoft PWS:Win32/OnLineGames.DL!dll
    Rising Packer.Win32.Mian007.a
    Sophos Mal/EncPk-DH
    Symantec Packed.Generic.61
    Trend Micro PAK_Generic.005
    Vet (Computer Associates)
    		 Win32/Lineage!generic

    Avert® Labs has observed the following system activities:

    Activity Risk Level
    Modifies Memory of Other Processes
    		 High
    Enumerates open windows
    		 Low
    Writes Executable in the Windows Folder
    		 Low
    Registers DLLs Informational

    System Changes

    These are general defaults for typical path variables. (Although they may differ, these examples are common.):
    %WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
    %SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
    %ProgramFiles% = \Program Files

    The following files have been added to the system:

  • %WINDIR%\help\eb6c4499b05f.dll
  • %WINDIR%\help\eb6c4499b05f.exe

    The following registry elements have been created:

  • HKEY_LOCAL_MACHINE\software\classes\clsid\{1dbd6574-d6d0-4782-94c3-69619e719765}\
    • (default) = ssuudl
  • HKEY_LOCAL_MACHINE\software\classes\clsid\{1dbd6574-d6d0-4782-94c3-69619e719765}\inprocserver32\
    • (default) = c:\windows\help\eb6c4499b05f.dll
    • threadingmodel = apartment

    Symptoms

    Symptoms -

    This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.

    Method of Infection

    Method of Infection -

    Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.

    Removal -

    Removal -

    AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

    Additional Windows ME/XP removal considerations

    Variants

    Variants -

      N/A