Content
PWS-OnlineGames.bd
- Type
- Trojan
- SubType
- Password Stealer
- Discovery Date
- 06/18/2008
- Length
- varies
- Minimum DAT
- 5320 (06/18/2008)
- Updated DAT
- 5320 (06/18/2008)
- Minimum Engine
- 5.1.00
- Description Added
- 06/18/2008
- Description Modified
- 06/24/2008 12:18 AM (PT)
Tab Navigation
Characteristics
There are several variants of the trojan. The description is a general guide.
Upon execution, the trojan drops the following files:
- %Windir%\Help\F3C74E3FA248.exe (PWS-OnlineGames.bd trojan)
- %Windir%\Help\F3C74E3FA248.dll (PWS-OnlineGames.y.dll trojan)
The following registry keys are added:
- HKEY_CLASSES_ROOT\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}
"(Default)" = SSUUDL - HKEY_CLASSES_ROOT\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32
"(Default)" = C:\WINDOWS\HELP\F3C74E3FA248.dll
"ThreadingModel" =Apartment
The dll file is injected into running processes and is reponsible for monitoring account information of onlinegames. The trorjan attempts to connect the following remote sites to send the gathered information.
- http://www.163.com/[removed].php
Symptoms
- Existence of files and registry keys mentioned above.
Method of Infection
Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.
Removal
All Users:
Use current engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Variants
Variants
N/A
All Information
Overview -
This is a generic detection covers password stealing trojan for online games.
Characteristics
Characteristics -
There are several variants of the trojan. The description is a general guide.
Upon execution, the trojan drops the following files:
- %Windir%\Help\F3C74E3FA248.exe (PWS-OnlineGames.bd trojan)
- %Windir%\Help\F3C74E3FA248.dll (PWS-OnlineGames.y.dll trojan)
The following registry keys are added:
- HKEY_CLASSES_ROOT\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}
"(Default)" = SSUUDL - HKEY_CLASSES_ROOT\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32
"(Default)" = C:\WINDOWS\HELP\F3C74E3FA248.dll
"ThreadingModel" =Apartment
The dll file is injected into running processes and is reponsible for monitoring account information of onlinegames. The trorjan attempts to connect the following remote sites to send the gathered information.
- http://www.163.com/[removed].php
Symptoms
Symptoms -
- Existence of files and registry keys mentioned above.
Method of Infection
Method of Infection -
Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.
Removal -
Removal -
All Users:
Use current engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Additional Windows ME/XP removal considerations
Variants
Variants -
N/A
