This application requires Javascript for optimal performance.

W32/OnlineGames!tr - Released Apr 12, 2007 - Last Updated Jul 14, 2008

Alias/es

Trojan-PSW.Win32.OnLineGames.oe (KAV), Win32/PSW.Agent.NCC (NOD32), PSW.Generic3.VNO (AVG), W32/OnLineGames.AME!tr, OnlineGames.BD!tr.pws, W32/OnlineGames.BD!tr.pws

Detection Availability

Active DatabaseExtended Database
FortiGate
low
high
FortiClient
FortiMail N/A

Visible Symptoms

  • It deletes itself from the current directory.

  • Possible firewall alert that an executable is attempting to connect to the internet.

    • Detailed Analysis


  • It copies itself to the Windows folder using a random filename.

  • It drops a DLL file with a random filename in the System folder.

  • It adds the following registry:
    • key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    • value:AppInit_DLLs
    • data: {RANDOM}.dll
    • key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • value:{RANDOM}
    • data: {RANDOM}.exe
    Note: {RANDOM}.dll and {RANDOM}.exe are the dropped files of the malware.

  • Searches for the following online games and steals their account information:
    • YouXiChaYuan
    • Perfect World
    • World Of Warcraft
  • The stolen information is sent to the following URL:
    • http://www.ck{REMOVED}.com/wow5566/lin111.asp
  • Injects code into the process explorer.exe.

    • Recommended Action

      FortiGate Systems

    • Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.

      FortiClient Systems

    • Quarantine/delete files that are detected and replace infected files with clean backup copies.

    Reference: ID - 347958