virus logo Virus

W32/OnLineGames.ES!tr.pws

description-logoAnalysis

  • The malware drops the following files, both of which is in the Current User's Temp folder:
    • upxdn.exe
    • upxdn.dll
  • Adds the following value to run itself at each Windows startup:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
      upxdn = "undefinedTempundefined\upxdn.exe"
  • The malware has an approximate filesize of 13KB.

    • recommended-action-logoRecommended Action

      FortiGate Systems
    • Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.
      FortiClient Systems
    • Quarantine/delete files that are detected and replace infected files with clean backup copies.

    Telemetry logoTelemetry

    Detection Availability

    FortiGate
    Extended
    FortiClient
    FortiMail
    FortiSandbox
    FortiWeb
    Web Application Firewall
    FortiIsolator
    FortiDeceptor
    FortiEDR

    Version Updates

    Date Version Detail
    2023-08-01 91.05634
    2022-01-13 89.08666
    2019-08-13 70.68900 Sig Updated
    2019-06-30 69.64000 Sig Updated
    ID 318779
    Released Feb 15, 2007
    Description
    Updated    		 Feb 16, 2007
    Aliases .
    Platform Profile Win32 file format / PE 32 bit
    Profile Type Trojan Password Stealing (tr.pws)