TR/PSW.OnlineGames.rdx - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/PSW.OnlineGames.rdx
Type:	Trojan
In the wild:	No
Reported Infections:	High
Distribution Potential:	Low
Damage Potential:	Low to medium
Static file:	Yes
File size:	10.150 Bytes
MD5 checksum:	f222db1ecca476410Fb383fb5844bdc5
IVDF version:	7.00.02.180 - Fri, 22 Feb 2008 15:56 (GMT+1)

General Aliases:
   • F-Secure: Trojan-PSW.Win32.OnLineGames.rdx
   • Eset: Win32/PSW.OnLineGames.PBQ trojan

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003
   • Windows CE

Side effects:
   • Drops files
   • Registry modification
   • Steals information

Files It copies itself to the following location:
• %sysdir%\KABKAB1032.exe

The following files are created:

– %sysdir%\KABKAB1032.dll
– C:\f9cafde592ab8303437.bat

Registry The following registry key is added:

– [HKCR\CLSID\{4f79092a-66ba-4317-b2c7-f839909661f0}\InprocServer32]
   • "(Default)"="KABKAB1032.dll"
   • "ThreadingModel"="Apartment"

The following registry key is changed:

– [HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\
   ShellExecuteHooks]
   Old value:
   • "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
   New value:
   • "{4f79092a-66ba-4317-b2c7-f839909661f0}"="KABKAB1032.dll"

File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• Upack 0.39

See a brief description here.

Description inserted by Irina Diaconescu on Tue, 15 Apr 2008 15:57 (GMT+1)
Description updated by Irina Diaconescu on Fri, 18 Apr 2008 15:12 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back