Igw.exe virus analysis and troubleshooting methods

File Name: IGW.exe
Size: 68913 bytes
MD5: 39c920088e5d153c6d2e42413b0e460c
Shelling: N/
Programming Language: Delphi
Virus name: kaspersky: Trojan-PSW.Win32.OnLineGames.eif
Rising: N/
Duba: N/

Details:

File changes:
Release files
%Windows1_igw.exe
% WINDOWS % 338448WO. DLL

Virus creation startup Item:
[HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun]
"WinSys" = "%windows#igw.exe"

Add registry:
[HKLMSYSTEMCurrentControlSetControlSession Manager]
"PendingFileRenameOperations" = "% WINDOWS % uuuu12999"

How to clear the igw.exe virus:
1. End the process
%Windows1_igw.exe

2. Delete the registry key created by the virus
[HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun]
"WinSys" = "%windows#igw.exe

[HKLMSYSTEMCurrentControlSetControlSession Manager]
"PendingFileRenameOperations" = "% WINDOWS % uuuu12999"

3. delete files released by viruses
%Windows1_igw.exe
% WINDOWS % 338448WO. DLL