PSW. Win32.OnLineGames. buv Trojan Analysis

Virus: Trojan-PSW.Win32.OnLineGames.buv

Virus Type: Trojan

File MD5: EF4E9F7427CB570E4A91BEE2B9545D31

File length: 24,953 bytes

Infected system: Windows 98 or later

Development Tool: Borland Delphi 6.0-7.0

Shelling type: Upack 0.3.9 beta2s

Virus description:

The virus is a trojan. After the virus runs, it copies itself to the system directory to derive the virus file. To start Trojans and steal accounts and passwords of perfect world, Wulin, and xiaoxian.

Behavior Analysis:

Local behavior:

1. After the file is run, the following files will be generated:

C: WINDOWSkulionwl. dll 29,184 bytes

C: WINDOWSwinwl.exe 24,953 bytes

2. kulionwl. dll is inserted into the EXPLORER. EXE process.

To start Trojans and steal accounts and passwords of perfect world, Wulin, and xiaoxian.

4. Once the information is stolen, the information sending module is activated and the stolen information is sent in a fixed format.

Note:

% Windir % mongodws directory

% DriveLetter % logical drive root directory

% ProgramFiles % default system program installation directory

% HomeDrive % partition of the current startup system

% Documents and Settings % root directory of the current user document

% Temp % current user TEMP cache variable; Path:

% Documents and Settings % current user \ Local SettingsTemp

% System32 % is a mutable path;

The virus queries the operating system to determine the location of the current System32 folder;

In Windows2000/NT, the default installation path is C: WinntSystem32;

In Windows 95/98/Me, the default installation path is C: WindowsSystem;

In Windows XP, the default installation path is C: WindowsSystem32.

Clear Solution:

1. You can use the CERT Trojan line to completely clear the virus (recommended). Please download www.antiy.com from the CERT website.

2. manually clear the file according to the behavior analysis and restore the relevant system settings. We recommend that you use ATool, ATool: www.antiy.com or http://www.antiy.com/download/index.htm.

(1) Use the CERT Trojan defense line or the "Process Management" in the ATool to disable virus processes.

(2) Forcibly delete virus files

C: WINDOWSkulionwl. dll 29,184 bytes

C: WINDOWSwinwl.exe 24,953 bytes