RAV0088.exe RAV0088. Dat Manual killing method _ virus killing

Virus name: N/A (Kaspersky)
Virus alias: win32.troj.onlinegamest.cu.65536 [DLL] (poison PA)
Virus size: 9,420 bytes
Adding shell way: Pe_patch Upack
Sample Md5:e14c15ece526b8dea5347b1bdad8afe0
Sample SHA1:31BD81EAF9182E9F87A9C2DF55FA748A8C1CE0AD
Discovery Time: 2007.8
Update Time: 2007.8
Associated virus:
Transmission way: Through the malicious website spread, other Trojan downloads


Technical analysis
==========


The game Trojan, after running to copy itself to the system directory:
%system%\rav0088.exe
and release the DLL injection process:
%system%\rav0088. Dat

To create a startup item:


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RAV0088" = "%system%\rav0088.exe"
Cleanup steps
==========

1. Delete Trojan boot entry (to down.45it.com download icesword120_cn.zip delete):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RAV0088" = "%system%\rav0088.exe"
2. Restart your computer

3. Delete Trojan file:
%system%\rav0088.exe
%system%\rav0088. Dat