Trojan-PSW.Win32.OnLineGames.oz

This Trojan is designed to steal online gaming passwords.

When launching, the Trojan writes code to the explorer.exe process by linking LgSy0.dll (or Kavs0.dll - the name of the file may vary in different versions of the Trojan) in order to gain unhindered access to the Internet.

The Trojan harvests the names of gaming servers, player passwords, PIN number and other information. All data relates to a specific well known online game.

The Trojan will sent the harvested data via HTTP to the remote malicious user's server.

In order to protect itself from firewalls and antivirus solutions the Trojan checks for the following processes in memory:

RavMon.exe
Twister.exe
FileMsg.exe
trojankiller.exe

It also searches the system for windows of the following classes:

AVP.AlertDialog

It will emulate a mouse click on the following buttons in these windows:

"Razreshit'" [Russian for 'Allow']

It will close windows of the class "AVP.Product_Notification".

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the Trojan process.
2. Delete the Trojan files:

   Winlog0n.exe
   LgSy0.dll
   Kavs0.dll

3. Delete the following parameters from the system registry (see What is a system registry and how do I use it for details on how to edit the registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   " 
   
       
   
   This Trojan is designed to steal confidential data. It is a Windows PE EXE
   file.  It is 52,734 bytes in size. It is packed using UPX. The unpacked file
   is approximately 106 KB in size.  It is written in Visual C  .
   Installation
   When launching, the Trojan drops the following files to the Windows temporary
   directory (%Temp%):
   Winlog0n.exe (18,944 bytes in size);
   LgSy0.dll or Kavs0.dll (28,551 bytes in size).
   It also adds the following value to the system registry:
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "<random symbols>" = "%Temp%\winlog0n.exe"
   This ensures that the Trojan will be launched each time Windows is booted
   on the victim machine.
   
   Payload