Categories: Malware

Should I remove “PWS:Win32/Lolyda!pz”?

The PWS:Win32/Lolyda!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/Lolyda!pz virus can do?

Uses Windows utilities for basic functionality
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Binary compilation timestomping detected
Uses suspicious command line tools or Windows utilities
Yara detections observed in process dumps, payloads or dropped files

How to determine PWS:Win32/Lolyda!pz?


File Info:
name: 07BA14555B79C0A1905E.mlwpath: /opt/CAPEv2/storage/binaries/5a9145e0c20a3570f61ef66e057976a97b7c4501e998bec5ee4edea89744a3eccrc32: 29280B87md5: 07ba14555b79c0a1905edeea5a14cf46sha1: 88c7ed6916a0ffd092a4f37923ffa6e7eade636dsha256: 5a9145e0c20a3570f61ef66e057976a97b7c4501e998bec5ee4edea89744a3ecsha512: c496b3b7c9529f6d0a4a3595a4bd0bda1b67786e04fe3a608bee3b8b3a3ec0760b0140bcad97642f1c9b59999aa54cc7ded7e42a17a67fe891c97995e1c18f7fssdeep: 768:00G1WZzEt5MGOtVfTW6K7EWeChW0mPztjQrH15wHYV+tqyXM:0oqMGOvfThUElChWXhjCH15GYV+tRXMtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T195F2D048EAEC54E1F23EAEBC57F7A637E2607D68B75CEB1F1340416E19340966B50811sha3_384: c9a4dea97fe3dfe9d89fb50d343edf29271bbed264aacc32dacd52f69eb25fe780589f687c7b88ccdc92734d732880a5ep_bytes: 60be00d040008dbe0040ffff5783cdfftimestamp: 2033-06-15 13:26:27
Version Info:
CompanyName: FileDescription: DlgServer Microsoft 基础类应用程序FileVersion: 1, 0, 0, 1InternalName: DlgServerLegalCopyright: 版权所有 (C) 2011LegalTrademarks: OriginalFilename: DlgServer.EXEProductName: DlgServer 应用程序ProductVersion: 1, 0, 0, 1Translation: 0x0804 0x04b0

PWS:Win32/Lolyda!pz also known as:

Lionic	Trojan.Win32.Generic.lq5E
Elastic	malicious (moderate confidence)
MicroWorld-eScan	Dropped:Generic.Dacic.C35DC41E.A.402F9702
FireEye	Generic.mg.07ba14555b79c0a1
CAT-QuickHeal	Trojan.LolydaPMF.S31006844
Skyhigh	Generic PWS.vv
McAfee	Generic PWS.vv
Malwarebytes	MachineLearning/Anomalous.100%
VIPRE	Dropped:Generic.Dacic.C35DC41E.A.402F9702
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Password-Stealer ( 000250261 )
Alibaba	TrojanPSW:Win32/Lolyda.19a7b182
K7GW	Password-Stealer ( 000250261 )
Arcabit	Generic.Dacic.C35DC41E.A.402F9702
Baidu	Win32.Trojan-Dropper.Dycler.a
VirIT	Trojan.Win32.OLG.CCDO
Symantec	Infostealer.Gampass
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/PSW.OnLineGames.PIR
APEX	Malicious
ClamAV	Win.Malware.Onlinegames-7647999-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Dropped:Generic.Dacic.C35DC41E.A.402F9702
NANO-Antivirus	Trojan.Win32.SchoolBoy.hhxhyl
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan.Psw.Fajl
Emsisoft	Dropped:Generic.Dacic.C35DC41E.A.402F9702 (B)
F-Secure	Trojan.TR/PSW.Lolyda.BY
DrWeb	Trojan.PWS.Gamania.30164
Zillya	Trojan.OnLineGames.Win32.103252
TrendMicro	TROJ_RVERSE.SMI
Trapmine	malicious.moderate.ml.score
Sophos	Troj/Vakooja-Q
Ikarus	Trojan-GameThief.Win32.OnLineGames
Jiangmin	Trojan/Generic.vksb
Webroot	W32.Infostealer.Onlinegames.Gen
Google	Detected
Avira	TR/PSW.Lolyda.BY
Varist	W32/Agent.JT.gen!Eldorado
Antiy-AVL	Trojan[GameThief]/Win32.Frethoq
Kingsoft	malware.kb.b.905
Xcitium	TrojWare.Win32.PSW.GamePass.AHD@4l3ra2
Microsoft	PWS:Win32/Lolyda!pz
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Dropped:Generic.Dacic.C35DC41E.A.402F9702
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.OnlineGameHack.R3318
VBA32	BScope.Trojan.Dynamer
ALYac	Dropped:Generic.Dacic.C35DC41E.A.402F9702
MAX	malware (ai score=100)
Cylance	unsafe
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_RVERSE.SMI
Rising	Stealer.OnLineGames!1.65EB (CLOUD)
Yandex	Trojan.PWS.OnLineGames!1d6wiNO82LE
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/OnLineGames.SMI!tr
BitDefenderTheta	Gen:NN.ZexaF.36744.cmKfa0BPfKlb
AVG	Win32:Trojan-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (D)