PWS:Win32/OnLineGames.FT removal guide

The PWS:Win32/OnLineGames.FT is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/OnLineGames.FT virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• At least one IP Address, Domain, or File Name was found in a crypto call
• Enumerates running processes
• Reads data out of its own binary image
• A process created a hidden window
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Deletes its original binary from disk
• Uses suspicious command line tools or Windows utilities

How to determine PWS:Win32/OnLineGames.FT?

File Info:
name: 79D8F3797C221E710648.mlw
path: /opt/CAPEv2/storage/binaries/e49b381115d848046b6d3df586787ecceef033fd5eceed0c74e67df5c2a65cad
crc32: 7F999469
md5: 79d8f3797c221e7106484b462cd310d0
sha1: e8546b788cc11804573ffc729b34af4ac8579bc7
sha256: e49b381115d848046b6d3df586787ecceef033fd5eceed0c74e67df5c2a65cad
sha512: fa4eb9163be6ebd4658e5c258444f7784344b6ffbe17b7a211f02e52d6374c2c920ed6836a0399e4bb32e57a3d01c0b685bee87bac18c3a204e84c943948c594
ssdeep: 96:i3Ppl4n9ofZOwyrMVD2b0Q8zVT7PZLc4gKtYFrcBYLmqmynfq:6RMhMecVT7Pll36cBYLtq
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T178D17DDFEB3D797AE3B2517203EB87A12925373252E4971D6D60711368F210B61173C4
sha3_384: b1ee7550d77de76a2e0518c293308c741a6c254c93bc0b39155eda597b9bf67a3921b44b84e163a9a32d866b6af1a3c8
ep_bytes: 60be006040008dbe00b0ffff5783cdff
timestamp: 2009-05-21 16:55:20

Version Info:
0: [No Data]

PWS:Win32/OnLineGames.FT also known as:

How to remove PWS:Win32/OnLineGames.FT?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.