Categories: Malware

PWS:Win32/OnLineGames.JQ malicious file

The PWS:Win32/OnLineGames.JQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/OnLineGames.JQ virus can do?

Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
Uses Windows utilities for basic functionality
Attempts to modify Internet Explorer’s start page
Authenticode signature is invalid
A scripting utility was executed
Uses Windows utilities to create a scheduled task
Attempts to modify proxy settings
Deletes executed files from disk
Touches a file containing cookies, possibly for information gathering
Collects information to fingerprint the system
Uses suspicious command line tools or Windows utilities
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine PWS:Win32/OnLineGames.JQ?


File Info:
name: 35BFBC09D6E774CD5DCF.mlwpath: /opt/CAPEv2/storage/binaries/8b2f68576c792bb4facc7a3841c02ce2dddaa27fd03d7b42f05e2c5a963529e7crc32: A1D8F848md5: 35bfbc09d6e774cd5dcfb9aa7f461b35sha1: 049dfb5f5791f307c257df097690dfef0c88ee76sha256: 8b2f68576c792bb4facc7a3841c02ce2dddaa27fd03d7b42f05e2c5a963529e7sha512: 26f1e21c81b2c2191e3583c679774c8f8b6e403f87f4c09376211ecb5f9ac8533699b9796b6b4e7a60e466c5c0097c16361d6d2a4790b4f98eaedfa7b3a22eebssdeep: 768:HbHnq63kOWREdQQtiaxq5wbuHZyYbwjt8vmEGuZ9NJ1/z0ggFIgHKcNFTBULJxyQ:bXVy1aQ5wb7xEF/zT0KWFiLJ22BcQm+type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T121D39ED5C50403B1C3D184B849EBFB374954A8327E053A47AF8AEE865AF2FD88DCE156sha3_384: 210207c89d9c2a943ea2c52bb5bc1d1c270c6f693046b9276e9ad9f117dfb09f9dd811a89d174d58850d062a9503c982ep_bytes: e83a040000e94efdffff8bff558bec81timestamp: 2011-02-25 08:23:41
Version Info:
0: [No Data]

PWS:Win32/OnLineGames.JQ also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Kykymber.lmDX
MicroWorld-eScan	Gen:Trojan.Downloader.imW@aS7vNlmi
FireEye	Generic.mg.35bfbc09d6e774cd
Skyhigh	BehavesLike.Win32.Corrupt.cm
McAfee	GenericRXCR-VZ!35BFBC09D6E7
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Gen:Trojan.Downloader.imW@aS7vNlmi
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0021fe271 )
BitDefender	Gen:Trojan.Downloader.imW@aS7vNlmi
K7GW	Trojan ( 0021fe271 )
Cybereason	malicious.f5791f
VirIT	Trojan.Win32.Agent2.CEPL
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Agent.SGX
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Trojan.Barys-9754805-0
Kaspersky	Trojan-GameThief.Win32.OnLineGames.xnvu
Alibaba	TrojanPSW:Win32/OnLineGames.e8db5cf7
NANO-Antivirus	Trojan.Win32.Agent.cexuj
Rising	Trojan.DL.Win32.Undef.svt (CLASSIC)
Sophos	Mal/Generic-S
Baidu	Win32.Trojan.Agent.ea
F-Secure	Heuristic.HEUR/AGEN.1366571
DrWeb	Trojan.DownLoader5.25579
TrendMicro	TSPY_ONLING.SMIF
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Trojan.Downloader.imW@aS7vNlmi (B)
Ikarus	Trojan-Downloader.Win32.Small
Jiangmin	Trojan/Generic.dgtk
Webroot	W32.Rogue.Gen
Varist	W32/A-f329c2b0!Eldorado
Avira	TR/StartPage.uwtml
Antiy-AVL	Trojan[Dropper]/Win32.Agent
Kingsoft	malware.kb.a.1000
Microsoft	PWS:Win32/OnLineGames.JQ
Xcitium	TrojWare.Win32.Agent.sgx@4i1tyd
Arcabit	Trojan.Downloader.EA714C
ZoneAlarm	UDS:Trojan-GameThief.Win32.OnLineGames.xnvu
GData	Win32.Trojan.PSE.13LF282
Google	Detected
AhnLab-V3	Trojan/Win32.Agent.R25735
Acronis	suspicious
VBA32	BScope.Trojan.Inject
ALYac	Gen:Trojan.Downloader.imW@aS7vNlmi
MAX	malware (ai score=81)
DeepInstinct	MALICIOUS
Cylance	unsafe
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TSPY_ONLING.SMIF
Tencent	Trojan.Win32.OnLineGames.vmk
Yandex	Trojan.DR.Agent!eeJvu1/tGlo
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Agent.ELSA!tr
AVG	Win32:TrojanX-gen [Trj]
Avast	Win32:TrojanX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)