Trojan.PWS.OnlineGames.KDXA information

The Trojan.PWS.OnlineGames.KDXA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.PWS.OnlineGames.KDXA virus can do?

• A file was accessed within the Public folder.
• Sample contains Overlay data
• Reads data out of its own binary image
• Installs a browser addon or extension
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• CAPE detected the shellcode patterns malware family
• Deletes executed files from disk
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan.PWS.OnlineGames.KDXA?

File Info:
name: F48195FE5B8D604BB699.mlw
path: /opt/CAPEv2/storage/binaries/2d7ee5e8d3dae2aec0d7909fc1f0fafdd163cce3ab4bd0baec2a0bfe1a3f6490
crc32: 590B5C73
md5: f48195fe5b8d604bb6991dc0af1d426c
sha1: c28ce6ae7a5580a4e607262a49493bfc8b8f33b1
sha256: 2d7ee5e8d3dae2aec0d7909fc1f0fafdd163cce3ab4bd0baec2a0bfe1a3f6490
sha512: 9713d744c3f98b1f04d166f216906637947a600a9140f0c068d44979aebdadc4c2f7bad57f2857f4906853631bcfeec0ac68bc9f6be98d55f2501d668ae5ebda
ssdeep: 768:0eRELsSMnCgYGsDeN3arL3OBDcvagyBnf:0eRPiJhDfOBDcUf
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T168C2D05125B52634CC17773FA2A0B78D42DEFE4507B23A122D3AED8BDD2C6E1E1D6520
sha3_384: 6824b740d79fa47b19170f749cd2b6ca56122ef032b759edd45cfc05d5947e6d6e12908a3fca6efb5055c5c885ae8353
ep_bytes: 60be00c040008dbe0050ffff5783cdff
timestamp: 2011-06-18 19:07:20

Version Info:
0: [No Data]

Trojan.PWS.OnlineGames.KDXA also known as:

How to remove Trojan.PWS.OnlineGames.KDXA?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.