Categories: Trojan

Trojan.PWS.OnlineGames.ZWU removal instruction

The Trojan.PWS.OnlineGames.ZWU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.PWS.OnlineGames.ZWU virus can do?

Sample contains Overlay data
Yara rule detections observed from a process memory dump/dropped files/CAPE
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Creates a copy of itself
Deletes executed files from disk

How to determine Trojan.PWS.OnlineGames.ZWU?


File Info:
name: 236F84624B912712A85D.mlwpath: /opt/CAPEv2/storage/binaries/5deb394dde3a4aa4123249fb0cbf3d1996863e37bf3436a6c77e1951a251ea6bcrc32: 1C827960md5: 236f84624b912712a85d5c8e9891f302sha1: 0b2599f82304ceebc231bba95b14c992609e65d8sha256: 5deb394dde3a4aa4123249fb0cbf3d1996863e37bf3436a6c77e1951a251ea6bsha512: b58a3bc6f9a6d0418db2c85ab227227b5cca6659c9f1208006ecbabb3e70fc48a374dedc25385c68b9051b7ac22ad06571c4a76923ed4ee989758a653b562610ssdeep: 192:VErlncuFLrflfLN8EMOGk0XhhT09GP1sHOEF/NKY2mvwl3LQpc5:VErln5dWEjGk0XGsEpcpnxtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B432AE8BD92B4577C0A90F750381FD693A0F36084FF6CDD85AA61ACB347A495873D263sha3_384: ae8927c5a441ee77b0a32ad47c68543fcddad51698e3847dfe33fac74466cc4a103eef29132f518b974fc213b5fc578fep_bytes: 60be00b040008dbe0060ffff5783cdfftimestamp: 2008-07-31 05:47:46
Version Info:
0: [No Data]

Trojan.PWS.OnlineGames.ZWU also known as:

Elastic	malicious (moderate confidence)
MicroWorld-eScan	Trojan.PWS.OnlineGames.ZWU
ClamAV	Win.Spyware.49558-2
FireEye	Generic.mg.236f84624b912712
CAT-QuickHeal	Trojan.Onlinegames.20374
McAfee	Generic Dropper.cd
Cylance	Unsafe
VIPRE	Trojan.PWS.OnlineGames.ZWU
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.24b912
Baidu	Win32.Trojan-PSW.OLGames.by
Cyren	W32/OnlineGames.AS.gen!Eldorado
Symantec	Infostealer.Gampass
ESET-NOD32	a variant of Win32/PSW.OnLineGames.NXI
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan-GameThief.Win32.OnLineGames.tcnt
BitDefender	Trojan.PWS.OnlineGames.ZWU
NANO-Antivirus	Trojan.Win32.OnLineGames.bnajx
SUPERAntiSpyware	Trojan.Agent/Gen-OnlineGames
Avast	Win32:Evo-gen [Trj]
Ad-Aware	Trojan.PWS.OnlineGames.ZWU
Sophos	ML/PE-A + Mal/Dropper-O
Comodo	TrojWare.Win32.PSW.OnLineGames.~BAFL@flzq
DrWeb	Trojan.PWS.Wsgame.6861
Zillya	Trojan.OnLineGames.Win32.127842
TrendMicro	TSPY_ONLINEG.CHS
McAfee-GW-Edition	BehavesLike.Win32.Mydoom.lc
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.PWS.OnlineGames.ZWU (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	TrojanSpy.OnLineGames.klg
Webroot
Avira	TR/Agent.gfwf
Antiy-AVL	Trojan/Generic.ASMalwS.12
Microsoft	Trojan:Win32/Wacatac.B!ml
ViRobot	Trojan.Win32.PSWIGames.11776.AT
GData	Trojan.PWS.OnlineGames.ZWU
Google	Detected
AhnLab-V3	Dropper/Win32.OnlineGameHack.R271
Acronis	suspicious
BitDefenderTheta	AI:Packer.1957088321
MAX	malware (ai score=87)
VBA32	BScope.TrojanSpy.Treemz
Malwarebytes	Malware.Heuristic.1003
TrendMicro-HouseCall	TSPY_ONLINEG.CHS
Rising	Trojan.PSW.Win32.GameOL.pcx (CLASSIC)
Yandex	Trojan.GenAsa!WbC+eYQZIGA
Ikarus	Virus.Win32.Agent.ZRP
Fortinet	W32/Agent.SAV!tr
AVG	Win32:Evo-gen [Trj]
Panda	Generic Malware
CrowdStrike	win/malicious_confidence_100% (W)