Trojan:Win32/OnLineGames!pz removal instruction

The Trojan:Win32/OnLineGames!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/OnLineGames!pz virus can do?

• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Binary file triggered multiple YARA rules
• Deletes executed files from disk
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/OnLineGames!pz?

File Info:
name: E3A4CEEE03FC3948750D.mlw
path: /opt/CAPEv2/storage/binaries/0b68e10a2df596d73263e56c3630b06bbc3a921b88271c091636c69b72256268
crc32: BB718500
md5: e3a4ceee03fc3948750db5919fff72ab
sha1: be3ba6906a6d10b41bcb09ec53803641af11d4cb
sha256: 0b68e10a2df596d73263e56c3630b06bbc3a921b88271c091636c69b72256268
sha512: e77141cd88070eedd25d2bc758a4748b8c2a4b46efe5bb6e3d005e47cc414b49d31aa0a4dbc4cbb25b0f36f8490cb3ba4262deaa2f54bb34be41fdaaf6b2097e
ssdeep: 1536:37CvnKhWQtC3Izj6TrlDa2z6Ewd0zvPTQw9LBZRL8V3zhb:rCvKztiIzj6xtDLBZRL8Vj5
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F0937D00FAD584B0EC95377000E76BB6C1BA9DA1120B0BB36F64CE6B38B65B9BD35417
sha3_384: b0e8a7155690d8bfad08c7bcd35d77297bb49981f0334072ded76eb2939da7aede121ad50284c3cf0c649aad8fe2c318
ep_bytes: 558bec6aff689011151368dacf151364
timestamp: 2012-07-19 19:00:28

Version Info:
Comments: 1.5901.1.195
CompanyName: 网龙天晴数码
FileDescription: 网络游戏魔域客户端执行程序
FileVersion: 1, 5901, 1, 195
InternalName: soul.exe
LegalCopyright: 版权所有 (C) 2002
LegalTrademarks: 
OriginalFilename: 魔域.exe
PrivateBuild: 
ProductName: 魔域客户端执行程序
ProductVersion: 1, 0, 0, 1
SpecialBuild: 
Translation: 0x0804 0x04b0

Trojan:Win32/OnLineGames!pz also known as:

How to remove Trojan:Win32/OnLineGames!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.