PWS:Win32/OnLineGames.ZDV

PWS:Win32/OnLineGames.ZDV is a detection for the dropper component of PWS:Win32/OnLineGames.ZDV!dll, password-stealing trojan.

Installation

This PWS:Win32/OnLineGames.ZDV attempts to load the file "<system folder>\sfc_os.dll" to use the SetFileException function. It uses this function to attempt to exclude the following files from Windows File Protection (WFP):

• <system folder>\imm32.dll
• <system folder>\dllcache\imm32.dll

Note: <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.

For more information about the Windows File protection feature, please refer to the following bulletin: http://support.microsoft.com/kb/222193

It then renames the file <system folder>\imm32.dll to <system folder>\imm32A.dll.

PWS:Win32/OnLineGames.ZDV then drops the following file:

• <system folder>\imm32.dll - detected as PWS:Win32/OnLineGames.ZDV!dll

This way is the same as hooking to the Input Method Manager to monitor and anticipate the user's keystrokes.

It then deletes the originally executed file, the file detected as PWS:Win32/OnLineGames.ZDV.

Payload

Terminates processes

The malware attempts to terminate processes associated with the following files, should they be running on the affected computer:

• AYAgent.aye
• ALYac.aye
• SystemMon.exe
• SkyMon.exe
• nsvmon.npc
• NVC.npc
• NVCAgent.npc
• Nsavsvc.npc
• PCOTP.exe
• V3LSvc.exe
• V3LTray.exe

Analysis by Jonathan San Jose