Daily Virus Report (Nov 25, 2008) - Trojan.PSW.Win32.XYOnline.ajq
-
RISING
Nov 25, 2008 one virus needs your attention. It is AJQ (Trojan.PSW.Win32.XYOnline.ajq). The virus will search antivirus software, and try to shut down antivirus software in victim device. This virus steals password of online game “XYOnline II”, by dropping its executed program in IE browser process and send the game password out by penetrating through victim device’s firewall.
Name: AJQ (Trojan.PSW.Win32.XYOnline.ajq)
Warning level: Dangerous
Category: Trojan
Affected System: NT/2000/XP/2003
Description:
This is an account stealer Trojan; the virus releases virus files “msosdohs00.Dll”, "msosfpids32.Sys” to Windows system directory after being executed. And the virus modifies registry key value to achieve startup with system. This virus searches antivirus software process, and try to shut down it by force, this will make some antivirus software can not work steadily. Most important, the virus records the game account and password information of online game "XYonline II”, and sends this record out to hackers.
Anti-virus experts suggest that computer users take the following measures to protect against this virus:
1. Install Rising Anti-virus, personal firewall, update in time, and at least 3 times per day for updating Rising.
2. Use Rising Vulnerability Check, patch your computer system in a timely manner as many viruses spread by taking advantage of the system exploits or vulnerabilities.
3. Do not browse suspicious websites, and suspicious inserter; turn off or delete unnecessary system services.
4. Do not receive the suspicious file from QQ, MSN, Email, etc.
5. Open auto-protect and auto-monitor function when accessing to the internet.
6. Put your account information of networks bank, networks game, QQ etc, into Rising Application Protection, Rising Application Protection can protect specified applications from attack by malicious programs. A user can apply rules to game software, instant messenger, etc. to customize protection.
Daily Virus Report (Feb 07, 2012)- Rootkit.Win32.Undef.cvu ()
