TSPY_ONLINEG.TYB

This spyware may be downloaded by other malware/grayware/spyware from remote sites. It may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It creates folders where it drops its files.

It steals sensitive information such as user names and passwords, particularly for certain games. Stolen information may be used for profit by cybercriminals who may gain access to the information.

It deletes itself after execution.

Arrival Details

This spyware may be downloaded by other malware/grayware/spyware from remote sites.

It may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This spyware drops the following copies of itself into the affected system:

• %Program Files%\WLmhzx\Gameclien.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

It drops the following component file(s):

• %System%\mhzx.bat
• %System%\mhzx.reg
• %System%\mhzxin.bat
• %Program Files%\WLmhzx\jietu.exe
• %System%\sougou.ime

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• WLmhzx

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{12345678-b1gf-14d0-89bb-0090ce808666}
StubPath = %System%\mhzx.bat

Information Theft

This spyware steals sensitive information such as user names and passwords, particularly for certain games.

Other Details

This spyware deletes itself after execution.