W32/OnLineGames.PRS is a password stealing trojan. The trojan will infect Windows systems.

Upon execution, the trojan drops the following files:

tavo0.dll in the Windows System folder,
kavo1.dll in the Windows System folder,
kavo.exe in the Windows System folder,
tavo.exe in the Windows System folder,
8oc.dll in the Current User's temp folder,
lbq7cc.dll in the Current User's temp folder,
7x.dll in the Current User's temp folder.

It also copies nncu6kk.com, i8.com and autorun.inf in all drives. When ever a drive is accessed i8.com will be executed.

The trojan modifies registry at the following location to load itself during each startup;

HKEY_USERS\S-1-5-21-1004336348-413027322-682003330-500\Software\Microsoft\Windows\CurrentVersion\Run\kava
HKEY_USERS\S-1-5-21-1004336348-413027322-682003330-500\Software\Microsoft\Windows\CurrentVersion\Run\tava

The trojan also attempts to connect to remote web-sites to download malicious files.

This trojan first appeared on March 19, 2008.

 Other names of W32/OnLineGames.PRS Trojan:

This trojan is also known as Trojan-PSW.Win32.OnLineGames.prs, PWS-LegMir.gen.k, W32/Lineage.HHE.worm, W32.Gammima.AG.