Download the latest scan engine


In the wild: No

Destructive: No

Language: English

Systems affected: Windows 98, ME, NT, 2000, XP, Server 2003

Encrypted: No

Overall risk rating:


Reported detections:


System  impact:


Information exposure:



A spyware is a program that monitors and gathers user information for different purposes. Spyware programs usually run in the background, with their activities transparent to most users. Many users inadvertently agree to installing spyware by accepting the End User License Agreement (EULA) on certain free software.

Many users consider spyware an invasive form of data gathering. Spyware may also cause a general degradation in both network connection and system performance.

The state of California classifies spyware as: programs that are installed under deceptive circumstances; software that hides in personal computers; software that secretly monitors user activity; keylogging software; and software that collects Web browsing histories.


Initial samples received on:  Sep 23, 2008

File type: PE

Memory resident: No  

File size: 87,040 Bytes


This spyware may be dropped by other grayware. It may also be downloaded unknowingly by a user when visiting Web site(s).

It may arrive as a .DLL file that exports functions used by other grayware. It is usually injected into running processes to achieve memory residency.

It steals sensitive information, such as user names and passwords, related to certain online games.

This spyware runs on Windows 98, ME, NT, 2000, XP, and Server 2003.

Analysis by:  Jasper Manuel


Minimum scan engine version needed: 8.500

Download the latest scan engine

Virus pattern version needed : 5.565.00

Pattern release date:  Sep 24, 2008

Important note: The "Minimum scan engine" refers to the earliest Trend Micro scan engine version guaranteed to detect this threat. However, Trend Micro strongly recommends that you update to the latest version in order to get comprehensive protection. Download the latest scan engine here.


Identifying the Spyware Files

  1. Scan your computer with your Trend Micro antivirus product.
  2. Note the path and file name of all files detected as TSPY_OLGAME.MS.

Trend Micro customers need to download the latest virus pattern file before scanning their computer. Other users can use Housecall, the Trend Micro online threat scanner.

Important Windows ME/XP Cleaning Instructions

Users running Windows ME and XP must disable System Restore to allow full scanning of infected computers.

Users running other Windows versions can proceed with the succeeding solution set(s).

Restarting in Safe Mode

This spyware has characteristics that require the computer to be restarted in safe mode. Go to this page for instructions on how to restart your computer in safe mode.

Deleting the Spyware File(s)

  1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
  2. In the Named input box, type the name(s) of the file(s) detected earlier.
  3. In the Look In drop-down list, select My Computer, then press Enter.
  4. Once located, select the file then press SHIFT%20DELETE.

*NOTE: This malware is a .DLL file that may come with a main component detected by Trend Micro as another malware. It may also be used by several variants of a certain malware family. If your Trend Micro product detects another malware on your system, refer to the manual removal instructions of that detected malware.