English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Trojan.Win32.KillAV.gj

Detected Dec 09 2005 17:04 GMT
Released Dec 09 2005 19:26 GMT
Published Mar 15 2006 15:25 GMT

Technical Details

This Trojan is a Windows PE EXE file 61440 bytes in size.

Once launched, the Trojan causes the following message to be displayed:

It then creates a file called Update.bat in the C: root directory:

C:\Update.bat

The Trojan terminates any processes it finds with the names listed below:

_AVP32.EXE
_AVPCC.EXE
_AVPM.EXE
ACKWIN32.EXE
ADVXDWIN.EXE
ALERTSVC.EXE
ALOGSERV.EXE
AMON9X.EXE
ANTI-t*r*o*jan.EXE
ANTS.EXE
apvxdwin.exe
ATCON.EXE
ATUPDATER.EXE
ATWATCH.EXE
AUTODOWN.EXE
AutoTrace.exe
AUTOUPDATE.EXE
AVCONSOL.EXE
AVGCC32.EXE
Avgctrl.exe
AvgServ.exe
AVGSERV.EXE
AVGSERV9.EXE
AVGW.EXE
avkpop.exe
AVKSERV.EXE
avkservice.exe
avkwctl9.exe
AVP.EXE
AVP32.EXE
AVPCC.EXE
AVPM.EXE
Avsched32.exe
AvSynMgr.exe
AVSYNMGR.EXE
AVWINNT.EXE
AVXMONITOR9X.EXE
AVXMONITORNT.EXE
AVXQUAR.EXE.EXE
AVXW.EXE
BLACKICE.EXE
CDP.EXE
CLAW95.EXE
CLAW95CF.EXE
CLEANER.EXE
CLEANER3.EXE
CMGRDIAN.EXE
CONNECTIONMONITOR.EXE
CTRL.EXE
defscangui.exe
DEFWATCH.EXE
DOORS.EXE
DRWATSON.EXE
DVP95.EXE
DVP95_0.EXE
EFPEADM.EXE
ETRUSTCIPE.EXE
EVPN.EXE
EXPERT.EXE
F-AGNT95.EXE
fameh32.exe
FAST.EXE
fch32.exe
fih32.exe
fnrb32.exe
F-PROT.EXE
F-PROT95.EXE
FP-WIN.EXE
FRW.EXE
fsaa.exe
fsav32.exe
fsgk32.exe
fsm32.exe
fsma32.exe
fsmb32.exe
F-STOPW.EXE
gbmenu.exe
gbpoll.exe
GENERICS.EXE
GUARD.EXE
GUARDDOG.EXE
IAMAPP.EXE
IAMSERV.EXE
ICLOAD95.EXE
ICLOADNT.EXE
ICMON.EXE
ICSUPP95.EXE
ICSUPPNT.EXE
IFACE.EXE
IOMON98.EXE
ISRV95.EXE
JEDI.EXE
LDNETMON.EXE
LDPROMENU.EXE
LDSCAN.EXE
LOCKDOWN.EXE
LOCKDOWN2000.EXE
LUALL.EXE
LUCOMSERVER.EXE
MCAGENT.EXE
MCMNHDLR.EXE
McShield.exe
MCSHIELD.EXE
MCTOOL.EXE
MCUPDATE.EXE
MCVSRTE.EXE
MCVSSHLD.EXE
MGAVRTCL.EXE
MGAVRTE.EXE
MGHTML.EXE
MINILOG.EXE
MONITOR.EXE
MOOLIVE.EXE
MpfConsole
MPFSERVICE.EXE
MPFTRAY.EXE
MWATCH.EXE
NAVAPSVC.EXE
NAVLU32.EXE
NAVW32.EXE
NAVWNT.EXE
NDD32.EXE
NeoWatchLog.exe
NETUTILS.EXE
NISSERV.EXE
NISUM.EXE
NMAIN.EXE
NORMIST.EXE
notepad.exe
NPROTECT.EXE
NPSSVC.EXE
NSCHED32.EXE
ntrtscan.EXE
NTVDM.EXE
Nui.EXE
NVC95.EXE
NWService.exe
NWTOOL16.EXE
PADMIN.EXE
pavproxy.exe
PCCIOMON.EXE
pccntmon.EXE
pccwin97.EXE
PCCWIN98.EXE
pcscan.EXE
PERSFW.EXE
POP3TRAP.EXE
POPROXY.EXE
PORTMONITOR.EXE
PROGRAMAUDITOR.EXE
PVIEW95.EXE
RAV7.EXE
RAV7WIN.EXE
REALMON.EXE
REGEDIT.EXE
RESCUE.EXE
RTVSCN95.EXE
sbserv.exe
SCAN32.EXE
SCRSCAN.EXE
SMC.EXE
SPHINX.EXE
SPYXX.EXE
SS3EDIT.EXE
SWEEP95.EXE
SWEEPSRV.SYS
SWNETSUP.EXE
SymProxySvc.exe
SYMTRAY.EXE
taskmgr.exe
taskmgr.exe
TAUMON.EXE
TC.EXE
TCA.EXE
TCM.EXE
TDS-3.EXE
TFAK.EXE
UPDATE.EXE
vbcmserv.exe
VbCons.exe
VET32.EXE
VET95.EXE
VETTRAY.EXE
VIR-HELP.EXE
VPC32.EXE
VPTRAY.EXE
VSCHED.EXE
VSECOMR.EXE
VSHWIN32.EXE
VSMON.EXE
VSSTAT.EXE
WATCHDOG.EXE
WEBSCANX.EXE
WEBTRAP.EXE
WGFE95.EXE
WIMMUN32.EXE
WRADMIN.EXE
WRCTRL.EXE
ZATUTOR.EXE
ZAUINST.EXE
ZONEALARM.EXE

The Trojan registers itself in the system registry, ensuring that it will be launched each time Windows is rebooted on the victim machine:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
 "Start"="<path to original executable file>c:\Update.bat"

The Trojan then causes the following message to be displayed:


Bookmark and Share
Share
Trojan

This type of behaviour covers malicious programs that delete, block, modify, or copy data, disrupt computer or network performance, but which cannot be classified under any of the behaviours identified above.

This classification also covers “multipurpose” Trojan programs, i.e. those that are capable of conducting several actions at once and which demonstrate several Trojan behaviours in a single program. This means they cannot be indisputably classified as having any single behaviour.


Other versions

Aliases

Trojan.Win32.KillAV.gj (Kaspersky Lab) is also known as:

  • Trojan: ProcKill-AK (McAfee)
  • Troj/KillAV-GJ (Sophos)
  • W32/KillAV.EW (FPROT)
  • Trojan:Win32/Tropid!rts (MS(OneCare))
  • Trojan.AVKill.133 (DrWeb)
  • Win32/KillAV.GJ trojan (Nod32)
  • Generic.Malware.SP!Tk.E8828A1D (BitDef7)
  • Win32:Trojan-gen (AVAST)
  • Trojan.Win32.KillAV (Ikarus)
  • Generic.LBX (AVG)
  • TR/Killav.GJ (AVIRA)
  • Trojan Horse (NAV)
  • W32/Killav.LR (Norman)
  • ProcKill-AK (NAI)
  • Hack.AVkill (Rising)
  • TROJ_Generic (TrendMicro)