Internet threat level: 1
Home→Descriptions→Trojan.Win32.KillAV.hl
Trojan.Win32.KillAV.hl
| Detected | Mar 20 2006 08:42 GMT |
| Released | Mar 20 2006 08:42 GMT |
| Published | Apr 03 2006 12:42 GMT |
Technical Details
This Trojan program deletes a number of legal programs from memorz. The Trojan itself is a Windows PE EXE file, 103424 bytes in size.
Once launched, the Trojan copies itself to the Windows system directory as shell33.exe:
The following icon is used for this file in File Manager:
The Trojan then registers itself in the system registry, ensuring that it will be launched each time Windows is rebooted on the victim machine:
"System"="%System%\shell33.exe"
The Trojan terminates the processes listed below:
_AVP32.EXE _AVPCC.EXE _AVPM.EXE AckWin32.exe AckWin32.EXE ACKWIN32.EXE ADVXDWIN.EXE agentw.exe ALERTSVC.EXE alogserv.exe ALOGSERV.EXE AMON9X.EXE ANTI-TROJAN.EXE ANTS.EXE APVXDWIN.EXE apvxdwin.exe ATCON.EXE ATUPDATER.EXE ATWATCH.EXE AUTODOWN.exe AutoDown.exe AUTODOWN.EXE AutoTrace.exe AVCONSOL.EXE AVGCC32.exe AVGCC32.EXE AVGCTRL.EXE Avgctrl.exe AVGSERV.EXE AVGSERV.exe AVGSERV9.EXE AVGW.EXE avkpop.exe AvkServ.exe avkservice.exe avkwctl9.exe AVP.EXE AVP32.EXE AVP32.EXE AVPCC.EXE avpcc.exe AVPM.EXE avpm.exe Avsched32.exe AVSYNMGR.exe AVSYNMGR.EXE AVWINNT.EXE AVXMONITOR9X.EXE AVXMONITOR9X.exe AVXMONITORNT.EXE AVXMONITORNT.exe AVXQUAR.EXE AVXQUAR.EXE.EXE AVXW.EXE backd.exe blackd.exe BLACKD.EXE BlackICE.exe ccApp.exe ccEvtMgr.exe ccPxySvc.exe ccPxySvc.EXE CDP.EXE cfgWiz.exe Claw95.exe Claw95.EXE CLAW95.EXE Claw95cf.exe CLAW95CF.EXE cleaner.EXE cleaner3.EXE CMGRDIAN.EXE CONNECTIONMONITOR.EXE cpd.exe cpd.EXE CPDCLNT.EXE CPDClnt.exe CTRL.EXE defalert.exe defscangui.exe defscangui.exe DEFWATCH.EXE DOORS.EXE DOORS.exe DVP95.EXE DVP95_0.EXE EFPEADM.exe EFPEADM.EXE ETRUSTCIPE.exe ETRUSTCIPE.EXE EVPN.exe EVPN.EXE EXPERT.EXE F-AGNT95.EXE fameh32.exe fch32.exe fih32.exe fnrb32.exe F-PROT.EXE F-PROT95.EXE FP-WIN.EXE FRW.exe FRW.EXE fsaa.exe fsav32.exe fsgk32.exe fsm32.exe fsma32.exe fsmb32.exe f-stopw.exe F-STOPW.EXE gbmenu.exe GBPOLL.EXE gbpoll.exe GENERICS.EXE GUARD.EXE GUARD.exe GUARDDOG.EXE iamapp.exe IAMAPP.EXE IAMAPP.exe iamserv.exe IAMSERV.EXE IAMSTATS.EXE ICLOAD95.EXE ICLOADNT.exe ICLOADNT.EXE ICMON.EXE ICSUPP95.EXE ICSUPP95.exe ICSUPPNT.EXE IFACE.EXE IOMON98.exe IOMON98.EXE ISRV95.EXE JEDI.EXE LDNETMON.EXE LDPROMENU.EXE LDSCAN.EXE LOCKDOWN.EXE lockdown2000.exe LOCKDOWN2000.EXE LUALL.EXE LUCOMSERVER.EXE LUSPT.exe MCAGENT.EXE MCMNHDLR.EXE Mcshield.exe MCTOOL.EXE MCUPDATE.EXE MCVSRTE.EXE MCVSSHLD.EXE MGAVRTCL.EXE MGAVRTE.EXE MGHTML.EXE MINILOG.EXE Monitor.exe MONITOR.EXE MOOLIVE.EXE MPFAGENT.EXE MPFSERVICE.exe MPFTRAY.EXE MWATCH.exe MWATCH.EXE NAVAPSVC.EXE navapsvc.exe NAVAPW32.EXE NAVLU32.EXE Navw32.exe NAVWNT.EXE NDD32.EXE NeoWatchLog.exe NETUTILS.EXE NISSERV.EXE NISSERV.exe NISUM.EXE NISUM.exe NMAIN.EXE NORMIST.EXE NORMIST.exe notstart.exe NPROTECT.EXE npscheck.exe NPSSVC.EXE NSCHED32.EXE ntrtscan.EXE NTVDM.EXE NTXconfig.exe Nui.EXE Nupgrade.exe NVC95.EXE NVC95.exe NWService.exe NWTOOL16.EXE PADMIN.EXE PAVPROXY.EXE pavproxy.exe PCCIOMON.exe PCCIOMON.EXE pccntmon.EXE pccwin97.EXE PCCWIN98.EXE pcscan.EXE PERSFW.EXE PERSWF.EXE POP3TRAP.EXE POPROXY.EXE PORTMONITOR.EXE PROCESSMONITOR.EXE PROGRAMAUDITOR.EXE PVIEW95.EXE RapApp.exe rapapp.exe RAV7.EXE RAV7WIN.EXE REALMON.EXE Rescue.exe RESCUE.EXE RTVSCN95.EXE RULAUNCH.EXE sbserv.exe SCAN32.EXE SCRSCAN.EXE SMC.EXE Sphinx.exe SPHINX.EXE SPYXX.EXE SS3EDIT.EXE SWEEP95.EXE SWEEPSRV.SYS SWEEPSRV.sys SWNETSUP.EXE SymProxySvc.exe SYMTRAY.EXE TAUMON.EXE TCA.EXE TCM.EXE TDS-3.EXE TFAK.EXE vbcmserv.exe vbcmserv.EXE VbCons.exe VbCons.EXE VET32.exe VET32.EXE Vet95.exe VET95.EXE VetTray.exe VETTRAY.EXE VIR-HELP.EXE VPC32.EXE VPTRAY.EXE VSCHED.EXE VSECOMR.exe VSECOMR.EXE VSHWIN32.EXE VSMAIN.EXE vsmon.exe VSMON.EXE VSSTAT.EXE WATCHDOG.EXE WEBSCANX.EXE WEBTRAP.EXE WGFE95.EXE WIMMUN32.EXE WrAdmin.exe WRADMIN.exe WRADMIN.EXE WrCtrl.exe WRCTRL.EXE zapro.exe zonealarm.exe
This type of behaviour covers malicious programs that delete, block, modify, or copy data, disrupt computer or network performance, but which cannot be classified under any of the behaviours identified above.
This classification also covers “multipurpose” Trojan programs, i.e. those that are capable of conducting several actions at once and which demonstrate several Trojan behaviours in a single program. This means they cannot be indisputably classified as having any single behaviour.
Trojan.
- Mal/Generic-A (Sophos)
- Trojan.
Spy. Banker-5850 (ClamAV) - W32/TrojanX.
UZX (FPROT) - Trojan:
Win32/Killav. gen!A (MS(OneCare)) - BACKDOOR.
Trojan (DrWeb) - Win32/KillAV.
HL (Nod32) - Trojan.
KillAV. DQ (VirusBuster) - Win32:
Trojan-gen {Other} (AVAST) - Trojan.
Win32. Agent (Ikarus) - Generic.
SCO (AVG) - TR/KillAV.
HL (AVIRA) - Trojan.
KillAV (NAV) - Trojan.
KillAV. zz (Rising)
© 1997-2013 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.
The authors' opinions do not necessarily reflect the official positions of Kaspersky Lab.