English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Trojan.Win32.KillAV.hl

Detected Mar 20 2006 08:42 GMT
Released Mar 20 2006 08:42 GMT
Published Apr 03 2006 12:42 GMT

Technical Details

This Trojan program deletes a number of legal programs from memorz. The Trojan itself is a Windows PE EXE file, 103424 bytes in size.

Once launched, the Trojan copies itself to the Windows system directory as shell33.exe:

%System%/shell33.exe

The following icon is used for this file in File Manager:

The Trojan then registers itself in the system registry, ensuring that it will be launched each time Windows is rebooted on the victim machine:

[HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
 "System"="%System%\shell33.exe"

The Trojan terminates the processes listed below:

_AVP32.EXE
_AVPCC.EXE
_AVPM.EXE
AckWin32.exe
AckWin32.EXE
ACKWIN32.EXE
ADVXDWIN.EXE
agentw.exe
ALERTSVC.EXE
alogserv.exe
ALOGSERV.EXE
AMON9X.EXE
ANTI-TROJAN.EXE
ANTS.EXE
APVXDWIN.EXE
apvxdwin.exe
ATCON.EXE
ATUPDATER.EXE
ATWATCH.EXE
AUTODOWN.exe
AutoDown.exe
AUTODOWN.EXE
AutoTrace.exe
AVCONSOL.EXE
AVGCC32.exe
AVGCC32.EXE
AVGCTRL.EXE
Avgctrl.exe
AVGSERV.EXE
AVGSERV.exe
AVGSERV9.EXE
AVGW.EXE
avkpop.exe
AvkServ.exe
avkservice.exe
avkwctl9.exe
AVP.EXE
AVP32.EXE
AVP32.EXE 
AVPCC.EXE
avpcc.exe
AVPM.EXE
avpm.exe
Avsched32.exe
AVSYNMGR.exe
AVSYNMGR.EXE
AVWINNT.EXE
AVXMONITOR9X.EXE
AVXMONITOR9X.exe
AVXMONITORNT.EXE
AVXMONITORNT.exe
AVXQUAR.EXE
AVXQUAR.EXE.EXE
AVXW.EXE
backd.exe
blackd.exe
BLACKD.EXE
BlackICE.exe
ccApp.exe
ccEvtMgr.exe
ccPxySvc.exe
ccPxySvc.EXE
CDP.EXE
cfgWiz.exe 
Claw95.exe
Claw95.EXE
CLAW95.EXE
Claw95cf.exe
CLAW95CF.EXE
cleaner.EXE
cleaner3.EXE
CMGRDIAN.EXE
CONNECTIONMONITOR.EXE
cpd.exe
cpd.EXE
CPDCLNT.EXE
CPDClnt.exe
CTRL.EXE
defalert.exe
defscangui.exe
defscangui.exe 
DEFWATCH.EXE
DOORS.EXE
DOORS.exe
DVP95.EXE
DVP95_0.EXE
EFPEADM.exe
EFPEADM.EXE
ETRUSTCIPE.exe
ETRUSTCIPE.EXE
EVPN.exe
EVPN.EXE
EXPERT.EXE
F-AGNT95.EXE
fameh32.exe
fch32.exe
fih32.exe
fnrb32.exe
F-PROT.EXE
F-PROT95.EXE
FP-WIN.EXE
FRW.exe
FRW.EXE
fsaa.exe
fsav32.exe
fsgk32.exe
fsm32.exe
fsma32.exe
fsmb32.exe
f-stopw.exe
F-STOPW.EXE
gbmenu.exe
GBPOLL.EXE
gbpoll.exe
GENERICS.EXE
GUARD.EXE
GUARD.exe
GUARDDOG.EXE
iamapp.exe
IAMAPP.EXE
IAMAPP.exe
iamserv.exe
IAMSERV.EXE
IAMSTATS.EXE
ICLOAD95.EXE
ICLOADNT.exe
ICLOADNT.EXE
ICMON.EXE
ICSUPP95.EXE
ICSUPP95.exe
ICSUPPNT.EXE
IFACE.EXE
IOMON98.exe
IOMON98.EXE
ISRV95.EXE
JEDI.EXE
LDNETMON.EXE
LDPROMENU.EXE
LDSCAN.EXE
LOCKDOWN.EXE
lockdown2000.exe
LOCKDOWN2000.EXE
LUALL.EXE
LUCOMSERVER.EXE
LUSPT.exe
MCAGENT.EXE
MCMNHDLR.EXE
Mcshield.exe
MCTOOL.EXE
MCUPDATE.EXE
MCVSRTE.EXE
MCVSSHLD.EXE
MGAVRTCL.EXE
MGAVRTE.EXE
MGHTML.EXE
MINILOG.EXE
Monitor.exe
MONITOR.EXE
MOOLIVE.EXE
MPFAGENT.EXE
MPFSERVICE.exe
MPFTRAY.EXE
MWATCH.exe
MWATCH.EXE
NAVAPSVC.EXE
navapsvc.exe
NAVAPW32.EXE
NAVLU32.EXE
Navw32.exe
NAVWNT.EXE
NDD32.EXE
NeoWatchLog.exe
NETUTILS.EXE
NISSERV.EXE
NISSERV.exe
NISUM.EXE
NISUM.exe
NMAIN.EXE
NORMIST.EXE
NORMIST.exe
notstart.exe
NPROTECT.EXE
npscheck.exe
NPSSVC.EXE
NSCHED32.EXE
ntrtscan.EXE
NTVDM.EXE
NTXconfig.exe
Nui.EXE
Nupgrade.exe
NVC95.EXE
NVC95.exe
NWService.exe
NWTOOL16.EXE
PADMIN.EXE
PAVPROXY.EXE
pavproxy.exe
PCCIOMON.exe
PCCIOMON.EXE
pccntmon.EXE
pccwin97.EXE
PCCWIN98.EXE
pcscan.EXE
PERSFW.EXE
PERSWF.EXE
POP3TRAP.EXE
POPROXY.EXE
PORTMONITOR.EXE
PROCESSMONITOR.EXE
PROGRAMAUDITOR.EXE
PVIEW95.EXE
RapApp.exe
rapapp.exe
RAV7.EXE
RAV7WIN.EXE
REALMON.EXE
Rescue.exe
RESCUE.EXE
RTVSCN95.EXE
RULAUNCH.EXE
sbserv.exe
SCAN32.EXE
SCRSCAN.EXE
SMC.EXE
Sphinx.exe
SPHINX.EXE
SPYXX.EXE
SS3EDIT.EXE
SWEEP95.EXE
SWEEPSRV.SYS
SWEEPSRV.sys
SWNETSUP.EXE
SymProxySvc.exe
SYMTRAY.EXE
TAUMON.EXE
TCA.EXE
TCM.EXE
TDS-3.EXE
TFAK.EXE
vbcmserv.exe
vbcmserv.EXE
VbCons.exe
VbCons.EXE
VET32.exe
VET32.EXE
Vet95.exe
VET95.EXE
VetTray.exe
VETTRAY.EXE
VIR-HELP.EXE
VPC32.EXE
VPTRAY.EXE
VSCHED.EXE
VSECOMR.exe
VSECOMR.EXE
VSHWIN32.EXE
VSMAIN.EXE
vsmon.exe
VSMON.EXE
VSSTAT.EXE
WATCHDOG.EXE
WEBSCANX.EXE
WEBTRAP.EXE
WGFE95.EXE
WIMMUN32.EXE
WrAdmin.exe
WRADMIN.exe
WRADMIN.EXE
WrCtrl.exe
WRCTRL.EXE
zapro.exe
zonealarm.exe

Bookmark and Share
Share
Trojan

This type of behaviour covers malicious programs that delete, block, modify, or copy data, disrupt computer or network performance, but which cannot be classified under any of the behaviours identified above.

This classification also covers “multipurpose” Trojan programs, i.e. those that are capable of conducting several actions at once and which demonstrate several Trojan behaviours in a single program. This means they cannot be indisputably classified as having any single behaviour.


Other versions

Aliases

Trojan.Win32.KillAV.hl (Kaspersky Lab) is also known as:

  • Mal/Generic-A (Sophos)
  • Trojan.Spy.Banker-5850 (ClamAV)
  • W32/TrojanX.UZX (FPROT)
  • Trojan:Win32/Killav.gen!A (MS(OneCare))
  • BACKDOOR.Trojan (DrWeb)
  • Win32/KillAV.HL (Nod32)
  • Trojan.KillAV.DQ (VirusBuster)
  • Win32:Trojan-gen {Other} (AVAST)
  • Trojan.Win32.Agent (Ikarus)
  • Generic.SCO (AVG)
  • TR/KillAV.HL (AVIRA)
  • Trojan.KillAV (NAV)
  • Trojan.KillAV.zz (Rising)