English

Log in

Search

The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service.

Internet threat level: 1

Read us on

Home→Descriptions→Trojan.Win32.KillFiles.afz

Trojan.Win32.KillFiles.afz

Detected	Nov 12 2008 22:34 GMT
Released	Nov 13 2008 02:52 GMT
Published	Sep 20 2011 14:15 GMT

Technical Details
Payload
Removal instructions

Technical Details

A trojan program designed to delete components of the security software Gbuster plugin for Internet Explorer. Implemented in the form of an NT kernel mode driver. 5632 bytes. Written in C++.

Payload

After launching, the trojan tries to delete the following files:

C:\Arquivos de Programas\Scpad\Sshib.dll
C:\Arquivos de Programas\Scpad\Scpsssh2.dll
C:\Arquivos de Programas\Scpad\Scpmib.dll
C:\Arquivos de Programas\Scpad\Scplib.dll
C:\Arquivos de Programas\Scpad\Scpibcfg.bin
C:\Arquivos de Programas\GbPlugin\isg.gpc
C:\Arquivos de Programas\GbPlugin\cef.gpc
C:\Arquivos de Programas\GbPlugin\gbieh.dll
C:\Arquivos de Programas\GbPlugin\bb.gpc
C:\Arquivos de Programas\GbPlugin\gbiehcef.dll
C:\Arquivos de Programas\GbPlugin\gbiehisg.dll
C:\Arquivos de Programas\GbPlugin\gbpdist.dll
C:\Arquivos de Programas\GbPlugin\gbieh.gmd
C:\Arquivos de Programas\GbPlugin\gbpsv.exe
C:\Program Files\Scpad\Sshib.dll
C:\Program Files\Scpad\Scpsssh2.dll
C:\Program Files\\Scpad\Scpmib.dll
C:\Program Files\Scpad\Scplib.dll
C:\Program Files\Scpad\Scpibcfg.bin
C:\Program Files\GbPlugin\isg.gpc
C:\Program Files\GbPlugin\cef.gpc
C:\Program Files\GbPlugin\bb.gpc
C:\Program Files\GbPlugin\gbieh.dll
C:\Program Files\GbPlugin\gbiehcef.dll
C:\Program Files\GbPlugin\gbiehisg.dll
C:\Program Files\GbPlugin\gbpdist.dll
C:\Program Files\GbPlugin\gbieh.gmd
C:\Program Files\GbPlugin\gbpsv.exe
C:\Arquivos de Programas\Scpad
C:\Arquivos de Programas\GbPlugin
C:\Program Files\GbPlugin

Removal instructions

If your computer has not been protected with anti-virus software and has been infected with malware, you will need to take the following actions to delete this:

Delete the original trojan file (its location on the infected computer will depend on how it got onto the computer).
Run a full Kaspersky Antivirus scan of the computer with updated antivirus databases (download trial version).

MD5: 0EC41D1575FCD41247ECC2F2B668F90F
SHA1: 70755C21242BA85EC2168206E4D12BD9AEE2001A

Print

Share

Malicious programs

Trojans

Trojan

This type of behaviour covers malicious programs that delete, block, modify, or copy data, disrupt computer or network performance, but which cannot be classified under any of the behaviours identified above.

This classification also covers “multipurpose” Trojan programs, i.e. those that are capable of conducting several actions at once and which demonstrate several Trojan behaviours in a single program. This means they cannot be indisputably classified as having any single behaviour.

Other versions

Trojan.Win32.KillFiles.ac

Trojan.Win32.KillFiles.cgi

Trojan.Win32.KillFiles.ki

Trojan.Win32.KillFiles.lm

Aliases

Trojan.Win32.KillFiles.afz (Kaspersky Lab) is also known as:

Trojan: Generic Del.x (McAfee)
Mal/Generic-A (Sophos)
W32/Trojan2.FWAA (FPROT)
Trojan:Win32/Killfiles.ET (MS(OneCare))
Trojan.KillFiles.869 (DrWeb)
a variant of Win32/KillFiles trojan (Nod32)
Trojan.Generic.1178245 (BitDef7)
Trojan.KillFiles.XP (VirusBuster)
Win32:Rootkit-gen [Rtk] (AVAST)
Trojan.Win32.KillFiles (Ikarus)
Generic12.WEY (AVG)
TR/Rootkit.Gen (AVIRA)
Trojan Horse (NAV)
W32/Rootkit.TKB (Norman)
TROJ_Generic.DIS (TrendMicro)

© 1997-2013 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.
The authors' opinions do not necessarily reflect the official positions of Kaspersky Lab.

kaspersky.com

securelist.com