English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Trojan.Win32.KillAV.br

Detected Jan 03 2004 13:28 GMT
Released Jan 03 2004 13:28 GMT
Published May 11 2006 16:12 GMT

Technical Details
Payload

Technical Details

This Trojan will terminate a range of legitimate programs on the victim machine. The Trojan itself is a Windows PE EXE file 4608 bytes in size.

Installation

Once launched, the Trojan creates a file called mserv.exe, 6656 bytes in size, in the Windows root directory:

%Windir%/mserv.exe

The Trojan then creates the following entries in the system registry:

[HKLM\System\CurrentControlSet001\Enum\Root\LEGACY_ANEM]
 Service="anem"
 Legacy="dword:00000001"
 Class="LegacyDriver"
 DeviceDesc="mserv.exe"

Payload

The Trojan terminates processes listed below:

_AVP32.EXE
_AVPCC.EXE
_AVPM.EXE
AckWin32.exe
ACKWIN32.EXE
ALERTSVC.EXE
ALOGSERV.EXE
Anti-Trojan.exe
ANTS.EXE
ATCON.EXE
ATCON.EXE
ATUPDATER.EXE
ATWATCH.EXE
AutoDown.exe
AutoTrace.exe
AUTOUPDATE.EXE
AVCONSOL.EXE
AVGCC32.EXE
AVGCTRL.EXE
AVGSERV.EXE
AvkServ.exe
AVKSERV.EXE
AVP.EXE
AVP32.EXE
AVPCC.EXE
AVPM.EXE
AVSYNMGR.EXE
AVXMONITOR9X.EXE
AVXMONITOR9X.EXE
AVXMONITORNT.EXE
AVXQUAR.EXE
blackd.exe
blackice.exe
Claw95.exe
Claw95cf.exe
cleaner.exe
cleaner3.exe
cpd.exe
DEFWATCH.EXE
DOORS.EXE
F-AGNT95.EXE
FAST.EXE
F-PROT95.EXE
FRW.EXE
FRW.EXE
GUARD.EXE
GUARD.EXE
iamapp.exe
IAMAPP.EXE
iamserv.exe
IAMSERV.EXE
ICLOAD95.EXE
ICLOADNT.EXE
ICLOADNT.EXE
ICMON.EXE
ICSUPP95.EXE
ICSUPP95.EXE
ICSUPPNT.EXE
ICSUPPNT.EXE
IFACE.EXE
IFACE.EXE
IOMON98.EXE
ISRV95.EXE
JEDI.EXE
LOCKDOWN2000.EXE
LUCOMSERVER.EXE
MCAGENT.EXE
MCAGENT.EXE
Mcshield.exe
MCUPDATE.EXE
MCUPDATE.EXE
MINILOG.EXE
MONITOR.EXE
MOOLIVE.EXE
NAVAPW32.EXE
NAVAPW32.EXE
NAVAPW32.EXE
NavLu32.exe
NAVW32.EXE
Navw32.exe
NDD32.EXE
NeoWatchLog.exe
NeoWatchTray.exe
NISSERV
NISUM.EXE
NMAIN.EXE
NORMIST.EXE
notstart.exe
NPROTECT.EXE
NSCHED32.EXE
NTXconfig.exe
Nupgrade.exe
NVC95.EXE
NWService.exe
outpost.exe
PCCIOMON.EXE
PERSFW.EXE
POP3TRAP.EXE
POPROXY.EXE
REALMON95.EXE
Rescue.exe
RTVSCN95.EXE
Smc.exe
SPHINX.EXE
SPYXX.EXE
SPYXX.EXE
SS3EDIT.EXE
SS3EDIT.EXE
SWNETSUP.EXE
SymProxySvc.exe
SYNMGR.EXE
TAUMON.EXE
TC.EXE
tca.exe
TCA.EXE
TCM.EXE
TDS-3.EXE
TFAK.EXE
TFAK.EXE
TRJSCAN.EXE
VetTray.exe
VPTRAY.EXE
VSECOMR.EXE
VSHWIN32.EXE
VSHWIN32.EXE
VSMON.EXE
VSSTAT.EXE
VSSTAT.EXE
WATCHDOG.EXE
WebScanX.exe
WEBSCANX.EXE
WEBTRAP.EXE
WGFE95.EXE
WRADMIN.EXE
WrAdmin.exe
WRCTRL.EXE
WrCtrl.exe
WrCtrl.exe
ZATUTOR.EXE
ZAUINST.EXE
ZONEALARM.EXE

Bookmark and Share
Share
Trojan

This type of behaviour covers malicious programs that delete, block, modify, or copy data, disrupt computer or network performance, but which cannot be classified under any of the behaviours identified above.

This classification also covers “multipurpose” Trojan programs, i.e. those that are capable of conducting several actions at once and which demonstrate several Trojan behaviours in a single program. This means they cannot be indisputably classified as having any single behaviour.


Other versions

Aliases

Trojan.Win32.KillAV.br (Kaspersky Lab) is also known as:

  • Trojan: MultiDropper-GP.d (McAfee)
  • Troj/Killav-A (Sophos)
  • Trojan.Killav.BR (ClamAV)
  • Trj/Killav.AI (Panda)
  • W32/Tofger.J (FPROT)
  • Trojan:Win32/Killav.BR (MS(OneCare))
  • Trojan.MulDrop.739 (DrWeb)
  • Win32/KillAV.BR trojan (Nod32)
  • Generic.Malware.P!Pk!g.B532590E (BitDef7)
  • Trojan.DR.Small.GV (VirusBuster)
  • Win32:Trojan-gen (AVAST)
  • Trojan.Win32.KillAV (Ikarus)
  • Generic.KWV.dropper (AVG)
  • WORM/Dumaru.e.4 (AVIRA)
  • Trojan.Dropper (NAV)
  • W32/Tofger.B (Norman)
  • MultiDropper-GP.d (NAI)
  • TROJ_KILLAV.BR (PCCIL)
  • Trojan.Spy.Tofger.al (Rising)