Trojan.AVKill.24590

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winhlp32.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dfrg.msc] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleanmgr.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winhelp.exe] 'Debugger' = ' '
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Runouce' = '<SYSTEM32>\Runouce.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AvastUi.exe' = 'C:\Runouce.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SM?RTP] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpvsetup.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.exe, C:\Runouce.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe, %WINDIR%\svchost.exe, <SYSTEM32>\Runouce.exe '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntbackup.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dxdiag.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordpad.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegistryEditor.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regedit.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastUi.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '<Virus name>' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avp.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Notepad.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VB6.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVG.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ARTAV Internet Security.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creator.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Virus.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mapix.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Katrox.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Morphost.exe] 'Debugger' = ' '
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Artav.exe] 'Debugger' = ' '

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)
Registry Editor (RegEdit)

Terminates or attempts to terminate

the following user processes:

AVP.EXE
firefox.exe

Modifies settings of Windows Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'

Modifies file system :

Creates the following files:

C:\Mayda, I LOVE YOU.exe
C:\The killer.exe
C:\Ngentot.exe
C:\Crack Avast.exe
C:\Crack Kaspersky.exe
C:\Cendoro Bergoyang.exe
C:\Cinta Di tolak, Dukun Bertindak.exe
C:\Crack Adobe.exe
C:\Ria Yasinta.exe
C:\Ngentot Murah.exe
C:\AKU CINTA KAU.exe
C:\Adobe Photoshop.exe
C:\Crack smadav.exe
C:\Cara Bobol Facebook.exe
C:\Dapatkan Pulsa Gratis.exe
C:\Hentai Naruto dan Sakura.exe
<SYSTEM32>\No, He Does Not.exe
<SYSTEM32>\The bugil.exe
<SYSTEM32>\Bugil Terbaru.exe
C:\Facebook Hack.exe
C:\13 Tahun sudah berani.exe
C:\Crack Avira.exe
C:\Penis Terbesar.exe
C:\Payudara Termontok.exe
C:\Pantat Terseksi.exe
C:\Smadav tai.exe
C:\Anti-Antivirus.exe
C:\No-Antivirus.exe
C:\Smadav Bajakan.exe
C:\Memek Terseksi.exe
C:\WOW, enak banget!!.exe
C:\No, He Does Not.exe
C:\The bugil.exe
C:\Bugil Terbaru.exe
C:\karek Wonge.exe
C:\AKU SAYANG KAMU.exe
C:\Dancok kabeh.exe
C:\Smadav 2013.exe
C:\MAN Tuban Ngentot.exe
C:\Visual Basic.exe
C:\Virus Worm.exe
C:\Avira.exe
C:\Helmi Dancok.exe
C:\Spongebob Hentai.exe
C:\Dukung Jokowi.exe
C:\Avira Mobile.exe
C:\Virus Lokal.exe
C:\Trojan Generic.exe
C:\Hargailah orang lain.exe
C:\Stop Pembajakan.exe
<SYSTEM32>\Crack Avast.exe
<SYSTEM32>\Crack Kaspersky.exe
<SYSTEM32>\Cendoro Bergoyang.exe
<SYSTEM32>\13 Tahun sudah berani.exe
<SYSTEM32>\Crack Avira.exe
<SYSTEM32>\Crack smadav.exe
<SYSTEM32>\Ngentot Murah.exe
<SYSTEM32>\AKU CINTA KAU.exe
<SYSTEM32>\Adobe Photoshop.exe
<SYSTEM32>\Mayda, I LOVE YOU.exe
<SYSTEM32>\The killer.exe
<SYSTEM32>\Ngentot.exe
<SYSTEM32>\Facebook Hack.exe
<SYSTEM32>\Runouce.exe
<SYSTEM32>\Wplugin.exe
<SYSTEM32>\WinHelp.exe
C:\1.bat
C:\Autorun.inf
<SYSTEM32>\Penis Terbesar.exe
<SYSTEM32>\Payudara Termontok.exe
<SYSTEM32>\Pantat Terseksi.exe
<SYSTEM32>\Cara Bobol Facebook.exe
<SYSTEM32>\Dapatkan Pulsa Gratis.exe
<SYSTEM32>\Hentai Naruto dan Sakura.exe
<SYSTEM32>\Smadav Bajakan.exe
<SYSTEM32>\Memek Terseksi.exe
<SYSTEM32>\WOW, enak banget!!.exe
<SYSTEM32>\Avira Mobile.exe
<SYSTEM32>\Virus Lokal.exe
<SYSTEM32>\Smadav 2013.exe
<SYSTEM32>\karek Wonge.exe
<SYSTEM32>\AKU SAYANG KAMU.exe
<SYSTEM32>\Dancok kabeh.exe
<SYSTEM32>\Smadav tai.exe
<SYSTEM32>\Anti-Antivirus.exe
<SYSTEM32>\No-Antivirus.exe
<SYSTEM32>\Dukung Jokowi.exe
<SYSTEM32>\Avira.exe
<SYSTEM32>\Helmi Dancok.exe
<SYSTEM32>\Spongebob Hentai.exe
<SYSTEM32>\Cinta Di tolak, Dukun Bertindak.exe
<SYSTEM32>\Crack Adobe.exe
<SYSTEM32>\Ria Yasinta.exe
<SYSTEM32>\Trojan Generic.exe
<SYSTEM32>\Hargailah orang lain.exe
<SYSTEM32>\Stop Pembajakan.exe
<SYSTEM32>\MAN Tuban Ngentot.exe
<SYSTEM32>\Visual Basic.exe
<SYSTEM32>\Virus Worm.exe

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\Runouce.exe
C:\Autorun.inf
C:\1.bat

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: ''

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial