Technical Information
Malicious functions:
Creates and executes the following:
- <Current directory>\savedump.exe
- <Current directory>\saveddump.exe
Terminates or attempts to terminate
the following user processes:
- smc.exe
- AVGCTRL.EXE
- GUARD.EXE
- spidernt.exe
- ekrn.exe
- AVP.EXE
- avgcc.exe
- ccapp.exe
Restores hooked functions in System Service Descriptor Table (SSDT).
Hides the following processes:
Modifies file system :
Creates the following files:
- <Current directory>\savedump.exe
- <Current directory>\saveddump.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
