Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\net1.exe' stop NAVW32 /y
- '<SYSTEM32>\net.exe' stop NAVAPW32 /y
- '<SYSTEM32>\net.exe' stop NAVW32 /y
- '<SYSTEM32>\net.exe' stop NMAIN /y
- '<SYSTEM32>\net1.exe' stop NMAIN /y
- '<SYSTEM32>\net1.exe' stop NAVAPW32 /y
- '<SYSTEM32>\net1.exe' stop VSHWIN32 /y
- '<SYSTEM32>\net.exe' stop AVSYNMGR /y
- '<SYSTEM32>\net.exe' stop VSHWIN32 /y
- '<SYSTEM32>\net.exe' stop VSSTAT /y
- '<SYSTEM32>\net1.exe' stop VSSTAT /y
- '<SYSTEM32>\net1.exe' stop LUALL /y
- '<SYSTEM32>\net1.exe' stop NISSERV /y
- '<SYSTEM32>\net.exe' stop ATRACK /y
- '<SYSTEM32>\net.exe' stop NISSERV /y
- '<SYSTEM32>\net.exe' stop RESCUE32 /y
- '<SYSTEM32>\net1.exe' stop RESCUE32 /y
- '<SYSTEM32>\net1.exe' stop ATRACK /y
- '<SYSTEM32>\net1.exe' stop LUCOMSERVER /y
- '<SYSTEM32>\net.exe' stop LUALL /y
- '<SYSTEM32>\net.exe' stop LUCOMSERVER /y
- '<SYSTEM32>\net.exe' stop IAMAPP /y
- '<SYSTEM32>\net1.exe' stop IAMAPP /y
- '<SYSTEM32>\net1.exe' stop AVSYNMGR /y
- '<SYSTEM32>\net1.exe' stop MONSYSNT /y
- '<SYSTEM32>\net.exe' stop MONSVCNT /y
- '<SYSTEM32>\net.exe' stop MONSYSNT /y
- '<SYSTEM32>\net.exe' stop KIMLAB /y
- '<SYSTEM32>\net1.exe' stop KIMLAB /y
- '<SYSTEM32>\net1.exe' stop MONSVCNT /y
- '<SYSTEM32>\net1.exe' stop V3 /y
- '<SYSTEM32>\net.exe' stop V3CFGU /y
- '<SYSTEM32>\net.exe' stop V3 /y
- '<SYSTEM32>\net.exe' stop V3PRO32 /y
- '<SYSTEM32>\net1.exe' stop V3PRO32 /y
- '<SYSTEM32>\net1.exe' stop AHNLAB /y
- '<SYSTEM32>\net1.exe' stop WEBTRAP /y
- '<SYSTEM32>\net.exe' stop POP3TRAP /y
- '<SYSTEM32>\net.exe' stop WEBTRAP /y
- '<SYSTEM32>\net.exe' stop AVCONSOL /y
- '<SYSTEM32>\net1.exe' stop AVCONSOL /y
- '<SYSTEM32>\net1.exe' stop POP3TRAP /y
- '<SYSTEM32>\net1.exe' stop PCCIOMON /y
- '<SYSTEM32>\net.exe' stop AHNLAB /y
- '<SYSTEM32>\net.exe' stop PCCIOMON /y
- '<SYSTEM32>\net.exe' stop PCCMAIN /y
- '<SYSTEM32>\net1.exe' stop PCCMAIN /y
- '<SYSTEM32>\net.exe' stop ANTIVIR /y
- '<SYSTEM32>\net1.exe' stop ANTIVIR /y
- '<SYSTEM32>\net1.exe' stop WEBSCANX /y
- '<SYSTEM32>\net1.exe' stop SAFEWEB /y
- '<SYSTEM32>\net.exe' stop WEBSCANX /y
- '<SYSTEM32>\net.exe' stop MCAFEE /y
- '<SYSTEM32>\net.exe' stop NVC95 /y
- '<SYSTEM32>\net1.exe' stop NVC95 /y
- '<SYSTEM32>\net1.exe' stop NORTON /y
- '<SYSTEM32>\net1.exe' stop MCAFEE /y
- '<SYSTEM32>\net.exe' stop NORTON /y
- '<SYSTEM32>\net.exe' stop SAFEWEB /y
- '<SYSTEM32>\net.exe' stop AVP.EXE /y
- '<SYSTEM32>\net1.exe' stop AVP.EXE /y
- '<SYSTEM32>\net1.exe' stop MsMpSvc /y
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\killav.bat" "
- '<SYSTEM32>\net.exe' stop MsMpSvc /y
- '<SYSTEM32>\net.exe' stop CFINET32 /y
- '<SYSTEM32>\net.exe' stop ICMON /y
- '<SYSTEM32>\net1.exe' stop ICMON /y
- '<SYSTEM32>\net1.exe' stop CFINET /y
- '<SYSTEM32>\net1.exe' stop CFINET32 /y
- '<SYSTEM32>\net.exe' stop CFINET /y
- '<SYSTEM32>\net.exe' stop FP-WIN /y
- '<SYSTEM32>\net.exe' stop NAVLU32 /y
- '<SYSTEM32>\net1.exe' stop NAVLU32 /y
- '<SYSTEM32>\net1.exe' stop NAVRUNR /y
- '<SYSTEM32>\net1.exe' stop NAVWNT /y
- '<SYSTEM32>\net.exe' stop NAVRUNR /y
- '<SYSTEM32>\net.exe' stop NAVAPSVC /y
- '<SYSTEM32>\net.exe' stop SYMPROXYSVC /y
- '<SYSTEM32>\net1.exe' stop SYMPROXYSVC /y
- '<SYSTEM32>\net1.exe' stop NISUM /y
- '<SYSTEM32>\net1.exe' stop NAVAPSVC /y
- '<SYSTEM32>\net.exe' stop NISUM /y
- '<SYSTEM32>\net.exe' stop NAVWNT /y
- '<SYSTEM32>\net.exe' stop PCCWIN98 /y
- '<SYSTEM32>\net1.exe' stop PCCWIN98 /y
- '<SYSTEM32>\net1.exe' stop IOMON98 /y
- '<SYSTEM32>\net1.exe' stop FP-WIN /y
- '<SYSTEM32>\net.exe' stop IOMON98 /y
- '<SYSTEM32>\net.exe' stop F-PROT95 /y
- '<SYSTEM32>\net.exe' stop PVIEW95 /y
- '<SYSTEM32>\net1.exe' stop PVIEW95 /y
- '<SYSTEM32>\net1.exe' stop F-STOPW /y
- '<SYSTEM32>\net1.exe' stop F-PROT95 /y
- '<SYSTEM32>\net.exe' stop F-STOPW /y
Modifies file system :
Creates the following files:
- %TEMP%\1.tmp\killav.bat
