ProcKill-AF

Content

ProcKill-AF

Type: Trojan
SubType: Process
Discovery Date: 03/06/2003
Length: 17,410 bytes
Minimum DAT: 4252 (03/12/2003)
Updated DAT: 4775 (06/01/2006)
Minimum Engine: 5.1.00
Description Added: 03/06/2003
Description Modified: 03/07/2003 4:19 PM (PT)

Risk Assessment

Corporate User: Low
Home User: Low

Tab Navigation

Characteristics

This trojan attempts to terminate the process of the following security programs:

AGENTW.EXE

MONITOR.EXE

AVPM.EXE

_AVP32.EXE

AVP32.EXE

F-STOPW.EXE

APVXDWIN.EXE

PAVPROXY.EXE

VBCONS.EXE

VBCMSERV.EXE

_AVPCC.EXE

TAUMON.EXE

ZONEALARM.EXE

VSMON.EXE

ZAPRO.EXE

PERSWF.EXE

MPFAGENT.EXE

MPFSERVICE.EXE

MPFTRAY.EXE

AVSYNMGR.EXE

VSHWIN32.EXE

VSECOMR.EXE

WEBSCANX.EXE

AVCONSOL.EXE

VSSTAT.EXE

CPD.EXE

ALOGSERV.EXE

CMGRDIAN.EXE

RULAUNCH.EXE

VSMAIN.EXE

MCSHIELD.EXE

CPDCLNT.EXE

CFGWIZ.EXE

AMAPP.EXE

FRW.EXE

WRCTRL.EXE

BLACKICE.EXE

RAPAPP.EXE

IAMAPP.EXE

NISUM.EXE

IAMSTATS.EXE

LUSPT.EXE

CCAPP.EXE

CCEVTMGR.EXE

CCPXYSVC.EXE

NISSERV.EXE

VET32.EXE

ETRUSTCIPE.EXE

CLEANER3.EXE

CLEANER.EXE

NAVW32.EXE

AVXMONITOR9X.EXE

AVXMONITORNT.EXE

NORMIST.EXE

NVC95.EXE

NUPGRADE.EXE

AVGCC32.EXE

AVGCTRL.EXE

AVGSERV.EXE

ICLOADNT.EXE

IOMON98.EXE

VETTRAY.EXE

WRADMIN.EXE

GUARD.EXE

DOORS.EXE

PCCIOMON.EXE

AVKSERV.EXE

NOTSTART.EXE

MINILOG.EXE

BLACKD.EXE

NMAIN.EXE

IAMSERV.EXE

CDP.EXE

GUARDDOG.EXE

PERSFW.EXE

LOCKDOWN.EXE

LOCKDOWN2000.EXE

SPHINX.EXE

NPROTECT.EXE

NDD32.EXE

SMC.EXE

NETUTILS.EXE

LDNETMON.EXE

PORTMONITOR.EXE

CONNECTIONMONITOR.EXE

SYMPROXYSVC.EXE

SWEEPSRV.SYS

_AVPM.EXE

AVP.EXE

NAVAPW32.EXE

RTVSCN95.EXE

DEFWATCH.EXE

VPC32.EXE

VPTRAY.EXE

POPROXY.EXE

NAVAPSVC.EXE

ALERTSVC.EXE

NAVLU32.EXE

NAVWNT.EXE

NPSSVC.EXE

LUALL.EXE

SWNETSUP.EXE

ICLOAD95.EXE

ICMON.EXE

ICSUPP95.EXE

ICSUPPNT.EXE

IFACE.EXE

ADVXDWIN.EXE

PADMIN.EXE

NWTOOL16.EXE

NTVDM.EXE

ANTS.EXE

ANTI-TROJAN.EXE

TC.EXE

TCA.EXE

TCM.EXE

MOOLIVE.EXE

MGHTML.EXE

MCMNHDLR.EXE

MCVSRTE.EXE

MCVSSHLD.EXE

MGAVRTCL.EXE

MGAVRTE.EXE

SCAN32.EXE

SCRSCAN.EXE

SYMTRAY.EXE

VSCHED.EXE

MCTOOL.EXE

AVXW.EXE

AVXQUAR.EXE

AMON9X.EXE

AVGW.EXE

WEBTRAP.EXE

PCCWIN98.EXE

POP3TRAP.EXE

TDS-3.EXE

SS3EDIT.EXE

JEDI.EXE

RAV7WIN.EXE

RAV7.EXE

SWEEP95.EXE

MCAGENT.EXE

MCUPDATE.EXE

NTRTSCAN.EXE

PCCWIN97.EXE

PCCNTMON.EXE

PCSCAN.EXE

NUI.EXE

CLAW95.EXE

VET95.EXE

AUTODOWN.EXE

MWATCH.EXE

EFPEADM.EXE

EVPN.EXE

RESCUE.EXE

ACKWIN32.EXE

DVP95.EXE

DVP95_0.EXE

F-AGNT95.EXE

F-PROT95.EXE

EXPERT.EXE

FP-WIN.EXE

VIR-HELP.EXE

F-PROT.EXE

SPYXX.EXE

ATWATCH.EXE

ATUPDATER.EXE

ATCON.EXE

PVIEW95.EXE

WGFE95.EXE

CTRL.EXE

LDPROMENU.EXE

LDSCAN.EXE

GENERICS.EXE

PROCESSMONITOR.EXE

PROGRAMAUDITOR.EXE

TFAK.EXE

LUCOMSERVER.EXE

WIMMUN32.EXE

AUTOTRACE.EXE

NWSERVICE.EXE

NTXCONFIG.EXE

NEOWATCHLOG.EXE

NSCHED32.EXE

WATCHDOG.EXE

ISRV95.EXE

REALMON.EXE

AVWINNT.EXE

AVGSERV9.EXE

AVKPOP.EXE

AVKSERVICE.EXE

AVKWCTL9.EXE

FSAV32.EXE

FAMEH32.EXE

FCH32.EXE

FIH32.EXE

FNRB32.EXE

FSAA.EXE

FSGK32.EXE

FSM32.EXE

FSMA32.EXE

FSMB32.EXE

SBSERV.EXE

GBPOLL.EXE

GBMENU.EXE

AVSCHED32.EXE

DEFSCANGUI.EXE

DEFALERT.EXE

NPSCHECK.EXE

It also searches for processes with a list of strings taken from the above list, minus the ".exe" extension. Any processes which it finds which match, it will also terminate.

This trojan adds itself to the Windows directory as WINLOGON .EXE, and it creates the following registry key to run itself at Windows startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
"W1N32.DLL" = C:\WINDOWS\WINLOGON�.exe

Symptoms

The security programs which use the filenames listed above will cease to run even when restarted, as long as the trojan is in memory.

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, etc.

Removal

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

N/A

All Information

Overview -

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

Characteristics -

This trojan attempts to terminate the process of the following security programs:

AGENTW.EXE

MONITOR.EXE

AVPM.EXE

_AVP32.EXE

AVP32.EXE

F-STOPW.EXE

APVXDWIN.EXE

PAVPROXY.EXE

VBCONS.EXE

VBCMSERV.EXE

_AVPCC.EXE

TAUMON.EXE

ZONEALARM.EXE

VSMON.EXE

ZAPRO.EXE

PERSWF.EXE

MPFAGENT.EXE

MPFSERVICE.EXE

MPFTRAY.EXE

AVSYNMGR.EXE

VSHWIN32.EXE

VSECOMR.EXE

WEBSCANX.EXE

AVCONSOL.EXE

VSSTAT.EXE

CPD.EXE

ALOGSERV.EXE

CMGRDIAN.EXE

RULAUNCH.EXE

VSMAIN.EXE

MCSHIELD.EXE

CPDCLNT.EXE

CFGWIZ.EXE

AMAPP.EXE

FRW.EXE

WRCTRL.EXE

BLACKICE.EXE

RAPAPP.EXE

IAMAPP.EXE

NISUM.EXE

IAMSTATS.EXE

LUSPT.EXE

CCAPP.EXE

CCEVTMGR.EXE

CCPXYSVC.EXE

NISSERV.EXE

VET32.EXE

ETRUSTCIPE.EXE

CLEANER3.EXE

CLEANER.EXE

NAVW32.EXE

AVXMONITOR9X.EXE

AVXMONITORNT.EXE

NORMIST.EXE

NVC95.EXE

NUPGRADE.EXE

AVGCC32.EXE

AVGCTRL.EXE

AVGSERV.EXE

ICLOADNT.EXE

IOMON98.EXE

VETTRAY.EXE

WRADMIN.EXE

GUARD.EXE

DOORS.EXE

PCCIOMON.EXE

AVKSERV.EXE

NOTSTART.EXE

MINILOG.EXE

BLACKD.EXE

NMAIN.EXE

IAMSERV.EXE

CDP.EXE

GUARDDOG.EXE

PERSFW.EXE

LOCKDOWN.EXE

LOCKDOWN2000.EXE

SPHINX.EXE

NPROTECT.EXE

NDD32.EXE

SMC.EXE

NETUTILS.EXE

LDNETMON.EXE

PORTMONITOR.EXE

CONNECTIONMONITOR.EXE

SYMPROXYSVC.EXE

SWEEPSRV.SYS

_AVPM.EXE

AVP.EXE

NAVAPW32.EXE

RTVSCN95.EXE

DEFWATCH.EXE

VPC32.EXE

VPTRAY.EXE

POPROXY.EXE

NAVAPSVC.EXE

ALERTSVC.EXE

NAVLU32.EXE

NAVWNT.EXE

NPSSVC.EXE

LUALL.EXE

SWNETSUP.EXE

ICLOAD95.EXE

ICMON.EXE

ICSUPP95.EXE

ICSUPPNT.EXE

IFACE.EXE

ADVXDWIN.EXE

PADMIN.EXE

NWTOOL16.EXE

NTVDM.EXE

ANTS.EXE

ANTI-TROJAN.EXE

TC.EXE

TCA.EXE

TCM.EXE

MOOLIVE.EXE

MGHTML.EXE

MCMNHDLR.EXE

MCVSRTE.EXE

MCVSSHLD.EXE

MGAVRTCL.EXE

MGAVRTE.EXE

SCAN32.EXE

SCRSCAN.EXE

SYMTRAY.EXE

VSCHED.EXE

MCTOOL.EXE

AVXW.EXE

AVXQUAR.EXE

AMON9X.EXE

AVGW.EXE

WEBTRAP.EXE

PCCWIN98.EXE

POP3TRAP.EXE

TDS-3.EXE

SS3EDIT.EXE

JEDI.EXE

RAV7WIN.EXE

RAV7.EXE

SWEEP95.EXE

MCAGENT.EXE

MCUPDATE.EXE

NTRTSCAN.EXE

PCCWIN97.EXE

PCCNTMON.EXE

PCSCAN.EXE

NUI.EXE

CLAW95.EXE

VET95.EXE

AUTODOWN.EXE

MWATCH.EXE

EFPEADM.EXE

EVPN.EXE

RESCUE.EXE

ACKWIN32.EXE

DVP95.EXE

DVP95_0.EXE

F-AGNT95.EXE

F-PROT95.EXE

EXPERT.EXE

FP-WIN.EXE

VIR-HELP.EXE

F-PROT.EXE

SPYXX.EXE

ATWATCH.EXE

ATUPDATER.EXE

ATCON.EXE

PVIEW95.EXE

WGFE95.EXE

CTRL.EXE

LDPROMENU.EXE

LDSCAN.EXE

GENERICS.EXE

PROCESSMONITOR.EXE

PROGRAMAUDITOR.EXE

TFAK.EXE

LUCOMSERVER.EXE

WIMMUN32.EXE

AUTOTRACE.EXE

NWSERVICE.EXE

NTXCONFIG.EXE

NEOWATCHLOG.EXE

NSCHED32.EXE

WATCHDOG.EXE

ISRV95.EXE

REALMON.EXE

AVWINNT.EXE

AVGSERV9.EXE

AVKPOP.EXE

AVKSERVICE.EXE

AVKWCTL9.EXE

FSAV32.EXE

FAMEH32.EXE

FCH32.EXE

FIH32.EXE

FNRB32.EXE

FSAA.EXE

FSGK32.EXE

FSM32.EXE

FSMA32.EXE

FSMB32.EXE

SBSERV.EXE

GBPOLL.EXE

GBMENU.EXE

AVSCHED32.EXE

DEFSCANGUI.EXE

DEFALERT.EXE

NPSCHECK.EXE

It also searches for processes with a list of strings taken from the above list, minus the ".exe" extension. Any processes which it finds which match, it will also terminate.

This trojan adds itself to the Windows directory as WINLOGON .EXE, and it creates the following registry key to run itself at Windows startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
"W1N32.DLL" = C:\WINDOWS\WINLOGON�.exe

Symptoms

Symptoms -

The security programs which use the filenames listed above will cease to run even when restarted, as long as the trojan is in memory.

McAfee > Theat Center > Virus Detail Page

Navigation

Utility Navigation

Content

ProcKill-AF

Type

SubType

Discovery Date

Length

Minimum DAT

Updated DAT

Minimum Engine

Description Added

Description Modified

Risk Assessment

Tab Navigation

Overview

Characteristics

Symptoms

Method of Infection

Removal

Variants

Variants

All Information

Overview -

Characteristics

Characteristics -

Symptoms

Symptoms -

Method of Infection

Method of Infection -

Removal -

Removal -

Variants

Variants -

Threat Resources

Footer