Trojan.KillAV
Trojan.KillAV is a Trojan horse that can reduce security settings on infected computer by ending or removing antivirus applications. The Trojan may also steal sensitive information from the compromised PC.
Alias: PWS:Win32/Stealth.D, Trojan.PSW.Stealth, PWS-AC, TROJ_PSW.STEAL, Troj/PWS-AC, TR/Stealth.D1.PSW
Damage Level: Medium
Systems Affected: Windows 9x, 2000, XP, Windows Vista
Characteristics
When Trojan.KillAV is running on the compromised computer, it monitors all running processes and ends those that it identifies as antivirus programs. The Trojan also alters system registry and creates an entry to run itself every time Windows starts. It may also locate and terminate other programs and utilities that are typically utilized for virus analysis.
The Trojan is also dubbed as a password stealer. When executed, it can drop a copy of itself under Windows directory and activates with an entry on Windows registry. The process of Trojan.KillAV is not visible on Task Manager because it is capable of concealing itself to avoid detection. It can gather locally stored user name and passwords and usually send the collected information via email communication.
Distribution
Trojan.KillAV spreads through a number of methods. Typically, it is dropped on target computer via another threat. Email is another avenue to propagate this Trojan and usually arrives as an attached compressed file to a spam email messages.
How to Remove Trojan.KillAV
1. Temporarily Disable System Restore (Windows Me/XP). [how to]
2. To be able to identify even the most recent variant of Trojan.KillAV, open your antivirus application and update the virus definition file.
3. Start Windows in Safe Mode with Networking.
- From a power-off state, turn on the computer and press F8 on your keyboard repeatedly.
- Your computer will display Windows Advanced Boot Options menu. Please select Safe Mode with Networking.
- The system will now boot Windows and loads only necessary drivers and files.
4. Open your antivirus program and run a full system scan. After the scan, delete all infected items. If unable to delete, better place them in quarantine. Once the scan is complete, please proceed with the next step.
Scan with Norton Power Eraser:
Additional virus removal tool like Norton Power Eraser provides deep scanning technology to eliminate other threats not detected by a normal virus scan. Use this tool with extra caution.
5. Go to Norton Power Eraser web page and download the tool.
6. Once the download completes, double click on the file NPE.exe to run the program.
7. It will prompt for End User License Agreement, click on Accept to continue.
8. On NPE main window, click on Scan. Then select Exclude Rootkit Scan. Click on Continue to proceed.
9. Virus scanning may take some time. After running the scan, NPE will display the scan result.
Important! If there are any detected threats under Suspicious, remove the check mark. Only threats in Detected category are necessary to remove at this point. Make sure that you mark the Create System Restore Point before proceeding with the fix.
10. Now click on Fix to start removing the threats including Trojan.KillAV remnants if there are any.
11. When done, Norton Power Eraser will restart the computer. Then after a reboot, it will initialize and display the eliminated threats.
12. You may now close Norton Power Eraser.
precisesecurity
May 24, 2008 @ 01:38:02
1. Temporarily Disable System Restore (Windows Me/XP/Vista/7) . [how to]
2. Update the virus definitions.
3. Reboot Windows in Safe Mode. [how to]
4. Run a full system scan and clean/delete all infected file(s)
5. Delete/Modify any values added to the registry. [how to edit registry]
Navigate to and delete any value that refers to a file that was detected as Trojan.KillAV:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
6. Exit registry editor and restart Windows.
7. In order to make sure that threat is completely eliminated, carry out a full scan of your system using AntiVirus and Antispyware Software. Another way to delete the virus using various Antivirus Program without the need to install can be done with Online Virus Scanner.