FANDOM


Trojan.Win32.KillAV.an or KillAV.an is a malicious PE .exe file. The length listed above is when it is packed with UPX, unpacked it comes to 32 KB.

PayloadEdit

When run, the trojan will copy itself three times under the following names:

%System%\NavbwvLw32.Exe
%System%\Winscrl0n3.Scr
%System%\LwBWV60.dll

It also adds a registry key to ensure it always starts on bootup.

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"(Default)" = "%System%\NavbwvLw32.Exe"

PayloadEdit

When launched, the trojan will search for the following antivirus products and if any one of these is found it will terminate found antivirus and delete itself.

Norton AntiVirus
VirusScan
eSafe Desktop Watch
eTrust EZ AntiVirus
Panda AntiVirus Titanium
PC-Cillin 2002
PC-Cillin 2003
F-Secure Anti-Virus
Sophos AntiVirus
ZoneAlarm
ZoneAlarm Pro
Tiny Personal Firewall
McAfee Firewall
Norton Personal FireWall

RemovalEdit

1. Delete all copies of the trojan, both the original, and the three copies in the Behavior section.

2. Delete the following key

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]

"(Default)" = "%System%\NavbwvLw32.Exe"

3. Scan with any trusted antivirus program.

SourcesEdit

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.