Trojan:WinNT/Killav.G

Trojan:WinNT/Killav.G is a malicious system driver that acts as a malicious component for PWS:Win32/OnLineGames variants, such as PWS:Win32/OnLineGames.LH and PWS:Win32/OnLineGames.LY.

Installation

Trojan:WinNT/Killav.G is usually in your computer with the file name "<system folder>\drivers\ahnurl.sys".

Note: <system folder> refers to a variable location that is determined by the malware by querying the operating system. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.

Trojan:WinNT/Killav.G is registered as a system service by creating the following registry entry:

In subkey: HKLM\SYSTEM\CurrentControlSet\Services\ahnurl
Sets value: "Type"
With data: "dword:00000001"
Sets value: "Start"
With data: "dword:00000002"
Sets value: "ErrorControl"
With data: "dword:00000001"
Sets value: "ImagePath"
With data: "<system folder>\drivers\ahnurl.sys"
Sets value: "DisplayName"
With data: "ahnurl"

Payload

Lowers computer security

Trojan:WinNT/Killav.G can delete or terminate the following security-related processes and files:

• alyac.aye
• ashupd.exe
• avastsvc.exe
• avastui.exe
• avp.exe
• avsx.exe
• ayagent.aye
• ayagent.exe
• ayrtsrv.aye
• ayrtsrv.exe
• ayservicent.aye
• ayupdate.aye
• ayupdsrv.aye
• ayupdsrv.exe
• mupdate2.exe
• naveragent.exe
• nsavsvc.exe
• nsavsvc.npc
• nsvmon.exe
• nsvmon.npc
• nvcagent.exe
• nvcagent.npc
• nvcupgrader.exe
• nvcupgrader.npc
• ole32.dll
• systemroot
• v3light.exe
• v3lrun.exe
• v3lsvc.exe
• v3lsvc/exe
• v3ltray.exe
• v3medic.exe

Other information

As a part of its stealth routine, Trojan:WinNT/Killav.G may hook the following APIs:

• NtMapViewOfSection
• ZwEnumerateKey
• ZwEnumerateValueKey
• ZwMapViewOfSection
• ZwQueryDirectoryFile

Analysis by Ric Robielos