Malware

How to remove “BV:KillFiles-AO [Trj]”?

Malware Removal

The BV:KillFiles-AO [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What BV:KillFiles-AO [Trj] virus can do?

  • Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Uses Windows utilities for basic functionality
  • Uses Windows utilities for basic functionality
  • Deletes executed files from disk

How to determine BV:KillFiles-AO [Trj]?


File Info:

name: C3649B90B2B3B4501F05.mlw
path: /opt/CAPEv2/storage/binaries/7c21d569df9288a5cc12b2cb87a8d21aee4f5a57da520e41af007683cf885523
crc32: BE9978BD
md5: c3649b90b2b3b4501f0550050ba9eb5f
sha1: 75a140b7b456024f6f12966d3e3299d6a751b080
sha256: 7c21d569df9288a5cc12b2cb87a8d21aee4f5a57da520e41af007683cf885523
sha512: b9544cd1f4d3e0adc219d6f6e209b7ac880752504bb403f57deec51c2e0ca886eb5584bd3bea32bbabcd39c07307ab27340b3dac66ed0624b877a84e9560b354
ssdeep: 3072:mq6+ouCpk2mpcWJ0r+QNTBfyJ2FLbN+CPZ4w3+:mldk1cWQRNTBaJ2FXN+CPZ4++
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C0246D0376848CE7D8B113F90056E2BE972327986724D6D793F97C63F5D26820D7A2E8
sha3_384: aadaeeed5bc5b1114e8aa5f84bc3ce2d0c973595340a6c590935ee6e2982163db24e8c8adbc0b925694787db41b89376
ep_bytes: 68ac00000068000000006810804100e8
timestamp: 2019-07-30 08:52:50

Version Info:

0: [No Data]

BV:KillFiles-AO [Trj] also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.Tiny.trFe
Elasticmalicious (high confidence)
CAT-QuickHealPUA.RiskwarePMF.S7343609
CylanceUnsafe
SangforTrojan.Win32.Save.a
AlibabaTrojan:BAT/Assoc.1d7e6d7e
Cybereasonmalicious.7b4560
VirITTrojan.Win32.Genus.IHW
CyrenW32/Trojan.VFBA-8001
SymantecML.Attribute.HighConfidence
APEXMalicious
Paloaltogeneric.ml
CynetMalicious (score: 100)
KasperskyHEUR:Trojan.BAT.Assoc.gen
AvastBV:KillFiles-AO [Trj]
ZillyaTool.Lazagne.Win32.102
McAfee-GW-EditionBehavesLike.Win32.Generic.dm
FireEyeGeneric.mg.c3649b90b2b3b450
SophosGeneric ML PUA (PUA)
SentinelOneStatic AI – Malicious PE
AviraBAT/Agent.xywwi
Antiy-AVLTrojan/Generic.ASMalwS.50F5
MicrosoftTrojan:Win32/Wacatac.B!ml
GoogleDetected
AhnLab-V3Trojan/Win32.VB.C2364399
McAfeeArtemis!C3649B90B2B3
MalwarebytesMalware.AI.392946571
RisingTrojan.Generic@AI.99 (RDML:PoCGXoZsy/Niwt9xVkUkng)
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/PossibleThreat
AVGBV:KillFiles-AO [Trj]
CrowdStrikewin/malicious_confidence_60% (W)

How to remove BV:KillFiles-AO [Trj]?

BV:KillFiles-AO [Trj] removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment