About “Trojan:Win32/Killav!atmn” infection

The Trojan:Win32/Killav!atmn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Killav!atmn virus can do?

• Attempts to connect to a dead IP:Port (1 unique times)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Enumerates running processes
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• Drops a binary and executes it
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Attempts to stop active services
• Created a process from a suspicious location
• Installs itself for autorun at Windows startup
• Creates a copy of itself
• Attempts to disable UAC
• Attempts to modify UAC prompt behavior

How to determine Trojan:Win32/Killav!atmn?

File Info:
name: CA2E311292EAA3804437.mlw
path: /opt/CAPEv2/storage/binaries/fbd2a082539ee11f23094515c010a89b6d54e6a8481cec49b57c6d9388ecf7f0
crc32: 048BDCCE
md5: ca2e311292eaa3804437ac2af91afc9f
sha1: ab8eed5bb260ec4480612d99e358d60337c5bd94
sha256: fbd2a082539ee11f23094515c010a89b6d54e6a8481cec49b57c6d9388ecf7f0
sha512: 909903c5b8269dbc9f98dbe8eb84dcea6d28ce09af8e95ef9264fc10dc1bc501087cfbd7f0fcd27084df175fcc2dec9340a2c771798390d858f199270f182792
ssdeep: 6144:3mXqNhOPOUFLccF/nHkcPLRFB/fhLeiNruEnOldMrhJ11PUM1nF1WUfTHfTpn:3maNhOPnxBnHkapLjTn/rhlUy1W0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F8B4F214BA638CB6CB131EFC908F49D9576FEDE311C700275FB2CEC599602A5602ED6A
sha3_384: 9c8fc7a823bfd8f2bbf38f68070933e092de9725ac266473112d0fc511a232a0053829201e2e414080cb6f84c57832ea
ep_bytes: 6a606838714000e87e0d0000bf940000
timestamp: 2008-12-28 04:22:46

Version Info:
0: [No Data]

Trojan:Win32/Killav!atmn also known as:

How to remove Trojan:Win32/Killav!atmn?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.