Analysis of new AV terminator anti-virus software technical mechanism

Recent interception of the latest AV terminator, the variant using RING3 hook technology directly remove antivirus software, hijacked a number of web sites to prevent anti-virus software updates. Special kill procedure tense production, test pass will be released in time, the old version of AV Terminator kill after running automatically upgrade.

The following is a detailed analysis of the report:

Virus Name: win32.troj.avkiller.hd.212992

Viruses use Wh_callwndproc type hooks to inject themselves into other processes

**释放文件**
C:\WINDOWS\system32\nfxphzn.jbt 该文件为kernel32.dll的拷贝
c:\WINDOWS\system32\yqia.btl 该文件为病毒自身的拷贝
**下载文件**
w3.hao5555.com/v3/pic.bmp
w3.hao5555.com/v3/Riched32.dll
w3.hao5555.com/v3/search.asp
w3.hao5555.com/bd.dll
**修改的注册表**
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"xphz"="{1b5f93d7-93d7-0a4e-4e82-93d71b5f93d7}"
[HKEY_CLASSES_ROOT\CLSID\{1b5f93d7-93d7-0a4e-4e82-93d71b5f93d7}\InprocServer32]
@="C:\\WINDOWS\\system32\\yqia.btl""ThreadingModel"="Apartment"
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System]
"DisableCMD"=dword:00000001
**挂接函数**
RegEnumValueA
RegEnumValueW -- 目的为隐藏病毒添加的注册表键值
CreateFileA
CreateFileW -- 目的为保护病毒释放的文件
**卸载组件**
regsvr32.exe /u /s wshom.ocx

The virus itself calls the Createfilea and Createfilew functions through NFXPHZN.JBT, and after the virus injects the other processes in the system,

(1) Create a thread to protect its added registry key values from being deleted;

(2) End the anti-virus software process;

(3) Damage is done by filling the first two bytes of the zwcreatefile with 0;

(4) and attempts to delete the following files (mainly anti-virus software and rogue Software Removal Tool driver, program files)

　　　"mmskskin.dll"
"KKClean.dll"
"VirUnk.def"
"AntiActi.dll"
"Rsaupd.exe"
"Iereset.dll"
"Libclsid.dat"
"KNetWch.SYS"
"CleanHis.dll"
"WoptiClean.sys"
"kakalib.def"
"libdll.dat"
"kkinst.ini"
"KASearch.DLL"
"KAVBootC.sys"
"Ras.exe"
"iehelp.exe"
"trojandetector.exe"
"KAConfig.DLL"
"KAVPassp.DLL"
"hsfw.dll"