HackTool.Win64.KillAV.B

它以文件的形式出现在系统中，可能是其他恶意软件投放的，或者是用户在访问恶意网站时无意中下载的。

新病毒详细信息

它以文件的形式出现在系统中，可能是其他恶意软件投放的，或者是用户在访问恶意网站时无意中下载的。

其他系统修改

它修改下列注册表项：

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender
DisableAntiSpyWare = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
StartupApproved\Run
Security Health = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender
DisableAntiSpyware = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinDefend
DisableAntiSpyware = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender\Real-Time Protection
DisableRealtimeMonitoring = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender
TamperProtection = 1

(Note: The default value data of the said registry entry is 0.)

进程终止

它终止在受感染的系统上运行的下列服务：

• WinDefend

它终止在受感染的系统内存中运行的下列进程：

• smartscreen.exe

其他详细信息

该程序执行以下操作：

• It checks the local system account to see if it has the following security identifier (SID):
  • S-1-5-18
• It requires being executed with Administrative privileges to proceed with its routine.
• It disables the following features of Windows Defender:
  • DisableAntiSpyware
  • DisableAntiVirus
  • DisableArchiveScanning
  • DisableBehaviorMonitoring
  • DisableBlockAtFirstSeen
  • DisableIOAVProtection
  • DisableIntrusionPreventionSystem
  • DisablePrivacyMode
  • DisableRealtimeMonitoring
  • DisableScriptScanning