Trojan:Win32/KillProc.A

Trojan:Win32/KillProc.A is a trojan that opens a named pipe to communicate with other malware and attempts to terminate the Windows shell "explorer.exe" process.

This trojan may be installed by Trojan:Win32/FakePlus or other malware. When the trojan runs, it creates the following mutex to ensure only one instance of the malware executes:

 

461d0ddd-244f-4676-9aef-3bb792d49c19

 

Win32/KillPorc.A enumerates key values within the registry subkey HKLM\Software and searches for the string "pc*reg" using wildcards, where "*" can be any literal string. If the string is found, the trojan creates the following named pipe to allow communication with other malware:

 

 

If the trojan was unsuccessful in locating the string mentioned above, it then attempts to locate the following file and path and registry subkey "HKLM\Software\AntiSpyware Pro":

 

 

If both are found, the trojan creates the named pipe mentioned above to communicate with other malware. Data transfer could contain sensitive information such as logon credentials or other user information.

 

Trojan:Win32/KillProc.A attempts to terminate the Windows shell "Explorer.exe" process possibly resulting in data loss with open applications or an unusable Windows environment.