BAT/KillAV.1B54!tr

Analysis

BAT/KillAV.1B54!tr is a detection for a BAT trojan. Below are some of its observed characteristics/behaviours:

• This Trojan intends to:
  
  • issue task kill various AV / audit / security related processes
  • issue net stop various AV / audit / security /MSSQL related processes
  • issue sc config disable AV / audit / security /MSSQL related services
  • issue another net stop for various system tools / VM related / network monitor related
  • issue wmic uninstall for for various AV Related products

Recommended Action

• Make sure that your FortiGate/FortiClient system is using the latest AV database.
• Quarantine/delete files that are detected and replace infected files with clean backup copies.