Thread: AntiVirus&Firewall process list

I gather some info here and I hope this helpful to someone looking for this. I don't know whether they're all correct or not. Reply if anything isn't on the list, or the process on the list is wrong. Thanks a million.

Outpost Firewall: op_mon.exe acs.exe
Norton Internet Security Suite: ccSvcHst.exe
Kaspersky:avp.exe
ESET ESS: egui.exe,ekrn.exe
ESET NOD32:nod32gui.exe,nod32krn.exe
A-squread free: a2service.exe
AVG:avgam.exe,avgnsx.exe,avgrsx.exe,avgtray.exe,av gwdsvc.exe
AVG internet security suite:
avgam.exe,avgfws8.exe,avgnsx.exe,avgrsx.exe,avgtra y.exe,avgwdsvc.exe
ThreatFire: TFTray.exe,TFService.exe
McAfee: mcshield.exe,mcsysmon.exe,mcagent.exe,mcproxy.exe, mcNASvc.exe,mcmsesvc.exe,msksrver.exe,mpfsrv.exe
AVIRA AntiVir:avgnt.exe avguard.exe sched.exe,avmailc.exe,avwebgrd.exe
Ikarus: guardxservice.exe,guardxkickoff.exe
comodo internet firewall:cfp.exe,cmdagent.exe
Sophos Anti-Virus: SavService.exe,ALMon.exe,ALsvc.exe

I've a idea that don't hard code these process names in the app, let the app load the list from web panel and kill them all. Much easier to update then. (Maybe harder to detect? Because this process names ain't in the export table.)

ashDisp.exe
ashServ.exe

is used by avast 4.8 pro (not sure if the trial/free version uses same names)

also here is some more

http://support.citrix.com/article/CTX107604

Code:

avp.exe
DrUpdate.exe
QQDoctorRtp.exe
KWatch.exe
Uplive.exe
udaterui.exe
McTray.exe
SHSTAT.exe
ccSvcHst.exe
xcommsvr.exe
vsserv.exe
livesrv.exe
bdagent.exe
mcinsupd.exe
mcshell.exe
FrameworkService.exe
vstskmgr.exe
mcagent.exe
mcnasvc.exe
mcmscsvc.exe
mcsysmon.exe
mfevtps.exe
mcupdmgr.exe
vptray.exe
ccapp.exe
rtvscan.exe
defwatch.exe
ccEvtMgr.exe
ccSetMgr.exe
KVSrvXP.exe
KPFW32.exe
engineserver.exe
KavStart.exe
kmailmon.exe
KPfwSvc.exe
KISSvc.exe
MPSVC3.exe
MPSVC.exe
MpfSrv.exe
naPrdMgr.exe
rsnetsvr.exe
mcshield.exe
McProxy.exe
QQDoctor.exe
Rav.exe
ScanFrm.exe
RsTray.exe
RavStub.exe
CCenter.exe
RavTask.exe
RavMonD.exe
RavMon.exe
egui.exe
mfeann.exe
RsAgent.exe
ekrn.exe
antiarp.exe
360tray.exe
360Safebox.exe
safeboxTray.exe

from http://www.bitdefender.com/VIRUS-100...KillAV.PT.html

Code:

    * seccenter.exe
    * uiscan.exe
    * SSU.exe
    * SpySweeperUI.exe
    * SpySweeper.exe
    * WRConsumerService.exe
    * syssvcnt.exe
    * dvpapi.exe
    * THSM.EXE
    * THD32.EXE
    * THAV.EXE
    * GDFwSvc.exe
    * GDFirewallTray.exe
    * AVKWCtl.exe
    * AVKTray.exe
    * AVKService.exe
    * AVKProxy.exe
    * TFService.exe
    * pctsTray.exe
    * pctsSvc.exe
    * pctsAuxs.exe
    * BDTUpdateService.exe
    * sbamui.exe
    * SBAMTray.exe
    * SBAMSvc.exe
    * VMwareUser.exe
    * VMwareTray.exe
    * VMwareService.exe
    * vmacthlp.exe
    * K7TSMngr.exe
    * K7TSecurity.exe
    * K7SysTry.exe
    * K7SysMon.exe
    * K7RTScan.exe
    * K7PSSrvc.exe
    * K7FWSrvc.exe
    * K7EmlPxy.exe
    * vrrepair.exe
    * vrmonsvc.exe
    * vrmonnt.exe
    * vrfwsvc.exe
    * vrfwsock.exe
    * hsvcmod.exe
    * HrRes.exe
    * hpcsvc.exe
    * HFACSvc.exe
    * spiderui.exe
    * spidernt.exe
    * spiderml.exe
    * drwebscd.exe
    * WinSSUI.exe
    * winssnotify.exe
    * winss.exe
    * OcHealthMon.exe
    * msfwsvc.exe
    * CounterSpy.exe
    * SBCSTray.exe
    * SBCSSvc.exe
    * Nsesvc.exe
    * CClaw.exe
    * Nvcoas.exe
    * Nip.exe
    * Zlh.exe
    * nuaa.exe
    * npcsvc32.exe
    * Njeeves.exe
    * nvcsched.exe
    * npfsvc32.exe
    * nvoy.exe
    * Zanda.exe
    * nprosec.exe
    * elogsvc.exe
    * avgas.exe
    * guard.exe
    * AFMain.exe
    * ACASP.exe
    * ACAEGMr.exe
    * MSProxy.ahn
    * ACAAS.exe
    * ACAIS.exe
    * ACALS.exe
    * AhnSD.exe
    * AhnSDsv.exe
    * svcprs32.exe
    * PPCtlPriv.exe
    * mdmcls32.exe
    * cfgmng32.exe
    * ppctlpriv.exe
    * ccprovsp.exe
    * QOELoader.exe
    * capfasem.exe
    * cavrid.exe
    * caavguiscan.exe
    * cappactiveprotection.exe
    * cctray.exe
    * vetmsg.exe
    * ITMRTSVC.exe
    * isafe.exe
    * UmxAgent.exe
    * UmxPol.exe
    * UmxFwHlp.exe
    * UmxCfg.exe
    * CAGlobalLight.exe
    * CAGlobal.exe
    * FProtTray.exe
    * FPAVServer.exe
    * UfUpdUi.exe
    * TSCFPlatformCOMSvr
    * UfSeAgnt.exe
    * TmProxy.exe
    * TmPfw.exe
    * TMBMSRV.exe
    * SfCtlCom.exe
    * ALsvc.exe
    * SAVAdminService.exe
    * SavService.exe
    * ALMon.exe
    * avp.exe
    * egui.exe
    * ekrn.exe
    * livesrv.exe
    * bdagent.exe
    * vsserv.exe
    * xcommsvr.exe
    * avgcc.exe
    * avgamsvr.exe
    * avgupsvc.exe
    * avgemc.exe
    * avgnsx.exe
    * avgrsx.exe
    * avgam.exe
    * avgtray.exe
    * avgfws8.exe
    * avgwdsvc.exe
    * fsav32.exe
    * fsus.exe
    * fsdfwd.exe
    * fsqh.exe
    * fsaua.exe
    * FAMEH32.exe
    * FCH32.EXE
    * FSMB32.exe
    * fsavgui.exe
    * fsguidll.exe
    * FSM32.EXE
    * fssm32.exe
    * FSMA32.EXE
    * fsgk32st.exe
    * AluSchedulerSvc.exe
    * ccSvcHst.exe
    * mcvsshld.exe
    * mcvsmap.exe
    * mcsysmon.exe
    * McSACore.exe
    * mcagent.exe
    * msksrver.exe
    * MpfSrv.exe
    * Mcshield.exe
    * McProxy.exe
    * McNASvc.exe
    * mcmscsvc.exe
    * mcupdmgr.exe
    * vbsystry.exe
    * vbcmserv.exe
    * psksvc.exe
    * PavBckPT.exe
    * IFace.exe
    * ApVxdWin.exe
    * WEBPROXY.EXE
    * APVXDWIN.EXE
    * PslmSvc.exe
    * PSHost.exe
    * PavPrSrv.exe
    * PavFnSvr.exe
    * PsCtrlS.exe
    * TPSrv.exe
    * AVENGINE.EXE
    * PAVSRV51.EXE
    * escanmon.exe
    * TRAYICOS.EXE
    * CONSCTL.EXE
    * TRAYSSER.EXE
    * avpmapp.exe
    * MWAGENT.EXE
    * MWASER.EXE
    * vba32ldr.exe
    * EMLPROUI.EXE
    * qhfw.exe
    * QUHLPSVC.EXE
    * ONLINENT.EXE
    * SCANMSG.EXE
    * UPSCHD.EXE
    * EMLPROXY.EXE
    * SCANWSCS.EXE
    * ONLNSVC.EXE
    * PXConsole.exe
    * PXAgent.exe
    * guardxkickoff.exe
    * guardxup.exe
    * guardxservice.exe
    * ashDisp.exe
    * ashWebSv.exe
    * ashMaiSv.exe
    * ashServ.exe
    * aswUpdSv.exe
    * RavMon.exe
    * RavTask.exe
    * RavStub.exe
    * RavMonD.exe
    * CCenter.exe
    * mantispm.exe
    * zlclient.exe
    * Monitor.exe
    * vsmon.exe
    * avwebgrd.exe
    * avmailc.exe
    * avgwsvc.exe
    * avesvc.exe
    * avgnt.exe
    * sched.exe
    * avguard.exe

from http://vil.nai.com/vil/content/v_153540.htm

More samples in:
http://threatinfo.trendmicro.com/vin...KILLAV&Sect=SA

Security isn't a dirty word... Crevise is a dirty word... Now job thats another dirty word... for those who live the monthly tugboat anyway. Back to reality, I might get a friend to look at this...
hmmm a sounds like a virus from scratch to find antivirus and delete executables from particular path(maybe it won't have to be a specific path)... but thats just my thoughts see how im feelin later may look into more. Thanks for insight