A deeper look into the killav.rb script

Continuing from our previous recipe, we focused on how to kill running antivirus processes on the target machine using the killav.rb script. But, what if the processes are still running or they were not killed even after using the script? There can be two reasons for it. Either the killav.rb doesn't include those processes in its list to kill or the antivirus process is running as a service. In this recipe, we will try to overcome the problems. So let's quickly move on to our recipe.

Getting ready

We will start with the same meterpreter session where we ended our previous recipe. We have used the killav.rb script once, but still the antivirus processes are running. We can view the running processes by using the ps command.

PID     Name                   User                  Path
 ---     ----                   ----                  ----
   
 1060 svchost.exe    NT AUTHORITY\SYSTEM    C:\Windows\System32\.

 1096 svchost.exe    NT AUTHORITY\SYSTEM  ...