value:  Carberp has attempted to disable security software by creating a suspended process for the security software and injecting code to delete antivirus core files when the process is resumed. 
name: Impair Defenses: Disable Or Modify Tools