Para el funcionamiento correcto del sitio web, debe activar el soporte de JavaScript en su navegador.
Win32.HLLW.Autoruner1.20771
Added to the Dr.Web virus database:
2012-07-19
Virus description added:
2012-08-09
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Dump.exe' = 'C:\Drivers\Dump.exe'
Creates the following files on removable media:
<Drive name for removable media>:\autorun.inf
Malicious functions:
Creates and executes the following:
%TEMP%\1.tmp <Current directory>
Executes the following:
<SYSTEM32>\attrib.exe -s -h C:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +h +s E:\Drivers\Dump.exe
<SYSTEM32>\find.exe /I "naxo" C:\autorun.inf
<SYSTEM32>\attrib.exe +h +s C:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +h +s C:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" E:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" F:\autorun.inf
<SYSTEM32>\attrib.exe +h +s E:\autorun.inf
<SYSTEM32>\attrib.exe +s +h C:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -h -s C:\autorun.inf
<SYSTEM32>\attrib.exe +s +h W:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h X:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h W:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h V:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h V:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h Z:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h Z:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h Y:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h X:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h Y:\Drivers\Dump.exe
<SYSTEM32>\find.exe /I "naxo" T:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" U:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" S:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" Q:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" R:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" Y:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" Z:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" X:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" V:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" W:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" J:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" K:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" I:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" G:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" H:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" O:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" P:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" N:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" L:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" M:\autorun.inf
<SYSTEM32>\attrib.exe +s +h U:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h H:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h H:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h G:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h F:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h G:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h J:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h K:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h J:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h I:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h I:\Drivers\Dump.exe
<SYSTEM32>\reg.exe add hklm\software\microsoft\windows\currentversion\run /V Dump.exe /D C:\Drivers\Dump.exe /f
<SYSTEM32>\ping.exe -n 5 127.0.0.1
<SYSTEM32>\msg.exe * hacked by -={ naxo itc }=-
<SYSTEM32>\cmd.exe /c ""%TEMP%\tmpfile0.bat" "
<SYSTEM32>\attrib.exe +s +h "%TEMP%\tmpfile0.bat"
<SYSTEM32>\attrib.exe +s +h E:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h F:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h E:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +h +s C:\Drivers
<SYSTEM32>\attrib.exe +h +s E:\Drivers
<SYSTEM32>\attrib.exe -s -h R:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h R:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h Q:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h P:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h Q:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h T:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h U:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h T:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h S:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h S:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h M:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h M:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h L:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h K:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h L:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h O:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h P:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h O:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h N:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h N:\Drivers\Dump.exe
Modifies file system :
Creates the following files:
C:\autorun.inf
%TEMP%\tmpfile0.bat
%TEMP%\1.tmp
Sets the 'hidden' attribute to the following files:
<Drive name for removable media>:\autorun.inf
C:\autorun.inf
%TEMP%\tmpfile0.bat
Descargue Dr.Web para Android
Gratis por 3 meses
Todos los componentes de protección
Renovación de la demo a través de AppGallery/Google Pay
Si Vd. continúa usando este sitio web, esto significa que Vd. acepta el uso de archivos Cookie y otras tecnologías para que recabemos las estadísticas sobre los visitantes. Más información
OK