JavaScript support is required for our site to be fully operational in your browser.
Win32.HLLW.Autoruner1.23598
Added to the Dr.Web virus database:
2012-07-20
Virus description added:
2012-08-10
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Dump.exe' = 'C:\Drivers\Dump.exe'
Creates the following files on removable media:
<Drive name for removable media>:\autorun.inf
Malicious functions:
Executes the following:
<SYSTEM32>\attrib.exe -s -h U:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h T:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h T:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h U:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h W:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h V:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h V:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h Q:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h Q:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h P:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h R:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h S:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h S:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h R:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h W:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h C:\Drivers\Dump.exe
<SYSTEM32>\find.exe /I "naxo" C:\autorun.inf
<SYSTEM32>\attrib.exe +h +s C:\autorun.inf
<SYSTEM32>\attrib.exe +h +s E:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +h +s E:\autorun.inf
<SYSTEM32>\attrib.exe -h -s C:\autorun.inf
<SYSTEM32>\attrib.exe +s +h C:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h Y:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h X:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h X:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h Y:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +h +s C:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h Z:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h Z:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h P:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h F:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h E:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h E:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h F:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h H:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h G:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h G:\Drivers\Dump.exe
<SYSTEM32>\msg.exe * hacked by -={ naxo itc }=-
<SYSTEM32>\attrib.exe +s +h "%TEMP%\tmpfile0.bat"
<SYSTEM32>\cmd.exe /c ""%TEMP%\tmpfile0.bat" "
<SYSTEM32>\reg.exe add hklm\software\microsoft\windows\currentversion\run /V Dump.exe /D C:\Drivers\Dump.exe /f
<SYSTEM32>\attrib.exe +h +s E:\Drivers
<SYSTEM32>\attrib.exe +h +s C:\Drivers
<SYSTEM32>\ping.exe -n 5 127.0.0.1
<SYSTEM32>\attrib.exe +s +h H:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h M:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h M:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h L:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h N:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h O:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h O:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h N:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h J:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h I:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h I:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h J:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h L:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h K:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h K:\Drivers\Dump.exe
Modifies file system :
Creates the following files:
C:\autorun.inf
%TEMP%\tmpfile0.bat
Sets the 'hidden' attribute to the following files:
<Drive name for removable media>:\autorun.inf
C:\autorun.inf
%TEMP%\tmpfile0.bat
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK