W32/Autorun-BZM

Category: Viruses and Spyware Protection available since:05 Dec 2012 16:54:06 (GMT)
Type: Win32 worm Last Updated:05 Dec 2012 16:54:06 (GMT)
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

Examples of W32/Autorun-BZM include:

Example 1

File Information

Size
264K
SHA-1
634cd533e212728f231c2dc20459d3b4dc5cc964
MD5
eeee73f475465318d96c6a898b803c4f
CRC-32
f8393591
File type
Windows executable
First seen
2012-12-05

Example 2

File Information

Size
264K
SHA-1
7d33de1db17075ad1c7f75cb8c543965ed0bb616
MD5
4ec7bb49eca97aec9b0dab2bac2b0d40
CRC-32
4843d074
File type
Windows executable
First seen
2012-12-05

Runtime Analysis

Copies Itself To
  • F:/Secret.exe
  • F:/hiaiv.exe
  • c:\Documents and Settings\test user\hiaiv.exe
Dropped Files
  • F:/Porn.exe
    Size
    264K
    SHA-1
    634cd533e212728f231c2dc20459d3b4dc5cc964
    MD5
    eeee73f475465318d96c6a898b803c4f
    CRC-32
    f8393591
    File type
    Windows executable
    First seen
    2012-12-05
  • F:/Sexy.exe
    Size
    264K
    SHA-1
    b321c2861a0d830f55aaf7a16fd570600df96faa
    MD5
    6c7dcfe9d2d8a5957fed39af451dae8b
    CRC-32
    fddfde70
    File type
    Windows executable
    First seen
    2012-12-05
  • F:/Passwords.exe
    Size
    264K
    SHA-1
    d8b0006e9fb5eb86b435ce6275a283243a48d7c1
    MD5
    67cee87ec4085fad8610d42410bcd00c
    CRC-32
    fd2e54d3
    File type
    Windows executable
    First seen
    2012-12-05
Registry Keys Created
  • HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    NoAutoUpdate
    0x00000001
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    hiaiv
    c:\Documents and Settings\test user\hiaiv.exe /f
Registry Keys Modified
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
    ShowSuperHidden
    0x00000000
Processes Created
  • c:\Documents and Settings\test user\hiaiv.exe

Example 3

File Information

Size
264K
SHA-1
b321c2861a0d830f55aaf7a16fd570600df96faa
MD5
6c7dcfe9d2d8a5957fed39af451dae8b
CRC-32
fddfde70
File type
Windows executable
First seen
2012-12-05

download Try Sophos products for free
Download now