Is the file ATNXWA7.EXE located on your computer? Then your computer is infected.
We do suggest you should remove ATNXWA7.EXE from your computer as soon as possible.
ATNXWA7.EXE is Trojan/Backdoor.
Kill the process ATNXWA7.EXE and remove ATNXWA7.EXE from the Windows startup.
Malware Analysis of ATNXWA7.EXE
Full path on a computer: C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5681477\atnxwa7.exe
Detected by UnHackMe:
Item Name: shell
Author: Unknown
Related File: explorer.exe,C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5681477\atnxwa7.exe
Type: User Shell
Item Name: taskman
Author: Unknown
Related File: C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5681477\ATNXWA7.EXE
Type: Winlogon System
Item Name: antaw4r7
Author:
Current Setting: C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5681477\ATNXWA7.EXE
Type: Registry Run
ATNXWA7.EXE
Default location: C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5681477\atnxwa7.exe
Removal Results: Success
Number of reboot: 1
ATNXWA7.EXE is known as:
Trojan.Lethic.B, Trojan.Agent.Gen-Undef, W32.Trojan.WLUI-7811, Win32.Lethic.THCJaN, BScope.Backdoor.IRCBot.2122, Trojan.Ircbrute, W32.Injector.AEJX.tr
ATNXWA7.EXE hash:
- MD5: 4d9736eb1bcf1164e402bb9d7a51e109
Registry:- HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman: “C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5681477\atnxwa7.exe”
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\antaw4r7: “C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5681477\atnxwa7.exe”
- HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell: “explorer.exe,C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5681477\atnxwa7.exe”
Folders:- C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5681477
Files:- C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5681477\atnxwa7.exe
- C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5681477\Desktop.ini