Discovered: May 07, 2004
Updated: May 07, 2004 6:38:44 PM
Systems Affected: Windows

W32.Axon is a virus that prepends itself to files with the .exe extension on drives C through Z. It also deletes files with .mp3 or .avi extensions.

Discovered: May 07, 2004
Updated: May 07, 2004 6:38:44 PM
Systems Affected: Windows

When a file infected with W32.Axon is executed, the virus does the following:

Searches drives C through Z for files with the .exe extension. For each file that it finds, it does the following:
- creates a temporary copy of itself as %Temp%\Xona.tmp
- appends the host file to Xona.tmp
- replaces the host file with with the infected Xona.tmp file

The virus deletes any .mp3 and .avi files that it finds.

When the infection routine is complete, the virus displays a message box with the following text:

You have been infected by the virus Xona !

Infected EXE = [umber of infected files]
Deleted AVI = [number of deleted files]
Deleted MP3 = [number of deleted files]

I FUCK THE RIAA !

This virus has been distributed on peer-to-peer file-sharing networks as "Keygen.exe".