Skip to main content

Virus.Win32.Duel_aeca0892c9


Susp_Dropper (Kaspersky), DeepScan:Generic.Malware.SIM!g.8520EE52 (B) (Emsisoft), DeepScan:Generic.Malware.SIM!g.8520EE52 (AdAware), Virus.Win32.Duel.FD, GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)Behaviour: Worm, EmailWorm, Virus, IRCBot

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: aeca0892c957918c67badd9925980c46

SHA1: 5582bd3be9a680a5d84f3269627e9b67586de1cd

SHA256: f31bc658dccbaaee66c5cb580aa1aebd152bafa22ff8eb71a6527e428ac88a3b

SSDeep: 384:KxHvgrNYDuxzToVHJd3Y2SB4AcvRZh/eyqJ6mbQutz3EdAocgEEculjaO33Bdk:KxH44o/oVowAcvRZ560utz35ocnMh2

Size: 44544 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 1980-11-21 13:41:12

Analyzed on: WindowsXP SP3 32-bit

Summary: Virus. A program that recursively replicates a possibly evolved copy of itself.

Dynamic Analysis

Payload

Behaviour Description
EmailWormWorm can send e-mails.
IRCBotA bot can communicate with command and control servers via IRC channel.


Process activity

The Virus creates the following process(es):

%original file name%.exe:1036
rzqyjaaar.iza:1284
rzqyjaaar.iza:1648

The Virus injects its code into the following process(es):No processes have been created.

File activity

The process %original file name%.exe:1036 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Program Files%\MSN Gaming Zone\Windows\iazzzarib.yqa (44 bytes)
%Program Files%\NetMeeting\bijrazyiy.aibiazzzarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\byjayayar.abr (44 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\rrrziiirr.qyr (44 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\yqyajqiaq.jjr (44 bytes)
C:\totalcmd\byjayayar.abr (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rrrziiirr.qyr (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aaibbb.jray.jiq (44 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\zbzbyqqjb.yjz (44 bytes)
%WinDir%\ime\imkr6_1\rrrziiirr.qyr (44 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\rrrziiirr.qyr (44 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\rzqyjaaar.iza (44 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\rzqyjaaar.iza (44 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\zbzbyqqjb.yjz (44 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\byjayayar.abr (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\yqyajqiaq.jjr (44 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\abrrararq.qjy (44 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\iazzzarib.yqa (44 bytes)
%WinDir%\Network Diagnostic\zbzbyqqjb.yjz (44 bytes)
%Program Files%\Outlook Express\rrrziiirr.qyrarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\zbzbyqqjb.yjz (44 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\rrrziiirr.qyr (44 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\byjayayar.abr (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\rrrziiirr.qyr (44 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\iazzzarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\rzqyjaaar.iza (44 bytes)
%Program Files%\NetMeeting\yqyajqiaq.jjriazzzarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\rrrziiirr.qyr (44 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\rzqyjaaar.iza (44 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\abrrararq.qjy (44 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\abrrararq.qjy (44 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\abrrararq.qjy (44 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\byjayayar.abr (44 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\iazzzarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\zbzbyqqjb.yjz (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\yqyajqiaq.jjr (44 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\bijrazyiy.aib (44 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\bijrazyiy.aib (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\iazzzarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\yqyajqiaq.jjr (44 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\iazzzarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\rrrziiirr.qyr (44 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\bijrazyiy.aib (44 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\rzqyjaaar.iza (44 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\rzqyjaaar.iza (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\bijrazyiy.aib (44 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\abrrararq.qjy (44 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\bijrazyiy.aib (44 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\rrrziiirr.qyr (44 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\iazzzarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\yqyajqiaq.jjr (44 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\rrrziiirr.qyr (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\yqyajqiaq.jjr (44 bytes)
%Program Files%\Outlook Express\byjayayar.abrarib.yqa (44 bytes)
%WinDir%\ime\imjp8_1\abrrararq.qjy (44 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\bijrazyiy.aib (44 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\iazzzarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\byjayayar.abr (44 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\byjayayar.abr (44 bytes)
%Program Files%\WinPcap\byjayayar.abrzbyqqjb.yjz.qyra (44 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\yqyajqiaq.jjr (44 bytes)
%WinDir%\pchealth\helpctr\binaries\rzqyjaaar.iza (44 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\bijrazyiy.aib (44 bytes)
%WinDir%\ime\imjp8_1\iazzzarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\iazzzarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\rrrziiirr.qyr (44 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\zbzbyqqjb.yjz (44 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\yqyajqiaq.jjr (44 bytes)
%Program Files%\Common Files\Adobe\Updater6\zbzbyqqjb.yjz (44 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\byjayayar.abr (44 bytes)
%Program Files%\Windows NT\Pinball\zbzbyqqjb.yjz.qyra (44 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\rrrziiirr.qyr (44 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\rzqyjaaar.iza (44 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\yqyajqiaq.jjr (44 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\zbzbyqqjb.yjz (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\byjayayar.abrr (44 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\rrrziiirr.qyr (44 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\zbzbyqqjb.yjz (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byjayayar.abr (44 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\zbzbyqqjb.yjz (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abrrararq.qjy (44 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\bijrazyiy.aib (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\abrrararq.qjy (44 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\bijrazyiy.aib (44 bytes)
C:\totalcmd\rrrziiirr.qyr (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\rzqyjaaar.iza (44 bytes)
%WinDir%\$hf_mig$\KB898461\iazzzarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\byjayayar.abr (44 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\yqyajqiaq.jjr (44 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\rzqyjaaar.iza (44 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\abrrararq.qjy (44 bytes)
%WinDir%\$hf_mig$\KB898461\update\bijrazyiy.aib.qyra (44 bytes)
%WinDir%\ime\imjp8_1\zbzbyqqjb.yjz (44 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\zbzbyqqjb.yjz (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\bijrazyiy.aib (44 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\abrrararq.qjy (44 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\iazzzarib.yqaiy.aibarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\abrrararq.qjy (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rrrziiirr.qyr (44 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\abrrararq.qjy (44 bytes)
%WinDir%\inf\zbzbyqqjb.yjz (44 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\bijrazyiy.aib (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\zbzbyqqjb.yjzr (44 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\zbzbyqqjb.yjz (44 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\bijrazyiy.aib (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yqyajqiaq.jjr (44 bytes)
%Program Files%\Windows Media Player\rzqyjaaar.iza (44 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\yqyajqiaq.jjr (44 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\bijrazyiy.aib (44 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\abrrararq.qjy (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza (44 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\yqyajqiaq.jjr (44 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\rrrziiirr.qyr (44 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\rzqyjaaar.iza (44 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\rrrziiirr.qyr (44 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\yqyajqiaq.jjr (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\zbzbyqqjb.yjz (44 bytes)
%Program Files%\Windows Media Player\bijrazyiy.aibyqa (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\iazzzarib.yqa (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\abrrararq.qjyr (44 bytes)
%WinDir%\byjayayar.abr (44 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\iazzzarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\iazzzarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\yqyajqiaq.jjr (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\iazzzarib.yqa (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjayayar.abr (44 bytes)
%WinDir%\xwrm.exe (44 bytes)
%Program Files%\Outlook Express\abrrararq.qjyarib.yqa (44 bytes)
%WinDir%\Microsoft.NET\Framework\rzqyjaaar.iza (44 bytes)
%Program Files%\Windows NT\Accessories\rrrziiirr.qyra (44 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\byjayayar.abr (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\zbzbyqqjb.yjz (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\bijrazyiy.aib (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\bijrazyiy.aibarib.yqa (44 bytes)
%WinDir%\ime\imjp8_1\rzqyjaaar.iza (44 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\abrrararq.qjy (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\byjayayar.abr (44 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\rzqyjaaar.iza (44 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\rzqyjaaar.iza (44 bytes)
%Program Files%\NetMeeting\rzqyjaaar.izaiazzzarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\bijrazyiy.aib (44 bytes)
%WinDir%\ime\imjp8_1\yqyajqiaq.jjr (44 bytes)
C:\totalcmd\rzqyjaaar.iza (44 bytes)
%WinDir%\pchealth\helpctr\binaries\iazzzarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\abrrararq.qjy (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\iazzzarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\rrrziiirr.qyr (44 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\yqyajqiaq.jjr (44 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\iazzzarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\byjayayar.abr (44 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\byjayayar.abr (44 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\iazzzarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\yqyajqiaq.jjr (44 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\zbzbyqqjb.yjz (44 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\iazzzarib.yqa (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib (44 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\rrrziiirr.qyr (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr (44 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\bijrazyiy.aib (44 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\rzqyjaaar.iza (44 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\bijrazyiy.aib (44 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\yqyajqiaq.jjr (44 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\byjayayar.abr (44 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\rzqyjaaar.iza (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\zbzbyqqjb.yjz (44 bytes)
%Program Files%\Windows Media Player\yqyajqiaq.jjr (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr (44 bytes)
%WinDir%\ime\imjp8_1\byjayayar.abr (44 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\abrrararq.qjy (44 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\iazzzarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\rzqyjaaar.iza (44 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\zbzbyqqjb.yjz (44 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\iazzzarib.yqa (44 bytes)
%Program Files%\Windows NT\abrrararq.qjy (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\abrrararq.qjy (44 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\zbzbyqqjb.yjz (44 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\byjayayar.abr (44 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\byjayayar.abr (44 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\rzqyjaaar.iza (44 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\rrrziiirr.qyr (44 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\yqyajqiaq.jjr (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\abrrararq.qjy (44 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\abrrararq.qjy (44 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\iazzzarib.yqa (44 bytes)
%WinDir%\ime\imjp8_1\bijrazyiy.aib (44 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\byjayayar.abr (44 bytes)
%Program Files%\Outlook Express\iazzzarib.yqaarib.yqa (44 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\bijrazyiy.aib (44 bytes)

The process rzqyjaaar.iza:1284 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jaqaij.abry.jiq (44 bytes)

The process rzqyjaaar.iza:1648 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jyazjz.jbry.jiq (44 bytes)

Registry activity

The process %original file name%.exe:1036 makes changes in the system registry.


The Virus creates and/or sets the following values in system registry:


To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"

Dropped PE files

MD5 File path
a27add1a933a4a56d5c26ad64a7dcfb1c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\bijrazyiy.aibarib.yqa
3843d7929b9015e144777ca8be8a2e57c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\aaibbb.jray.jiq
a27add1a933a4a56d5c26ad64a7dcfb1c:\Perl\bin\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\Perl\bin\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\Perl\bin\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Adobe\Reader 9.0\Reader\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Adobe\Reader 9.0\Reader\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Adobe\Reader 9.0\Reader\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Adobe\Reader 9.0\Reader\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Adobe\Reader 9.0\Reader\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\iazzzarib.yqaiy.aibarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Common Files\Adobe\ARM\1.0\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Common Files\Adobe\ARM\1.0\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Common Files\Adobe\ARM\1.0\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Common Files\Adobe\Updater6\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Common Files\Microsoft Shared\DW\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Common Files\Microsoft Shared\DW\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Common Files\Microsoft Shared\MSInfo\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\MSN Gaming Zone\Windows\abrrararq.qjyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\MSN Gaming Zone\Windows\byjayayar.abrr
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\MSN Gaming Zone\Windows\iazzzarib.yqa
5ac6cd4642fc24dc829bf5025a557efbc:\Program Files\MSN Gaming Zone\Windows\zClientm.exe
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\MSN Gaming Zone\Windows\zbzbyqqjb.yjzr
5ac6cd4642fc24dc829bf5025a557efbc:\Program Files\MSN Gaming Zone\Windows\zclientm.exe
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\NetMeeting\bijrazyiy.aibiazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\NetMeeting\rzqyjaaar.izaiazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\NetMeeting\yqyajqiaq.jjriazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Outlook Express\abrrararq.qjyarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Outlook Express\byjayayar.abrarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Outlook Express\iazzzarib.yqaarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Outlook Express\rrrziiirr.qyrarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\WinPcap\byjayayar.abrzbyqqjb.yjz.qyra
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Windows Media Player\bijrazyiy.aibyqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Windows Media Player\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Windows Media Player\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Windows NT\Accessories\rrrziiirr.qyra
faa1fde004b3c60b5a8068a7c3aab151c:\Program Files\Windows NT\Pinball\PINBALL.EXE
faa1fde004b3c60b5a8068a7c3aab151c:\Program Files\Windows NT\Pinball\pinball.exe
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Windows NT\Pinball\zbzbyqqjb.yjz.qyra
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Windows NT\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Wireshark\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Wireshark\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Wireshark\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Wireshark\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Wireshark\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\Program Files\Wireshark\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\$NtUninstallKB898461$\spuninst\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\$hf_mig$\KB898461\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\$hf_mig$\KB898461\update\bijrazyiy.aib.qyra
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\Microsoft.NET\Framework\rzqyjaaar.iza
5e28284f9b5f9097640d58a73d38ad4cc:\WINDOWS\NOTEPAD.EXE
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\Network Diagnostic\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\ime\imjp8_1\abrrararq.qjy
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\ime\imjp8_1\bijrazyiy.aib
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\ime\imjp8_1\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\ime\imjp8_1\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\ime\imjp8_1\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\ime\imjp8_1\yqyajqiaq.jjr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\ime\imjp8_1\zbzbyqqjb.yjz
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\ime\imkr6_1\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\inf\zbzbyqqjb.yjz
5e28284f9b5f9097640d58a73d38ad4cc:\WINDOWS\notepad.exe
b32a4db8fa8ba07afb1e86f8c9fb852ec:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe
b32a4db8fa8ba07afb1e86f8c9fb852ec:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\pchealth\helpctr\binaries\iazzzarib.yqa
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\pchealth\helpctr\binaries\rzqyjaaar.iza
a27add1a933a4a56d5c26ad64a7dcfb1c:\WINDOWS\xwrm.exe
a27add1a933a4a56d5c26ad64a7dcfb1c:\totalcmd\byjayayar.abr
a27add1a933a4a56d5c26ad64a7dcfb1c:\totalcmd\rrrziiirr.qyr
a27add1a933a4a56d5c26ad64a7dcfb1c:\totalcmd\rzqyjaaar.iza

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:1036
    rzqyjaaar.iza:1284
    rzqyjaaar.iza:1648

  2. Delete the original Virus file.
  3. Delete or disinfect the following files created/modified by the Virus:

    %Program Files%\MSN Gaming Zone\Windows\iazzzarib.yqa (44 bytes)
    %Program Files%\NetMeeting\bijrazyiy.aibiazzzarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\byjayayar.abr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\rrrziiirr.qyr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\yqyajqiaq.jjr (44 bytes)
    C:\totalcmd\byjayayar.abr (44 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\rrrziiirr.qyr (44 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\aaibbb.jray.jiq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\zbzbyqqjb.yjz (44 bytes)
    %WinDir%\ime\imkr6_1\rrrziiirr.qyr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\rrrziiirr.qyr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\rzqyjaaar.iza (44 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\rzqyjaaar.iza (44 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\zbzbyqqjb.yjz (44 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\byjayayar.abr (44 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\yqyajqiaq.jjr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\abrrararq.qjy (44 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\iazzzarib.yqa (44 bytes)
    %WinDir%\Network Diagnostic\zbzbyqqjb.yjz (44 bytes)
    %Program Files%\Outlook Express\rrrziiirr.qyrarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\zbzbyqqjb.yjz (44 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\rrrziiirr.qyr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\byjayayar.abr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\rrrziiirr.qyr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\iazzzarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\rzqyjaaar.iza (44 bytes)
    %Program Files%\NetMeeting\yqyajqiaq.jjriazzzarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\rrrziiirr.qyr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\rzqyjaaar.iza (44 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\abrrararq.qjy (44 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\abrrararq.qjy (44 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\abrrararq.qjy (44 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\byjayayar.abr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\iazzzarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\zbzbyqqjb.yjz (44 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\yqyajqiaq.jjr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\bijrazyiy.aib (44 bytes)
    %Program Files%\Common Files\Microsoft Shared\MSInfo\bijrazyiy.aib (44 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\iazzzarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\yqyajqiaq.jjr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\iazzzarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\rrrziiirr.qyr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\bijrazyiy.aib (44 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\rzqyjaaar.iza (44 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\rzqyjaaar.iza (44 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\bijrazyiy.aib (44 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\abrrararq.qjy (44 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\bijrazyiy.aib (44 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\rrrziiirr.qyr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\iazzzarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\yqyajqiaq.jjr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\rrrziiirr.qyr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\yqyajqiaq.jjr (44 bytes)
    %Program Files%\Outlook Express\byjayayar.abrarib.yqa (44 bytes)
    %WinDir%\ime\imjp8_1\abrrararq.qjy (44 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\bijrazyiy.aib (44 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\iazzzarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\byjayayar.abr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\byjayayar.abr (44 bytes)
    %Program Files%\WinPcap\byjayayar.abrzbyqqjb.yjz.qyra (44 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\yqyajqiaq.jjr (44 bytes)
    %WinDir%\pchealth\helpctr\binaries\rzqyjaaar.iza (44 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\bijrazyiy.aib (44 bytes)
    %WinDir%\ime\imjp8_1\iazzzarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\iazzzarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\rrrziiirr.qyr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\zbzbyqqjb.yjz (44 bytes)
    %WinDir%\$NtUninstallKB898461$\spuninst\yqyajqiaq.jjr (44 bytes)
    %Program Files%\Common Files\Adobe\Updater6\zbzbyqqjb.yjz (44 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\byjayayar.abr (44 bytes)
    %Program Files%\Windows NT\Pinball\zbzbyqqjb.yjz.qyra (44 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\rrrziiirr.qyr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\rzqyjaaar.iza (44 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\yqyajqiaq.jjr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\zbzbyqqjb.yjz (44 bytes)
    %Program Files%\MSN Gaming Zone\Windows\byjayayar.abrr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\rrrziiirr.qyr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\zbzbyqqjb.yjz (44 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\byjayayar.abr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\zbzbyqqjb.yjz (44 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abrrararq.qjy (44 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\bijrazyiy.aib (44 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\abrrararq.qjy (44 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\bijrazyiy.aib (44 bytes)
    C:\totalcmd\rrrziiirr.qyr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\rzqyjaaar.iza (44 bytes)
    %WinDir%\$hf_mig$\KB898461\iazzzarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\byjayayar.abr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\yqyajqiaq.jjr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\rzqyjaaar.iza (44 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\abrrararq.qjy (44 bytes)
    %WinDir%\$hf_mig$\KB898461\update\bijrazyiy.aib.qyra (44 bytes)
    %WinDir%\ime\imjp8_1\zbzbyqqjb.yjz (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\zbzbyqqjb.yjz (44 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\bijrazyiy.aib (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\abrrararq.qjy (44 bytes)
    %Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\iazzzarib.yqaiy.aibarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\abrrararq.qjy (44 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\rrrziiirr.qyr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\abrrararq.qjy (44 bytes)
    %WinDir%\inf\zbzbyqqjb.yjz (44 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\bijrazyiy.aib (44 bytes)
    %Program Files%\MSN Gaming Zone\Windows\zbzbyqqjb.yjzr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\zbzbyqqjb.yjz (44 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\bijrazyiy.aib (44 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yqyajqiaq.jjr (44 bytes)
    %Program Files%\Windows Media Player\rzqyjaaar.iza (44 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\yqyajqiaq.jjr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\bijrazyiy.aib (44 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\abrrararq.qjy (44 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza (44 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\yqyajqiaq.jjr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\rrrziiirr.qyr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\rzqyjaaar.iza (44 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\rrrziiirr.qyr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\yqyajqiaq.jjr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\zbzbyqqjb.yjz (44 bytes)
    %Program Files%\Windows Media Player\bijrazyiy.aibyqa (44 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\iazzzarib.yqa (44 bytes)
    %Program Files%\MSN Gaming Zone\Windows\abrrararq.qjyr (44 bytes)
    %WinDir%\byjayayar.abr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\iazzzarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\iazzzarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\yqyajqiaq.jjr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\iazzzarib.yqa (44 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjayayar.abr (44 bytes)
    %WinDir%\xwrm.exe (44 bytes)
    %Program Files%\Outlook Express\abrrararq.qjyarib.yqa (44 bytes)
    %WinDir%\Microsoft.NET\Framework\rzqyjaaar.iza (44 bytes)
    %Program Files%\Windows NT\Accessories\rrrziiirr.qyra (44 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\byjayayar.abr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\zbzbyqqjb.yjz (44 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\bijrazyiy.aib (44 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\bijrazyiy.aibarib.yqa (44 bytes)
    %WinDir%\ime\imjp8_1\rzqyjaaar.iza (44 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\abrrararq.qjy (44 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\byjayayar.abr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\rzqyjaaar.iza (44 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\rzqyjaaar.iza (44 bytes)
    %Program Files%\NetMeeting\rzqyjaaar.izaiazzzarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\bijrazyiy.aib (44 bytes)
    %WinDir%\ime\imjp8_1\yqyajqiaq.jjr (44 bytes)
    C:\totalcmd\rzqyjaaar.iza (44 bytes)
    %WinDir%\pchealth\helpctr\binaries\iazzzarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\abrrararq.qjy (44 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\iazzzarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\rrrziiirr.qyr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\yqyajqiaq.jjr (44 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\iazzzarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\byjayayar.abr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\byjayayar.abr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\iazzzarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\yqyajqiaq.jjr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\zbzbyqqjb.yjz (44 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\iazzzarib.yqa (44 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib (44 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\rrrziiirr.qyr (44 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\bijrazyiy.aib (44 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\rzqyjaaar.iza (44 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\bijrazyiy.aib (44 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\yqyajqiaq.jjr (44 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\byjayayar.abr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\rzqyjaaar.iza (44 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\zbzbyqqjb.yjz (44 bytes)
    %Program Files%\Windows Media Player\yqyajqiaq.jjr (44 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz (44 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr (44 bytes)
    %WinDir%\ime\imjp8_1\byjayayar.abr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\abrrararq.qjy (44 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\iazzzarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\rzqyjaaar.iza (44 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\zbzbyqqjb.yjz (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\iazzzarib.yqa (44 bytes)
    %Program Files%\Windows NT\abrrararq.qjy (44 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\abrrararq.qjy (44 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\zbzbyqqjb.yjz (44 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\byjayayar.abr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\byjayayar.abr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\rzqyjaaar.iza (44 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\rrrziiirr.qyr (44 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\yqyajqiaq.jjr (44 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\abrrararq.qjy (44 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\abrrararq.qjy (44 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\iazzzarib.yqa (44 bytes)
    %WinDir%\ime\imjp8_1\bijrazyiy.aib (44 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\byjayayar.abr (44 bytes)
    %Program Files%\Outlook Express\iazzzarib.yqaarib.yqa (44 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\bijrazyiy.aib (44 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\jaqaij.abry.jiq (44 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\jyazjz.jbry.jiq (44 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "x32x" = "%WinDir%\xwrm.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
aiyyrara4096409615360.71357cb4f020c67c392815f834ee5cf93bfad
ajjrqzii819232768322564.47667043cd13cc16ccc16945c771911646351
irrqyrab4096040965120.46801303990ce32513f25d3855296b7bc8aa4d
rrararqq45056409620483.924736481060bb77e469e5fdb95d8e5c6ab31

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 1
5f96eaeb9ce6b9f552973fdb22ccc89a

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Virus connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1036:

\xwrm.exe

\xwrm.exe

%WinDir%\xwrm.exe

%WinDir%\xwrm.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

USER %s 8 * :%s

USER %s 8 * :%s

NICK %s

NICK %s

PONG %s

PONG %s

JOIN #england

JOIN #england

PRIVMSG #england :.-:[X-Worm]:-.

PRIVMSG #england :.-:[X-Worm]:-.

irc.undernet.org

irc.undernet.org

MAIL FROM:<%s>

MAIL FROM:<%s>

RCPT TO:<%s>

RCPT TO:<%s>

--%s--

--%s--

From:<%s>

From:<%s>

To: %s

To: %s

Subject:%s

Subject:%s

boundary="%s"

boundary="%s"

X-Mailer: Microsoft Outlook Express 6.00.2800.1106

X-Mailer: Microsoft Outlook Express 6.00.2800.1106

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

charset="windows-1255"

charset="windows-1255"

name= "%s%s"

name= "%s%s"

Content-Disposition: attachment; filename="%s%s"

Content-Disposition: attachment; filename="%s%s"

Support

Support

No.reply

No.reply

8.txtt:

8.txtt:

8.htmt2

8.htmt2

8.rtft*

8.rtft*

8.doct"

8.doct"

8.bdxt

8.bdxt

8.phpt

8.phpt

8.jspt

8.jspt

8.cgit

8.cgit

smtp

smtp

ws2_32.dll

ws2_32.dll

Windows

Windows

Operating System

Operating System

# Start menu button. Clipping the button is better than showing portions of the Vista desktop background window.

# Start menu button. Clipping the button is better than showing portions of the Vista desktop background window.

ADVAPI32.DLL

ADVAPI32.DLL

RegOpenKeyExA

RegOpenKeyExA

RegCloseKey

RegCloseKey

User32.dll

User32.dll

visualstudio2005.txt

visualstudio2005.txt

9e6400_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03

9e6400_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03

VISUAL~1.TXT

VISUAL~1.TXT

8.exe

8.exe

8.scrtt

8.scrtt

8.avitJ

8.avitJ

8.doctB

8.doctB

8.mp3t:

8.mp3t:

8.mpgt2

8.mpgt2

8.xlst*

8.xlst*

8.jpgt"

8.jpgt"

8.zipt

8.zipt

8.isot

8.isot

8.pdft

8.pdft

8.pptt

8.pptt

8.rart

8.rart

c:\WINDOWS\_default.pif

c:\WINDOWS\_default.pif

stem.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll

stem.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll

nSolicitedRCUI.htm

nSolicitedRCUI.htm

rs.Soap.dll

rs.Soap.dll

SFC.DLL

SFC.DLL

WinExec

WinExec

iazzzarib.yqa

iazzzarib.yqa

c:\WINDOWS\iazzzarib.yqa

c:\WINDOWS\iazzzarib.yqa

bution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\abrrararq.qjy

bution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\abrrararq.qjy

arib.yqa

arib.yqa

ReadMe.exe

ReadMe.exe

c:\%original file name%.exe

c:\%original file name%.exe

t Menu\Programs\Startup\UjNbaBR2w.exe

t Menu\Programs\Startup\UjNbaBR2w.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\aaibbb.jray.jiq

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\aaibbb.jray.jiq

GetWindowsDirectoryA

GetWindowsDirectoryA

FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj

FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj

KERNEL32.dll

KERNEL32.dll