Susp_Dropper (Kaspersky), DeepScan:Generic.Malware.SIM!g.8E9B5AF3 (B) (Emsisoft), DeepScan:Generic.Malware.SIM!g.8E9B5AF3 (AdAware), Virus.Win32.Duel.FD, GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)Behaviour: Worm, EmailWorm, Virus, IRCBot
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 38136bc33fb0ddce1169fccf42662896
SHA1: 7bd877b5ed96e425325918764d31e6c5de33fe84
SHA256: 7f6698cbd132a47883f00972fa0c201b8f4481b5807f7470830db47272461f49
SSDeep: 384:O4Bk0gQZQY/twKwi/gVo5zgxwfUyBznYbE ApHNV6k5S6Wx4Ru0gakTiTX9bBXRr:Osk0x7FOqOwcY aHv6tvUrDtbhRhDU2
Size: 44544 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: no data
Analyzed on: WindowsXP SP3 32-bit
Summary: Virus. A program that recursively replicates a possibly evolved copy of itself.
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
EmailWorm | Worm can send e-mails. |
IRCBot | A bot can communicate with command and control servers via IRC channel. |
Process activity
The Virus creates the following process(es):
jrrzqyjaa.ari:1056
jrrzqyjaa.ari:840
%original file name%.exe:588
The Virus injects its code into the following process(es):No processes have been created.
File activity
The process jrrzqyjaa.ari:1056 makes changes in the file system.
The Virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\aarjbr.rzri.rir (44 bytes)
The process jrrzqyjaa.ari:840 makes changes in the file system.
The Virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\irbqyj.zyai.rir (44 bytes)
The process %original file name%.exe:588 makes changes in the file system.
The Virus creates and/or writes to the following file(s):
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\qabijrazy.iya (44 bytes)
%WinDir%\ime\imjp8_1\jyzbzbyqq.jby (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\qabijrazy.iya (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\jzbyjayay.ara (44 bytes)
%Program Files%\NetMeeting\ibyqyajqi.aqjbriazzzar.iby (44 bytes)
%WinDir%\inf\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\zarrrziii.rrq (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\jrrzqyjaa.ari (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\briazzzar.iby (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\jrrzqyjaa.ari (44 bytes)
%Program Files%\WinPcap\jzbyjayay.arazbzbyqq.jby.rrqy (44 bytes)
%Program Files%\Outlook Express\yrabrrara.rqqzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\jzbyjayay.ara (44 bytes)
%WinDir%\ime\imjp8_1\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\yrabrrara.rqq (44 bytes)
%Program Files%\Outlook Express\jzbyjayay.arazzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\zarrrziii.rrq (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\zarrrziii.rrq (44 bytes)
%WinDir%\ime\imkr6_1\zarrrziii.rrq (44 bytes)
%WinDir%\$hf_mig$\KB898461\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\jzbyjayay.ara (44 bytes)
%Program Files%\Windows Media Player\ibyqyajqi.aqj (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\qabijrazy.iya (44 bytes)
%Program Files%\Windows NT\Pinball\jyzbzbyqq.jby.rrqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\ime\imjp8_1\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\qabijrazy.iya (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\zarrrziii.rrq (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\yrabrrara.rqq (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\jzbyjayay.ara (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\zarrrziii.rrq (44 bytes)
C:\totalcmd\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\jzbyjayay.ara (44 bytes)
%WinDir%\ime\imjp8_1\qabijrazy.iya (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\jzbyjayay.araq (44 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\qabijrazy.iya (44 bytes)
%Program Files%\Outlook Express\zarrrziii.rrqzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\jzbyjayay.ara (44 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\ibyqyajqi.aqj (44 bytes)
%Program Files%\Windows Media Player\jrrzqyjaa.ari (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\qabijrazy.iya (44 bytes)
%Program Files%\Common Files\Adobe\Updater6\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\yrabrrara.rqq (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\yrabrrara.rqq (44 bytes)
%WinDir%\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\briazzzar.iby (44 bytes)
%WinDir%\Microsoft.NET\Framework\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\jrrzqyjaa.ari (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qabijrazy.iya (44 bytes)
%Program Files%\NetMeeting\jrrzqyjaa.aribriazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\ibyqyajqi.aqj (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\briazzzar.iby (44 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\qabijrazy.iya (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\yrabrrara.rqqq (44 bytes)
%WinDir%\ime\imjp8_1\jrrzqyjaa.ari (44 bytes)
%WinDir%\pchealth\helpctr\binaries\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\briazzzar.iby (44 bytes)
%Program Files%\Outlook Express\briazzzar.ibyzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\zarrrziii.rrq (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\ibyqyajqi.aqj (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\jyzbzbyqq.jbyq (44 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\qabijrazy.iya (44 bytes)
%WinDir%\xwrm.exe (44 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\zarrrziii.rrq (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\zarrrziii.rrq (44 bytes)
%WinDir%\pchealth\helpctr\binaries\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\jrrzqyjaa.ari (44 bytes)
C:\totalcmd\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\ibyqyajqi.aqj (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ayrrab.aiai.rir (44 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\briazzzar.iby (44 bytes)
%Program Files%\Windows Media Player\qabijrazy.iyaiby (44 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\yrabrrara.rqq (44 bytes)
%Program Files%\Windows NT\Accessories\zarrrziii.rrqy (44 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\briazzzar.ibyzy.iyazzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\yrabrrara.rqq (44 bytes)
%WinDir%\ime\imjp8_1\yrabrrara.rqq (44 bytes)
%WinDir%\ime\imjp8_1\ibyqyajqi.aqj (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\qabijrazy.iya (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\qabijrazy.iyazzar.iby (44 bytes)
%Program Files%\Windows NT\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\jrrzqyjaa.ari (44 bytes)
%Program Files%\NetMeeting\qabijrazy.iyabriazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\yrabrrara.rqq (44 bytes)
%WinDir%\$hf_mig$\KB898461\update\qabijrazy.iya.rrqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\yrabrrara.rqq (44 bytes)
%WinDir%\Network Diagnostic\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\ibyqyajqi.aqj (44 bytes)
C:\totalcmd\jrrzqyjaa.ari (44 bytes)
Registry activity
The process %original file name%.exe:588 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"
Dropped PE files
MD5 | File path |
---|---|
36ac972f817f6e29001098099cf0b9a6 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\qabijrazy.iyazzar.iby |
d23b4e6c077039809d799c2e63875bda | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ayrrab.aiai.rir |
36ac972f817f6e29001098099cf0b9a6 | c:\Perl\bin\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\Perl\bin\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\Perl\bin\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Adobe\Reader 9.0\Reader\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Adobe\Reader 9.0\Reader\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Adobe\Reader 9.0\Reader\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Adobe\Reader 9.0\Reader\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Adobe\Reader 9.0\Reader\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Adobe\Reader 9.0\Reader\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\briazzzar.ibyzy.iyazzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Common Files\Adobe\ARM\1.0\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Common Files\Adobe\ARM\1.0\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Common Files\Adobe\ARM\1.0\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Common Files\Adobe\ARM\1.0\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Common Files\Adobe\Updater6\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Common Files\Microsoft Shared\DW\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Common Files\Microsoft Shared\DW\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Common Files\Microsoft Shared\MSInfo\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\MSN Gaming Zone\Windows\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\MSN Gaming Zone\Windows\jyzbzbyqq.jbyq |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\MSN Gaming Zone\Windows\jzbyjayay.araq |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\MSN Gaming Zone\Windows\yrabrrara.rqqq |
5ac6cd4642fc24dc829bf5025a557efb | c:\Program Files\MSN Gaming Zone\Windows\zClientm.exe |
5ac6cd4642fc24dc829bf5025a557efb | c:\Program Files\MSN Gaming Zone\Windows\zclientm.exe |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\NetMeeting\ibyqyajqi.aqjbriazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\NetMeeting\jrrzqyjaa.aribriazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\NetMeeting\qabijrazy.iyabriazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Outlook Express\briazzzar.ibyzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Outlook Express\jzbyjayay.arazzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Outlook Express\yrabrrara.rqqzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Outlook Express\zarrrziii.rrqzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\WinPcap\jzbyjayay.arazbzbyqq.jby.rrqy |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Windows Media Player\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Windows Media Player\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Windows Media Player\qabijrazy.iyaiby |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Windows NT\Accessories\zarrrziii.rrqy |
faa1fde004b3c60b5a8068a7c3aab151 | c:\Program Files\Windows NT\Pinball\PINBALL.EXE |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Windows NT\Pinball\jyzbzbyqq.jby.rrqy |
faa1fde004b3c60b5a8068a7c3aab151 | c:\Program Files\Windows NT\Pinball\pinball.exe |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Windows NT\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Wireshark\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Wireshark\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Wireshark\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Wireshark\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Wireshark\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\Program Files\Wireshark\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\$NtUninstallKB898461$\spuninst\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\$hf_mig$\KB898461\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\$hf_mig$\KB898461\update\qabijrazy.iya.rrqy |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\Microsoft.NET\Framework\jrrzqyjaa.ari |
5e28284f9b5f9097640d58a73d38ad4c | c:\WINDOWS\NOTEPAD.EXE |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\Network Diagnostic\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\ime\imjp8_1\briazzzar.iby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\ime\imjp8_1\ibyqyajqi.aqj |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\ime\imjp8_1\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\ime\imjp8_1\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\ime\imjp8_1\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\ime\imjp8_1\qabijrazy.iya |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\ime\imjp8_1\yrabrrara.rqq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\ime\imkr6_1\zarrrziii.rrq |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\inf\jyzbzbyqq.jby |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\jzbyjayay.ara |
5e28284f9b5f9097640d58a73d38ad4c | c:\WINDOWS\notepad.exe |
b32a4db8fa8ba07afb1e86f8c9fb852e | c:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\pchealth\helpctr\binaries\briazzzar.iby |
b32a4db8fa8ba07afb1e86f8c9fb852e | c:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\pchealth\helpctr\binaries\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\WINDOWS\xwrm.exe |
36ac972f817f6e29001098099cf0b9a6 | c:\totalcmd\jrrzqyjaa.ari |
36ac972f817f6e29001098099cf0b9a6 | c:\totalcmd\jzbyjayay.ara |
36ac972f817f6e29001098099cf0b9a6 | c:\totalcmd\zarrrziii.rrq |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
jrrzqyjaa.ari:1056
jrrzqyjaa.ari:840
%original file name%.exe:588 - Delete the original Virus file.
- Delete or disinfect the following files created/modified by the Virus:
%Documents and Settings%\%current user%\Local Settings\Temp\aarjbr.rzri.rir (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\irbqyj.zyai.rir (44 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\qabijrazy.iya (44 bytes)
%WinDir%\ime\imjp8_1\jyzbzbyqq.jby (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\qabijrazy.iya (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\jzbyjayay.ara (44 bytes)
%Program Files%\NetMeeting\ibyqyajqi.aqjbriazzzar.iby (44 bytes)
%WinDir%\inf\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\zarrrziii.rrq (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\jrrzqyjaa.ari (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\briazzzar.iby (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\jrrzqyjaa.ari (44 bytes)
%Program Files%\WinPcap\jzbyjayay.arazbzbyqq.jby.rrqy (44 bytes)
%Program Files%\Outlook Express\yrabrrara.rqqzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\jzbyjayay.ara (44 bytes)
%WinDir%\ime\imjp8_1\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\yrabrrara.rqq (44 bytes)
%Program Files%\Outlook Express\jzbyjayay.arazzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\zarrrziii.rrq (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\zarrrziii.rrq (44 bytes)
%WinDir%\ime\imkr6_1\zarrrziii.rrq (44 bytes)
%WinDir%\$hf_mig$\KB898461\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\jzbyjayay.ara (44 bytes)
%Program Files%\Windows Media Player\ibyqyajqi.aqj (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\qabijrazy.iya (44 bytes)
%Program Files%\Windows NT\Pinball\jyzbzbyqq.jby.rrqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\ime\imjp8_1\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\qabijrazy.iya (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\zarrrziii.rrq (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\yrabrrara.rqq (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\jzbyjayay.ara (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\zarrrziii.rrq (44 bytes)
C:\totalcmd\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\jzbyjayay.ara (44 bytes)
%WinDir%\ime\imjp8_1\qabijrazy.iya (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\jzbyjayay.araq (44 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\qabijrazy.iya (44 bytes)
%Program Files%\Outlook Express\zarrrziii.rrqzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\jzbyjayay.ara (44 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\ibyqyajqi.aqj (44 bytes)
%Program Files%\Windows Media Player\jrrzqyjaa.ari (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\qabijrazy.iya (44 bytes)
%Program Files%\Common Files\Adobe\Updater6\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\yrabrrara.rqq (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\yrabrrara.rqq (44 bytes)
%WinDir%\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\briazzzar.iby (44 bytes)
%WinDir%\Microsoft.NET\Framework\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\jrrzqyjaa.ari (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qabijrazy.iya (44 bytes)
%Program Files%\NetMeeting\jrrzqyjaa.aribriazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\ibyqyajqi.aqj (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\briazzzar.iby (44 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\qabijrazy.iya (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\yrabrrara.rqqq (44 bytes)
%WinDir%\ime\imjp8_1\jrrzqyjaa.ari (44 bytes)
%WinDir%\pchealth\helpctr\binaries\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\briazzzar.iby (44 bytes)
%Program Files%\Outlook Express\briazzzar.ibyzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\zarrrziii.rrq (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\ibyqyajqi.aqj (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\jyzbzbyqq.jbyq (44 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\qabijrazy.iya (44 bytes)
%WinDir%\xwrm.exe (44 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\zarrrziii.rrq (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\zarrrziii.rrq (44 bytes)
%WinDir%\pchealth\helpctr\binaries\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\jrrzqyjaa.ari (44 bytes)
C:\totalcmd\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\ibyqyajqi.aqj (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ayrrab.aiai.rir (44 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\briazzzar.iby (44 bytes)
%Program Files%\Windows Media Player\qabijrazy.iyaiby (44 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\yrabrrara.rqq (44 bytes)
%Program Files%\Windows NT\Accessories\zarrrziii.rrqy (44 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\briazzzar.ibyzy.iyazzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\yrabrrara.rqq (44 bytes)
%WinDir%\ime\imjp8_1\yrabrrara.rqq (44 bytes)
%WinDir%\ime\imjp8_1\ibyqyajqi.aqj (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\qabijrazy.iya (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\qabijrazy.iyazzar.iby (44 bytes)
%Program Files%\Windows NT\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\jrrzqyjaa.ari (44 bytes)
%Program Files%\NetMeeting\qabijrazy.iyabriazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\yrabrrara.rqq (44 bytes)
%WinDir%\$hf_mig$\KB898461\update\qabijrazy.iya.rrqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\yrabrrara.rqq (44 bytes)
%WinDir%\Network Diagnostic\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\ibyqyajqi.aqj (44 bytes)
C:\totalcmd\jrrzqyjaa.ari (44 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
jqqaybza | 4096 | 4096 | 1536 | 0.476076 | cea23d7b527fadca8e74d7376c57659a |
airqqjzb | 8192 | 32768 | 32256 | 5.0983 | dea9750336f424c141e25edac2533c44 |
qajqrzqy | 40960 | 4096 | 512 | 0.468013 | 03990ce32513f25d3855296b7bc8aa4d |
jaaariza | 45056 | 4096 | 2048 | 3.92473 | 6481060bb77e469e5fdb95d8e5c6ab31 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Virus connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_588:
\xwrm.exe
\xwrm.exe
%WinDir%\xwrm.exe
%WinDir%\xwrm.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
USER %s 8 * :%s
USER %s 8 * :%s
NICK %s
NICK %s
PONG %s
PONG %s
JOIN #england
JOIN #england
PRIVMSG #england :.-:[X-Worm]:-.
PRIVMSG #england :.-:[X-Worm]:-.
irc.undernet.org
irc.undernet.org
MAIL FROM:<%s>
MAIL FROM:<%s>
RCPT TO:<%s>
RCPT TO:<%s>
--%s--
--%s--
From:<%s>
From:<%s>
To: %s
To: %s
Subject:%s
Subject:%s
boundary="%s"
boundary="%s"
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
charset="windows-1255"
charset="windows-1255"
name= "%s%s"
name= "%s%s"
Content-Disposition: attachment; filename="%s%s"
Content-Disposition: attachment; filename="%s%s"
Support
Support
No.reply
No.reply
8.txtt:
8.txtt:
8.htmt2
8.htmt2
8.rtft*
8.rtft*
8.doct"
8.doct"
8.bdxt
8.bdxt
8.phpt
8.phpt
8.jspt
8.jspt
8.cgit
8.cgit
smtp
smtp
ws2_32.dll
ws2_32.dll
HTTP 200 OK
HTTP 200 OK
server. Please contact the web site administrator.
server. Please contact the web site administrator.
ADVAPI32.DLL
ADVAPI32.DLL
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
User32.dll
User32.dll
adrot.txt
adrot.txt
cts.bat
cts.bat
aa58-4c8e-a8ea-3cad7c47ab03
aa58-4c8e-a8ea-3cad7c47ab03
8.exe
8.exe
8.scrtt
8.scrtt
8.avitJ
8.avitJ
8.doctB
8.doctB
8.mp3t:
8.mp3t:
8.mpgt2
8.mpgt2
8.xlst*
8.xlst*
8.jpgt"
8.jpgt"
8.zipt
8.zipt
8.isot
8.isot
8.pdft
8.pdft
8.pptt
8.pptt
8.rart
8.rart
c:\WINDOWS\_default.pif
c:\WINDOWS\_default.pif
stem.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll
stem.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll
nSolicitedRCUI.htm
nSolicitedRCUI.htm
rs.Soap.dll
rs.Soap.dll
SFC.DLL
SFC.DLL
WinExec
WinExec
briazzzar.iby
briazzzar.iby
c:\WINDOWS\briazzzar.iby
c:\WINDOWS\briazzzar.iby
bution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\yrabrrara.rqq
bution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\yrabrrara.rqq
zzar.iby
zzar.iby
ReadMe.exe
ReadMe.exe
c:\%original file name%.exe
c:\%original file name%.exe
t Menu\Programs\Startup\kluBQ3lDn.exe
t Menu\Programs\Startup\kluBQ3lDn.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ayrrab.aiai.rir
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ayrrab.aiai.rir
GetWindowsDirectoryA
GetWindowsDirectoryA
FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj
FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj
KERNEL32.dll
KERNEL32.dll