Skip to main content

Virus.Win32.Duel_38136bc33f


Susp_Dropper (Kaspersky), DeepScan:Generic.Malware.SIM!g.8E9B5AF3 (B) (Emsisoft), DeepScan:Generic.Malware.SIM!g.8E9B5AF3 (AdAware), Virus.Win32.Duel.FD, GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)Behaviour: Worm, EmailWorm, Virus, IRCBot

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 38136bc33fb0ddce1169fccf42662896

SHA1: 7bd877b5ed96e425325918764d31e6c5de33fe84

SHA256: 7f6698cbd132a47883f00972fa0c201b8f4481b5807f7470830db47272461f49

SSDeep: 384:O4Bk0gQZQY/twKwi/gVo5zgxwfUyBznYbE ApHNV6k5S6Wx4Ru0gakTiTX9bBXRr:Osk0x7FOqOwcY aHv6tvUrDtbhRhDU2

Size: 44544 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: no data

Analyzed on: WindowsXP SP3 32-bit

Summary: Virus. A program that recursively replicates a possibly evolved copy of itself.

Dynamic Analysis

Payload

Behaviour Description
EmailWormWorm can send e-mails.
IRCBotA bot can communicate with command and control servers via IRC channel.


Process activity

The Virus creates the following process(es):

jrrzqyjaa.ari:1056
jrrzqyjaa.ari:840
%original file name%.exe:588

The Virus injects its code into the following process(es):No processes have been created.

File activity

The process jrrzqyjaa.ari:1056 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aarjbr.rzri.rir (44 bytes)

The process jrrzqyjaa.ari:840 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\irbqyj.zyai.rir (44 bytes)

The process %original file name%.exe:588 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\qabijrazy.iya (44 bytes)
%WinDir%\ime\imjp8_1\jyzbzbyqq.jby (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\qabijrazy.iya (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\jzbyjayay.ara (44 bytes)
%Program Files%\NetMeeting\ibyqyajqi.aqjbriazzzar.iby (44 bytes)
%WinDir%\inf\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\zarrrziii.rrq (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\jrrzqyjaa.ari (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\briazzzar.iby (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\jrrzqyjaa.ari (44 bytes)
%Program Files%\WinPcap\jzbyjayay.arazbzbyqq.jby.rrqy (44 bytes)
%Program Files%\Outlook Express\yrabrrara.rqqzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\jzbyjayay.ara (44 bytes)
%WinDir%\ime\imjp8_1\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\yrabrrara.rqq (44 bytes)
%Program Files%\Outlook Express\jzbyjayay.arazzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\zarrrziii.rrq (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\zarrrziii.rrq (44 bytes)
%WinDir%\ime\imkr6_1\zarrrziii.rrq (44 bytes)
%WinDir%\$hf_mig$\KB898461\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\jzbyjayay.ara (44 bytes)
%Program Files%\Windows Media Player\ibyqyajqi.aqj (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\qabijrazy.iya (44 bytes)
%Program Files%\Windows NT\Pinball\jyzbzbyqq.jby.rrqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\ime\imjp8_1\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\qabijrazy.iya (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\zarrrziii.rrq (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\yrabrrara.rqq (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\jzbyjayay.ara (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\zarrrziii.rrq (44 bytes)
C:\totalcmd\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\jzbyjayay.ara (44 bytes)
%WinDir%\ime\imjp8_1\qabijrazy.iya (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\jzbyjayay.araq (44 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\qabijrazy.iya (44 bytes)
%Program Files%\Outlook Express\zarrrziii.rrqzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\jzbyjayay.ara (44 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\ibyqyajqi.aqj (44 bytes)
%Program Files%\Windows Media Player\jrrzqyjaa.ari (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\qabijrazy.iya (44 bytes)
%Program Files%\Common Files\Adobe\Updater6\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\yrabrrara.rqq (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\yrabrrara.rqq (44 bytes)
%WinDir%\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\briazzzar.iby (44 bytes)
%WinDir%\Microsoft.NET\Framework\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\jrrzqyjaa.ari (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qabijrazy.iya (44 bytes)
%Program Files%\NetMeeting\jrrzqyjaa.aribriazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\ibyqyajqi.aqj (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\briazzzar.iby (44 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\qabijrazy.iya (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\yrabrrara.rqqq (44 bytes)
%WinDir%\ime\imjp8_1\jrrzqyjaa.ari (44 bytes)
%WinDir%\pchealth\helpctr\binaries\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\briazzzar.iby (44 bytes)
%Program Files%\Outlook Express\briazzzar.ibyzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\zarrrziii.rrq (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\ibyqyajqi.aqj (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\jyzbzbyqq.jbyq (44 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\qabijrazy.iya (44 bytes)
%WinDir%\xwrm.exe (44 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\zarrrziii.rrq (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\zarrrziii.rrq (44 bytes)
%WinDir%\pchealth\helpctr\binaries\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\jrrzqyjaa.ari (44 bytes)
C:\totalcmd\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\ibyqyajqi.aqj (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ayrrab.aiai.rir (44 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\briazzzar.iby (44 bytes)
%Program Files%\Windows Media Player\qabijrazy.iyaiby (44 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\yrabrrara.rqq (44 bytes)
%Program Files%\Windows NT\Accessories\zarrrziii.rrqy (44 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\briazzzar.ibyzy.iyazzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\yrabrrara.rqq (44 bytes)
%WinDir%\ime\imjp8_1\yrabrrara.rqq (44 bytes)
%WinDir%\ime\imjp8_1\ibyqyajqi.aqj (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\qabijrazy.iya (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\qabijrazy.iyazzar.iby (44 bytes)
%Program Files%\Windows NT\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\jrrzqyjaa.ari (44 bytes)
%Program Files%\NetMeeting\qabijrazy.iyabriazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\yrabrrara.rqq (44 bytes)
%WinDir%\$hf_mig$\KB898461\update\qabijrazy.iya.rrqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\yrabrrara.rqq (44 bytes)
%WinDir%\Network Diagnostic\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\briazzzar.iby (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\yrabrrara.rqq (44 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\qabijrazy.iya (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\jzbyjayay.ara (44 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\zarrrziii.rrq (44 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\jrrzqyjaa.ari (44 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\jyzbzbyqq.jby (44 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\ibyqyajqi.aqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\ibyqyajqi.aqj (44 bytes)
C:\totalcmd\jrrzqyjaa.ari (44 bytes)

Registry activity

The process %original file name%.exe:588 makes changes in the system registry.


The Virus creates and/or sets the following values in system registry:


To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"

Dropped PE files

MD5 File path
36ac972f817f6e29001098099cf0b9a6c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\qabijrazy.iyazzar.iby
d23b4e6c077039809d799c2e63875bdac:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ayrrab.aiai.rir
36ac972f817f6e29001098099cf0b9a6c:\Perl\bin\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\Perl\bin\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\Perl\bin\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Adobe\Reader 9.0\Reader\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Adobe\Reader 9.0\Reader\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Adobe\Reader 9.0\Reader\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Adobe\Reader 9.0\Reader\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Adobe\Reader 9.0\Reader\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Adobe\Reader 9.0\Reader\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\briazzzar.ibyzy.iyazzar.iby
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Common Files\Adobe\ARM\1.0\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Common Files\Adobe\ARM\1.0\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Common Files\Adobe\ARM\1.0\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Common Files\Adobe\ARM\1.0\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Common Files\Adobe\Updater6\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Common Files\Microsoft Shared\DW\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Common Files\Microsoft Shared\DW\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Common Files\Microsoft Shared\MSInfo\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\Program Files\MSN Gaming Zone\Windows\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\Program Files\MSN Gaming Zone\Windows\jyzbzbyqq.jbyq
36ac972f817f6e29001098099cf0b9a6c:\Program Files\MSN Gaming Zone\Windows\jzbyjayay.araq
36ac972f817f6e29001098099cf0b9a6c:\Program Files\MSN Gaming Zone\Windows\yrabrrara.rqqq
5ac6cd4642fc24dc829bf5025a557efbc:\Program Files\MSN Gaming Zone\Windows\zClientm.exe
5ac6cd4642fc24dc829bf5025a557efbc:\Program Files\MSN Gaming Zone\Windows\zclientm.exe
36ac972f817f6e29001098099cf0b9a6c:\Program Files\NetMeeting\ibyqyajqi.aqjbriazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\Program Files\NetMeeting\jrrzqyjaa.aribriazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\Program Files\NetMeeting\qabijrazy.iyabriazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Outlook Express\briazzzar.ibyzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Outlook Express\jzbyjayay.arazzar.iby
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Outlook Express\yrabrrara.rqqzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Outlook Express\zarrrziii.rrqzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\Program Files\WinPcap\jzbyjayay.arazbzbyqq.jby.rrqy
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Windows Media Player\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Windows Media Player\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Windows Media Player\qabijrazy.iyaiby
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Windows NT\Accessories\zarrrziii.rrqy
faa1fde004b3c60b5a8068a7c3aab151c:\Program Files\Windows NT\Pinball\PINBALL.EXE
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Windows NT\Pinball\jyzbzbyqq.jby.rrqy
faa1fde004b3c60b5a8068a7c3aab151c:\Program Files\Windows NT\Pinball\pinball.exe
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Windows NT\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Wireshark\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Wireshark\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Wireshark\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Wireshark\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Wireshark\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\Program Files\Wireshark\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\$NtUninstallKB898461$\spuninst\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\$hf_mig$\KB898461\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\$hf_mig$\KB898461\update\qabijrazy.iya.rrqy
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\Microsoft.NET\Framework\jrrzqyjaa.ari
5e28284f9b5f9097640d58a73d38ad4cc:\WINDOWS\NOTEPAD.EXE
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\Network Diagnostic\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\ime\imjp8_1\briazzzar.iby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\ime\imjp8_1\ibyqyajqi.aqj
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\ime\imjp8_1\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\ime\imjp8_1\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\ime\imjp8_1\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\ime\imjp8_1\qabijrazy.iya
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\ime\imjp8_1\yrabrrara.rqq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\ime\imkr6_1\zarrrziii.rrq
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\inf\jyzbzbyqq.jby
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\jzbyjayay.ara
5e28284f9b5f9097640d58a73d38ad4cc:\WINDOWS\notepad.exe
b32a4db8fa8ba07afb1e86f8c9fb852ec:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\pchealth\helpctr\binaries\briazzzar.iby
b32a4db8fa8ba07afb1e86f8c9fb852ec:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\pchealth\helpctr\binaries\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\WINDOWS\xwrm.exe
36ac972f817f6e29001098099cf0b9a6c:\totalcmd\jrrzqyjaa.ari
36ac972f817f6e29001098099cf0b9a6c:\totalcmd\jzbyjayay.ara
36ac972f817f6e29001098099cf0b9a6c:\totalcmd\zarrrziii.rrq

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    jrrzqyjaa.ari:1056
    jrrzqyjaa.ari:840
    %original file name%.exe:588

  2. Delete the original Virus file.
  3. Delete or disinfect the following files created/modified by the Virus:

    %Documents and Settings%\%current user%\Local Settings\Temp\aarjbr.rzri.rir (44 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\irbqyj.zyai.rir (44 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\jrrzqyjaa.ari (44 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\briazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\qabijrazy.iya (44 bytes)
    %WinDir%\ime\imjp8_1\jyzbzbyqq.jby (44 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\jyzbzbyqq.jby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\yrabrrara.rqq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\qabijrazy.iya (44 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\ibyqyajqi.aqj (44 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\jyzbzbyqq.jby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\jzbyjayay.ara (44 bytes)
    %Program Files%\NetMeeting\ibyqyajqi.aqjbriazzzar.iby (44 bytes)
    %WinDir%\inf\jyzbzbyqq.jby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\jrrzqyjaa.ari (44 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\yrabrrara.rqq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\ibyqyajqi.aqj (44 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\zarrrziii.rrq (44 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\ibyqyajqi.aqj (44 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\jrrzqyjaa.ari (44 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jyzbzbyqq.jby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\briazzzar.iby (44 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\briazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\ibyqyajqi.aqj (44 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\jrrzqyjaa.ari (44 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\ibyqyajqi.aqj (44 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\jrrzqyjaa.ari (44 bytes)
    %Program Files%\WinPcap\jzbyjayay.arazbzbyqq.jby.rrqy (44 bytes)
    %Program Files%\Outlook Express\yrabrrara.rqqzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\jrrzqyjaa.ari (44 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\briazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\ibyqyajqi.aqj (44 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\zarrrziii.rrq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\yrabrrara.rqq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\jzbyjayay.ara (44 bytes)
    %WinDir%\ime\imjp8_1\briazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\yrabrrara.rqq (44 bytes)
    %Program Files%\Outlook Express\jzbyjayay.arazzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\zarrrziii.rrq (44 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\qabijrazy.iya (44 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\zarrrziii.rrq (44 bytes)
    %WinDir%\ime\imkr6_1\zarrrziii.rrq (44 bytes)
    %WinDir%\$hf_mig$\KB898461\briazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\zarrrziii.rrq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\briazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\zarrrziii.rrq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\qabijrazy.iya (44 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\jzbyjayay.ara (44 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\zarrrziii.rrq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\jzbyjayay.ara (44 bytes)
    %Program Files%\Windows Media Player\ibyqyajqi.aqj (44 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jzbyjayay.ara (44 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\briazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\briazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\jyzbzbyqq.jby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\briazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\qabijrazy.iya (44 bytes)
    %Program Files%\Windows NT\Pinball\jyzbzbyqq.jby.rrqy (44 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\jyzbzbyqq.jby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\jyzbzbyqq.jby (44 bytes)
    %WinDir%\ime\imjp8_1\jzbyjayay.ara (44 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\jzbyjayay.ara (44 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\qabijrazy.iya (44 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\zarrrziii.rrq (44 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yrabrrara.rqq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\yrabrrara.rqq (44 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\jzbyjayay.ara (44 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\yrabrrara.rqq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\jyzbzbyqq.jby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\jyzbzbyqq.jby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\zarrrziii.rrq (44 bytes)
    C:\totalcmd\zarrrziii.rrq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\jzbyjayay.ara (44 bytes)
    %WinDir%\ime\imjp8_1\qabijrazy.iya (44 bytes)
    %Program Files%\MSN Gaming Zone\Windows\jzbyjayay.araq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\qabijrazy.iya (44 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\qabijrazy.iya (44 bytes)
    %Program Files%\Outlook Express\zarrrziii.rrqzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\jyzbzbyqq.jby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\jrrzqyjaa.ari (44 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\jzbyjayay.ara (44 bytes)
    %WinDir%\$NtUninstallKB898461$\spuninst\ibyqyajqi.aqj (44 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\ibyqyajqi.aqj (44 bytes)
    %Program Files%\Windows Media Player\jrrzqyjaa.ari (44 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zarrrziii.rrq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\jrrzqyjaa.ari (44 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\zarrrziii.rrq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\briazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\qabijrazy.iya (44 bytes)
    %Program Files%\Common Files\Adobe\Updater6\jyzbzbyqq.jby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\ibyqyajqi.aqj (44 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\yrabrrara.rqq (44 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\jrrzqyjaa.ari (44 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\yrabrrara.rqq (44 bytes)
    %WinDir%\jzbyjayay.ara (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\yrabrrara.rqq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\jzbyjayay.ara (44 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\briazzzar.iby (44 bytes)
    %WinDir%\Microsoft.NET\Framework\jrrzqyjaa.ari (44 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\zarrrziii.rrq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\yrabrrara.rqq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\jrrzqyjaa.ari (44 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\ibyqyajqi.aqj (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\jrrzqyjaa.ari (44 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qabijrazy.iya (44 bytes)
    %Program Files%\NetMeeting\jrrzqyjaa.aribriazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\jyzbzbyqq.jby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\qabijrazy.iya (44 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\ibyqyajqi.aqj (44 bytes)
    %Program Files%\MSN Gaming Zone\Windows\briazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\briazzzar.iby (44 bytes)
    %Program Files%\Common Files\Microsoft Shared\MSInfo\qabijrazy.iya (44 bytes)
    %Program Files%\MSN Gaming Zone\Windows\yrabrrara.rqqq (44 bytes)
    %WinDir%\ime\imjp8_1\jrrzqyjaa.ari (44 bytes)
    %WinDir%\pchealth\helpctr\binaries\briazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\briazzzar.iby (44 bytes)
    %Program Files%\Outlook Express\briazzzar.ibyzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\jzbyjayay.ara (44 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\jyzbzbyqq.jby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\zarrrziii.rrq (44 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\briazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\jyzbzbyqq.jby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\jzbyjayay.ara (44 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\ibyqyajqi.aqj (44 bytes)
    %Program Files%\MSN Gaming Zone\Windows\jyzbzbyqq.jbyq (44 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\jzbyjayay.ara (44 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\qabijrazy.iya (44 bytes)
    %WinDir%\xwrm.exe (44 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\zarrrziii.rrq (44 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\zarrrziii.rrq (44 bytes)
    %WinDir%\pchealth\helpctr\binaries\jrrzqyjaa.ari (44 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\briazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\zarrrziii.rrq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\jrrzqyjaa.ari (44 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\jrrzqyjaa.ari (44 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\jrrzqyjaa.ari (44 bytes)
    C:\totalcmd\jzbyjayay.ara (44 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\ibyqyajqi.aqj (44 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ayrrab.aiai.rir (44 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\briazzzar.iby (44 bytes)
    %Program Files%\Windows Media Player\qabijrazy.iyaiby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\ibyqyajqi.aqj (44 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\qabijrazy.iya (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\yrabrrara.rqq (44 bytes)
    %Program Files%\Windows NT\Accessories\zarrrziii.rrqy (44 bytes)
    %Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\briazzzar.ibyzy.iyazzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\yrabrrara.rqq (44 bytes)
    %WinDir%\ime\imjp8_1\yrabrrara.rqq (44 bytes)
    %WinDir%\ime\imjp8_1\ibyqyajqi.aqj (44 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\ibyqyajqi.aqj (44 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\jrrzqyjaa.ari (44 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\qabijrazy.iya (44 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\qabijrazy.iyazzar.iby (44 bytes)
    %Program Files%\Windows NT\yrabrrara.rqq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\ibyqyajqi.aqj (44 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\jzbyjayay.ara (44 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\qabijrazy.iya (44 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\yrabrrara.rqq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\jyzbzbyqq.jby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\briazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\jzbyjayay.ara (44 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\jzbyjayay.ara (44 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\zarrrziii.rrq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\yrabrrara.rqq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\jyzbzbyqq.jby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\jrrzqyjaa.ari (44 bytes)
    %Program Files%\NetMeeting\qabijrazy.iyabriazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\yrabrrara.rqq (44 bytes)
    %WinDir%\$hf_mig$\KB898461\update\qabijrazy.iya.rrqy (44 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\ibyqyajqi.aqj (44 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\zarrrziii.rrq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\briazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\briazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\qabijrazy.iya (44 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\yrabrrara.rqq (44 bytes)
    %WinDir%\Network Diagnostic\jyzbzbyqq.jby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\briazzzar.iby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\yrabrrara.rqq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\jyzbzbyqq.jby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\jzbyjayay.ara (44 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\qabijrazy.iya (44 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\qabijrazy.iya (44 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\ibyqyajqi.aqj (44 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\jzbyjayay.ara (44 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\jyzbzbyqq.jby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\zarrrziii.rrq (44 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\jrrzqyjaa.ari (44 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\jyzbzbyqq.jby (44 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\ibyqyajqi.aqj (44 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\ibyqyajqi.aqj (44 bytes)
    C:\totalcmd\jrrzqyjaa.ari (44 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "x32x" = "%WinDir%\xwrm.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
jqqaybza4096409615360.476076cea23d7b527fadca8e74d7376c57659a
airqqjzb819232768322565.0983dea9750336f424c141e25edac2533c44
qajqrzqy4096040965120.46801303990ce32513f25d3855296b7bc8aa4d
jaaariza45056409620483.924736481060bb77e469e5fdb95d8e5c6ab31

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Virus connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_588:

\xwrm.exe

\xwrm.exe

%WinDir%\xwrm.exe

%WinDir%\xwrm.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

USER %s 8 * :%s

USER %s 8 * :%s

NICK %s

NICK %s

PONG %s

PONG %s

JOIN #england

JOIN #england

PRIVMSG #england :.-:[X-Worm]:-.

PRIVMSG #england :.-:[X-Worm]:-.

irc.undernet.org

irc.undernet.org

MAIL FROM:<%s>

MAIL FROM:<%s>

RCPT TO:<%s>

RCPT TO:<%s>

--%s--

--%s--

From:<%s>

From:<%s>

To: %s

To: %s

Subject:%s

Subject:%s

boundary="%s"

boundary="%s"

X-Mailer: Microsoft Outlook Express 6.00.2800.1106

X-Mailer: Microsoft Outlook Express 6.00.2800.1106

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

charset="windows-1255"

charset="windows-1255"

name= "%s%s"

name= "%s%s"

Content-Disposition: attachment; filename="%s%s"

Content-Disposition: attachment; filename="%s%s"

Support

Support

No.reply

No.reply

8.txtt:

8.txtt:

8.htmt2

8.htmt2

8.rtft*

8.rtft*

8.doct"

8.doct"

8.bdxt

8.bdxt

8.phpt

8.phpt

8.jspt

8.jspt

8.cgit

8.cgit

smtp

smtp

ws2_32.dll

ws2_32.dll

HTTP 200 OK

HTTP 200 OK

server. Please contact the web site administrator.

server. Please contact the web site administrator.

ADVAPI32.DLL

ADVAPI32.DLL

RegOpenKeyExA

RegOpenKeyExA

RegCloseKey

RegCloseKey

User32.dll

User32.dll

adrot.txt

adrot.txt

cts.bat

cts.bat

aa58-4c8e-a8ea-3cad7c47ab03

aa58-4c8e-a8ea-3cad7c47ab03

8.exe

8.exe

8.scrtt

8.scrtt

8.avitJ

8.avitJ

8.doctB

8.doctB

8.mp3t:

8.mp3t:

8.mpgt2

8.mpgt2

8.xlst*

8.xlst*

8.jpgt"

8.jpgt"

8.zipt

8.zipt

8.isot

8.isot

8.pdft

8.pdft

8.pptt

8.pptt

8.rart

8.rart

c:\WINDOWS\_default.pif

c:\WINDOWS\_default.pif

stem.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll

stem.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll

nSolicitedRCUI.htm

nSolicitedRCUI.htm

rs.Soap.dll

rs.Soap.dll

SFC.DLL

SFC.DLL

WinExec

WinExec

briazzzar.iby

briazzzar.iby

c:\WINDOWS\briazzzar.iby

c:\WINDOWS\briazzzar.iby

bution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\yrabrrara.rqq

bution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\yrabrrara.rqq

zzar.iby

zzar.iby

ReadMe.exe

ReadMe.exe

c:\%original file name%.exe

c:\%original file name%.exe

t Menu\Programs\Startup\kluBQ3lDn.exe

t Menu\Programs\Startup\kluBQ3lDn.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ayrrab.aiai.rir

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ayrrab.aiai.rir

GetWindowsDirectoryA

GetWindowsDirectoryA

FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj

FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj

KERNEL32.dll

KERNEL32.dll


Related articles