Skip to main content

Trojan.Crypt.DW_3d234f614c


Susp_Dropper (Kaspersky), Trojan.Crypt.DW (B) (Emsisoft), Trojan.Crypt.DW (AdAware), GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)Behaviour: Trojan, Worm, EmailWorm, IRCBot

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 3d234f614cb4d722277d0db57503cab0

SHA1: 6f74a1b8f4cb2c333429cb4a5845da5b9445667c

SHA256: 39e1d4540b17d56fc130fa5d6ae353db6bfe558406b42988b41dad8d162a0532

SSDeep: 768:Cei5qjujnzIG/opNpuixijKS6ezRJVV/:Chqaj5/opNpzxudf

Size: 43008 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2013-07-22 16:14:18

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour Description
EmailWormWorm can send e-mails.
IRCBotA bot can communicate with command and control servers via IRC channel.


Process activity

The Trojan creates the following process(es):

rzqyjaaar.iza:1132
rzqyjaaar.iza:1704
%original file name%.exe:1596

The Trojan injects its code into the following process(es):No processes have been created.

File activity

The process rzqyjaaar.iza:1132 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zjrrjy.azby.ibb (43 bytes)

The process rzqyjaaar.iza:1704 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\yirbza.bjry.ibb (43 bytes)

The process %original file name%.exe:1596 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Program Files%\MSN Gaming Zone\Windows\iazzzarib.yqa (43 bytes)
%Program Files%\NetMeeting\bijrazyiy.aibiazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\yqyajqiaq.jjr (43 bytes)
C:\totalcmd\byjayayar.abr (43 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\zbzbyqqjb.yjz (43 bytes)
%WinDir%\ime\imkr6_1\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\byjayayar.abr (43 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\iazzzarib.yqa (43 bytes)
%WinDir%\Network Diagnostic\zbzbyqqjb.yjz (43 bytes)
%Program Files%\Outlook Express\rrrziiirr.qyrarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\rzqyjaaar.iza (43 bytes)
%Program Files%\NetMeeting\yqyajqiaq.jjriazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\bijrazyiy.aib (43 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\yqyajqiaq.jjr (43 bytes)
%Program Files%\Outlook Express\byjayayar.abrarib.yqa (43 bytes)
%WinDir%\ime\imjp8_1\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\byjayayar.abr (43 bytes)
%Program Files%\WinPcap\byjayayar.abrzbyqqjb.yjz.qyra (43 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\yqyajqiaq.jjr (43 bytes)
%WinDir%\pchealth\helpctr\binaries\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\bijrazyiy.aib (43 bytes)
%WinDir%\ime\imjp8_1\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\zbzbyqqjb.yjz (43 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\yqyajqiaq.jjr (43 bytes)
%Program Files%\Common Files\Adobe\Updater6\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\byjayayar.abr (43 bytes)
%Program Files%\Windows NT\Pinball\zbzbyqqjb.yjz.qyra (43 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\zbzbyqqjb.yjz (43 bytes)
%Program Files%\MSN Gaming Zone\Windows\byjayayar.abrr (43 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\zbzbyqqjb.yjz (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\zbzbyqqjb.yjz (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\bijrazyiy.aib (43 bytes)
C:\totalcmd\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\rzqyjaaar.iza (43 bytes)
%WinDir%\$hf_mig$\KB898461\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\abrrararq.qjy (43 bytes)
%WinDir%\$hf_mig$\KB898461\update\bijrazyiy.aib.qyra (43 bytes)
%WinDir%\ime\imjp8_1\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\abrrararq.qjy (43 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\iazzzarib.yqaiy.aibarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\abrrararq.qjy (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\abrrararq.qjy (43 bytes)
%WinDir%\inf\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\bijrazyiy.aib (43 bytes)
%Program Files%\MSN Gaming Zone\Windows\zbzbyqqjb.yjzr (43 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\bijrazyiy.aib (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yqyajqiaq.jjr (43 bytes)
%Program Files%\Windows Media Player\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\abrrararq.qjy (43 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\zbzbyqqjb.yjz (43 bytes)
%Program Files%\Windows Media Player\bijrazyiy.aibyqa (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\iazzzarib.yqa (43 bytes)
%Program Files%\MSN Gaming Zone\Windows\abrrararq.qjyr (43 bytes)
%WinDir%\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\iazzzarib.yqa (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjayayar.abr (43 bytes)
%WinDir%\xwrm.exe (43 bytes)
%Program Files%\Outlook Express\abrrararq.qjyarib.yqa (43 bytes)
%WinDir%\Microsoft.NET\Framework\rzqyjaaar.iza (43 bytes)
%Program Files%\Windows NT\Accessories\rrrziiirr.qyra (43 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\zbzbyqqjb.yjz (43 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\bijrazyiy.aib (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\bijrazyiy.aibarib.yqa (43 bytes)
%WinDir%\ime\imjp8_1\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\rzqyjaaar.iza (43 bytes)
%Program Files%\NetMeeting\rzqyjaaar.izaiazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\bijrazyiy.aib (43 bytes)
%WinDir%\ime\imjp8_1\yqyajqiaq.jjr (43 bytes)
C:\totalcmd\rzqyjaaar.iza (43 bytes)
%WinDir%\pchealth\helpctr\binaries\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\abrrararq.qjy (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\yqyajqiaq.jjr (43 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\iazzzarib.yqa (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\rrrziiirr.qyr (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\yqyajqiaq.jjr (43 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\rzqyjaaar.iza (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\zbzbyqqjb.yjz (43 bytes)
%Program Files%\Windows Media Player\yqyajqiaq.jjr (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rzrqrb.jaay.ibb (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr (43 bytes)
%WinDir%\ime\imjp8_1\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\iazzzarib.yqa (43 bytes)
%Program Files%\Windows NT\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\yqyajqiaq.jjr (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\iazzzarib.yqa (43 bytes)
%WinDir%\ime\imjp8_1\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\byjayayar.abr (43 bytes)
%Program Files%\Outlook Express\iazzzarib.yqaarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\bijrazyiy.aib (43 bytes)

Registry activity

The process %original file name%.exe:1596 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:


To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"

Dropped PE files

MD5 File path
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\bijrazyiy.aibarib.yqa
cf0a0e7a3db0e3bc8ab1f26e81d71aa7c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\rzrqrb.jaay.ibb
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Perl\bin\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Perl\bin\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Perl\bin\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Adobe\Reader 9.0\Reader\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Adobe\Reader 9.0\Reader\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Adobe\Reader 9.0\Reader\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Adobe\Reader 9.0\Reader\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Adobe\Reader 9.0\Reader\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\iazzzarib.yqaiy.aibarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Common Files\Adobe\ARM\1.0\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Common Files\Adobe\ARM\1.0\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Common Files\Adobe\ARM\1.0\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Common Files\Adobe\Updater6\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Common Files\Microsoft Shared\DW\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Common Files\Microsoft Shared\DW\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Common Files\Microsoft Shared\MSInfo\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\MSN Gaming Zone\Windows\abrrararq.qjyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\MSN Gaming Zone\Windows\byjayayar.abrr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\MSN Gaming Zone\Windows\iazzzarib.yqa
5ac6cd4642fc24dc829bf5025a557efbc:\Program Files\MSN Gaming Zone\Windows\zClientm.exe
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\MSN Gaming Zone\Windows\zbzbyqqjb.yjzr
5ac6cd4642fc24dc829bf5025a557efbc:\Program Files\MSN Gaming Zone\Windows\zclientm.exe
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\NetMeeting\bijrazyiy.aibiazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\NetMeeting\rzqyjaaar.izaiazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\NetMeeting\yqyajqiaq.jjriazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Outlook Express\abrrararq.qjyarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Outlook Express\byjayayar.abrarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Outlook Express\iazzzarib.yqaarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Outlook Express\rrrziiirr.qyrarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\WinPcap\byjayayar.abrzbyqqjb.yjz.qyra
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Windows Media Player\bijrazyiy.aibyqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Windows Media Player\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Windows Media Player\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Windows NT\Accessories\rrrziiirr.qyra
faa1fde004b3c60b5a8068a7c3aab151c:\Program Files\Windows NT\Pinball\PINBALL.EXE
faa1fde004b3c60b5a8068a7c3aab151c:\Program Files\Windows NT\Pinball\pinball.exe
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Windows NT\Pinball\zbzbyqqjb.yjz.qyra
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Windows NT\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Wireshark\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Wireshark\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Wireshark\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Wireshark\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Wireshark\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\Program Files\Wireshark\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\$NtUninstallKB898461$\spuninst\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\$hf_mig$\KB898461\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\$hf_mig$\KB898461\update\bijrazyiy.aib.qyra
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\Microsoft.NET\Framework\rzqyjaaar.iza
5e28284f9b5f9097640d58a73d38ad4cc:\WINDOWS\NOTEPAD.EXE
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\Network Diagnostic\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\ime\imjp8_1\abrrararq.qjy
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\ime\imjp8_1\bijrazyiy.aib
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\ime\imjp8_1\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\ime\imjp8_1\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\ime\imjp8_1\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\ime\imjp8_1\yqyajqiaq.jjr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\ime\imjp8_1\zbzbyqqjb.yjz
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\ime\imkr6_1\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\inf\zbzbyqqjb.yjz
5e28284f9b5f9097640d58a73d38ad4cc:\WINDOWS\notepad.exe
b32a4db8fa8ba07afb1e86f8c9fb852ec:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe
b32a4db8fa8ba07afb1e86f8c9fb852ec:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\pchealth\helpctr\binaries\iazzzarib.yqa
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\pchealth\helpctr\binaries\rzqyjaaar.iza
b12d32b0a7cbc7eb56a1c34b6a495a11c:\WINDOWS\xwrm.exe
b12d32b0a7cbc7eb56a1c34b6a495a11c:\totalcmd\byjayayar.abr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\totalcmd\rrrziiirr.qyr
b12d32b0a7cbc7eb56a1c34b6a495a11c:\totalcmd\rzqyjaaar.iza

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    rzqyjaaar.iza:1132
    rzqyjaaar.iza:1704
    %original file name%.exe:1596

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Temp\zjrrjy.azby.ibb (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\yirbza.bjry.ibb (43 bytes)
    %Program Files%\MSN Gaming Zone\Windows\iazzzarib.yqa (43 bytes)
    %Program Files%\NetMeeting\bijrazyiy.aibiazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\yqyajqiaq.jjr (43 bytes)
    C:\totalcmd\byjayayar.abr (43 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\ime\imkr6_1\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\byjayayar.abr (43 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\iazzzarib.yqa (43 bytes)
    %WinDir%\Network Diagnostic\zbzbyqqjb.yjz (43 bytes)
    %Program Files%\Outlook Express\rrrziiirr.qyrarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\rzqyjaaar.iza (43 bytes)
    %Program Files%\NetMeeting\yqyajqiaq.jjriazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\bijrazyiy.aib (43 bytes)
    %Program Files%\Common Files\Microsoft Shared\MSInfo\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\yqyajqiaq.jjr (43 bytes)
    %Program Files%\Outlook Express\byjayayar.abrarib.yqa (43 bytes)
    %WinDir%\ime\imjp8_1\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\byjayayar.abr (43 bytes)
    %Program Files%\WinPcap\byjayayar.abrzbyqqjb.yjz.qyra (43 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\yqyajqiaq.jjr (43 bytes)
    %WinDir%\pchealth\helpctr\binaries\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\bijrazyiy.aib (43 bytes)
    %WinDir%\ime\imjp8_1\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\$NtUninstallKB898461$\spuninst\yqyajqiaq.jjr (43 bytes)
    %Program Files%\Common Files\Adobe\Updater6\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\byjayayar.abr (43 bytes)
    %Program Files%\Windows NT\Pinball\zbzbyqqjb.yjz.qyra (43 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\zbzbyqqjb.yjz (43 bytes)
    %Program Files%\MSN Gaming Zone\Windows\byjayayar.abrr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\zbzbyqqjb.yjz (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\bijrazyiy.aib (43 bytes)
    C:\totalcmd\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\rzqyjaaar.iza (43 bytes)
    %WinDir%\$hf_mig$\KB898461\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\abrrararq.qjy (43 bytes)
    %WinDir%\$hf_mig$\KB898461\update\bijrazyiy.aib.qyra (43 bytes)
    %WinDir%\ime\imjp8_1\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\abrrararq.qjy (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\iazzzarib.yqaiy.aibarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\abrrararq.qjy (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\abrrararq.qjy (43 bytes)
    %WinDir%\inf\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\bijrazyiy.aib (43 bytes)
    %Program Files%\MSN Gaming Zone\Windows\zbzbyqqjb.yjzr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\bijrazyiy.aib (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yqyajqiaq.jjr (43 bytes)
    %Program Files%\Windows Media Player\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\abrrararq.qjy (43 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\zbzbyqqjb.yjz (43 bytes)
    %Program Files%\Windows Media Player\bijrazyiy.aibyqa (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\iazzzarib.yqa (43 bytes)
    %Program Files%\MSN Gaming Zone\Windows\abrrararq.qjyr (43 bytes)
    %WinDir%\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\iazzzarib.yqa (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjayayar.abr (43 bytes)
    %WinDir%\xwrm.exe (43 bytes)
    %Program Files%\Outlook Express\abrrararq.qjyarib.yqa (43 bytes)
    %WinDir%\Microsoft.NET\Framework\rzqyjaaar.iza (43 bytes)
    %Program Files%\Windows NT\Accessories\rrrziiirr.qyra (43 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\zbzbyqqjb.yjz (43 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\bijrazyiy.aib (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\bijrazyiy.aibarib.yqa (43 bytes)
    %WinDir%\ime\imjp8_1\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\rzqyjaaar.iza (43 bytes)
    %Program Files%\NetMeeting\rzqyjaaar.izaiazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\bijrazyiy.aib (43 bytes)
    %WinDir%\ime\imjp8_1\yqyajqiaq.jjr (43 bytes)
    C:\totalcmd\rzqyjaaar.iza (43 bytes)
    %WinDir%\pchealth\helpctr\binaries\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\abrrararq.qjy (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\yqyajqiaq.jjr (43 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\iazzzarib.yqa (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\rrrziiirr.qyr (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\yqyajqiaq.jjr (43 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\rzqyjaaar.iza (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\zbzbyqqjb.yjz (43 bytes)
    %Program Files%\Windows Media Player\yqyajqiaq.jjr (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\rzrqrb.jaay.ibb (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr (43 bytes)
    %WinDir%\ime\imjp8_1\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\iazzzarib.yqa (43 bytes)
    %Program Files%\Windows NT\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\yqyajqiaq.jjr (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\iazzzarib.yqa (43 bytes)
    %WinDir%\ime\imjp8_1\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\byjayayar.abr (43 bytes)
    %Program Files%\Outlook Express\iazzzarib.yqaarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\bijrazyiy.aib (43 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "x32x" = "%WinDir%\xwrm.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
jabrizzy4096409615360.709451457e142f7a8f3db84735b1d3246ff526
jazaybay819232768322565.092638ab677ffc7aaf41ae042ced3ee83563f
zjiajizb4096040965120.46801303990ce32513f25d3855296b7bc8aa4d
qajqrzqy45056409615364.6214f01c8d5210e46d751a98e8ff6343b08d

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1596:

\xwrm.exe

\xwrm.exe

%WinDir%\xwrm.exe

%WinDir%\xwrm.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

USER %s 8 * :%s

USER %s 8 * :%s

NICK %s

NICK %s

PONG %s

PONG %s

JOIN #england

JOIN #england

PRIVMSG #england :.-:[X-Worm]:-.

PRIVMSG #england :.-:[X-Worm]:-.

irc.undernet.org

irc.undernet.org

MAIL FROM:<%s>

MAIL FROM:<%s>

RCPT TO:<%s>

RCPT TO:<%s>

--%s--

--%s--

501 5.5.4 Invalid domain name

501 5.5.4 Invalid domain name

From:<%s>

From:<%s>

To: %s

To: %s

Subject:%s

Subject:%s

boundary="%s"

boundary="%s"

X-Mailer: Microsoft Outlook Express 6.00.2800.1106

X-Mailer: Microsoft Outlook Express 6.00.2800.1106

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

charset="windows-1255"

charset="windows-1255"

name= "%s%s"

name= "%s%s"

Content-Disposition: attachment; filename="%s%s"

Content-Disposition: attachment; filename="%s%s"

Support

Support

No.reply

No.reply

8.txtt:

8.txtt:

8.htmt2

8.htmt2

8.rtft*

8.rtft*

8.doct"

8.doct"

8.bdxt

8.bdxt

8.phpt

8.phpt

8.jspt

8.jspt

8.cgit

8.cgit

smtp

smtp

smtp.microsoft.com

smtp.microsoft.com

cpxlate@microsoft.com

cpxlate@microsoft.com

ws2_32.dll

ws2_32.dll

# Contact: cpxlate@microsoft.com

# Contact: cpxlate@microsoft.com

ADVAPI32.DLL

ADVAPI32.DLL

RegOpenKeyExA

RegOpenKeyExA

RegCloseKey

RegCloseKey

User32.dll

User32.dll

CP1251.txt

CP1251.txt

le_norm_bidi.spp

le_norm_bidi.spp

IX.txt

IX.txt

ion.pm

ion.pm

itions.pm

itions.pm

8.exe

8.exe

8.scrtt

8.scrtt

8.avitJ

8.avitJ

8.doctB

8.doctB

8.mp3t:

8.mp3t:

8.mpgt2

8.mpgt2

8.xlst*

8.xlst*

8.jpgt"

8.jpgt"

8.zipt

8.zipt

8.isot

8.isot

8.pdft

8.pdft

8.pptt

8.pptt

8.rart

8.rart

c:\WINDOWS\_default.pif

c:\WINDOWS\_default.pif

stem.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll

stem.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll

nSolicitedRCUI.htm

nSolicitedRCUI.htm

rs.Soap.dll

rs.Soap.dll

SFC.DLL

SFC.DLL

WinExec

WinExec

iazzzarib.yqa

iazzzarib.yqa

c:\WINDOWS\iazzzarib.yqa

c:\WINDOWS\iazzzarib.yqa

bution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\abrrararq.qjy

bution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\abrrararq.qjy

arib.yqa

arib.yqa

ReadMe.exe

ReadMe.exe

c:\%original file name%.exe

c:\%original file name%.exe

gMchd.exe

gMchd.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rzrqrb.jaay.ibb

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rzrqrb.jaay.ibb

GetWindowsDirectoryA

GetWindowsDirectoryA

FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj

FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj

KERNEL32.dll

KERNEL32.dll


Related articles