Skip to main content

Virus.Win32.Duel_e5e13257e6


Susp_Dropper (Kaspersky), DeepScan:Generic.Malware.SIM!g.7B96CA2B (B) (Emsisoft), DeepScan:Generic.Malware.SIM!g.7B96CA2B (AdAware), Virus.Win32.Duel.FD, GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)Behaviour: Worm, EmailWorm, Virus, IRCBot

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: e5e13257e66a614e338afaf50823a42c

SHA1: 76dfbd743921ba3e70152d596626748ab9cb8687

SHA256: e0043b6769084edc721757a5460f627e5abf610e82c824cc6f448bb6454825ce

SSDeep: 768:WLFYGJv5meMRPFRmRwRPIxukkjTcUiONylZx0q1CPxQBxTk2:grB6RPeLukkXSOolJ17x

Size: 50688 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company: Windows

Created at: no data

Analyzed on: WindowsXP SP3 32-bit

Summary: Virus. A program that recursively replicates a possibly evolved copy of itself.

Dynamic Analysis

Payload

Behaviour Description
EmailWormWorm can send e-mails.
IRCBotA bot can communicate with command and control servers via IRC channel.


Process activity

The Virus creates the following process(es):

%original file name%.exe:1224
rqyrabrra.rar:1652
rqyrabrra.rar:1644

The Virus injects its code into the following process(es):No processes have been created.

File activity

The process %original file name%.exe:1224 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Program Files%\Windows Media Player\qjjrrzqyj.aaa (50 bytes)
%Program Files%\Windows NT\Accessories\rqyrabrra.rari (50 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\rarqqjyzb.zby (50 bytes)
%WinDir%\pchealth\helpctr\binaries\aaarizarr.rzi (50 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\aaarizarr.rzi (50 bytes)
%Program Files%\Windows Media Player\rizarrrzi.iir (50 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\aaarizarr.rzi (50 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\zyiyaibyq.yaj (50 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rizarrrzi.iir (50 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\ayarabria.zzz (50 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\aribyqabi.jra (50 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rizarrrzi.iir (50 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rabriazzz.ari (50 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\qiaqjjrrz.qyj (50 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\iirrqyrab.rra (50 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\qiaqjjrrz.qyj (50 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yaibyqyaj.qia (50 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\aribyqabi.jra (50 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\ayarabria.zzz (50 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\zyiyaibyq.yaj (50 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\qqjbyjzby.jay (50 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\aaarizarr.rzi (50 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\iirrqyrab.rra (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\qjjrrzqyj.aaaqyaj.qia (50 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\zyiyaibyq.yaj (50 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\rarqqjyzb.zby (50 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\aribyqabi.jra (50 bytes)
%Program Files%\Windows Media Player\yaibyqyaj.qiazyi (50 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qqjyzbzby.qqj (50 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\zyiyaibyq.yaj (50 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\aaarizarr.rzi (50 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\aaarizarr.rzi (50 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\rarqqjyzb.zby (50 bytes)
%WinDir%\ime\imkr6_1\rqyrabrra.rar (50 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\rarqqjyzb.zby (50 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\iirrqyrab.rra (50 bytes)
%WinDir%\Microsoft.NET\Framework\yraraajjr.qzi (50 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\iirrqyrab.rra (50 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\qqjbyjzby.jay (50 bytes)
%Program Files%\Outlook Express\qqjyzbzby.qqjijra.zyi (50 bytes)
%WinDir%\ime\imjp8_1\byjzbyjay.aya (50 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\rarqqjyzb.zby (50 bytes)
C:\totalcmd\rabriazzz.ari (50 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\aaarizarr.rzi (50 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\aaarizarr.rzi (50 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rabriazzz.ari (50 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\zyiyaibyq.yaj (50 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\iirrqyrab.rra (50 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\iirrqyrab.rra (50 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\aaarizarr.rzi (50 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yaibyqyaj.qia (50 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\qiaqjjrrz.qyj (50 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\qqjbyjzby.jay (50 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\aaarizarr.rzi (50 bytes)
%Program Files%\Outlook Express\byqabijra.zyiijra.zyi (50 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\qiaqjjrrz.qyj (50 bytes)
%WinDir%\ime\imjp8_1\byqabijra.zyi (50 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\ayarabria.zzz (50 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\ayarabria.zzz (50 bytes)
%WinDir%\$hf_mig$\KB898461\byqabijra.zyi (50 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\ayarabria.zzz (50 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\qqjbyjzby.jay (50 bytes)
%Program Files%\Outlook Express\rqyrabrra.rarijra.zyi (50 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\qjjrrzqyj.aaa (50 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\aaarizarr.rzi (50 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\qiaqjjrrz.qyj (50 bytes)
C:\totalcmd\rqyrabrra.rar (50 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qjjrrzqyj.aaa (50 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\aribyqabi.jra (50 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\aribyqabi.jra (50 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\rarqqjyzb.zby (50 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\aaarizarr.rzi (50 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\qiaqjjrrz.qyj (50 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\aribyqabi.jra (50 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\rarqqjyzb.zby (50 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\qiaqjjrrz.qyj (50 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\zyiyaibyq.yaj (50 bytes)
%Program Files%\NetMeeting\qjjrrzqyj.aaabyqabijra.zyi (50 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\byqabijra.zyiyj.aaaqyaj.qia (50 bytes)
%Program Files%\NetMeeting\rizarrrzi.iirbyqabijra.zyi (50 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\qqjbyjzby.jay (50 bytes)
C:\totalcmd\rizarrrzi.iir (50 bytes)
%WinDir%\Network Diagnostic\qqjbyjzby.jay (50 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\aribyqabi.jra (50 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\ayarabria.zzz (50 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\ayarabria.zzz (50 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\qiaqjjrrz.qyj (50 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\rarqqjyzb.zby (50 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\ayarabria.zzz (50 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\yaibyqyaj.qia (50 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\rarqqjyzb.zby (50 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\ayarabria.zzz (50 bytes)
%WinDir%\ime\imjp8_1\rabriazzz.ari (50 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\qiaqjjrrz.qyj (50 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\iirrqyrab.rra (50 bytes)
%Program Files%\MSN Gaming Zone\Windows\byqabijra.zyi (50 bytes)
%WinDir%\inf\byjzbyjay.aya (50 bytes)
%WinDir%\$hf_mig$\KB898461\update\yaibyqyaj.qia.rari (50 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\aaarizarr.rzi (50 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byjzbyjay.aya (50 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\qqjbyjzby.jay (50 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\ayarabria.zzz (50 bytes)
%Program Files%\Common Files\Adobe\Updater6\byjzbyjay.aya (50 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\rarqqjyzb.zby (50 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byqabijra.zyi (50 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\zyiyaibyq.yaj (50 bytes)
%WinDir%\ayarabria.zzz (50 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\aribyqabi.jra (50 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\ayarabria.zzz (50 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\qqjbyjzby.jay (50 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\qqjbyjzby.jay (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\yaibyqyaj.qia (50 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\qiaqjjrrz.qyj (50 bytes)
%WinDir%\ime\imjp8_1\rizarrrzi.iir (50 bytes)
%Program Files%\NetMeeting\yaibyqyaj.qiabyqabijra.zyi (50 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\ayarabria.zzz (50 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rqyrabrra.rar (50 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\qqjbyjzby.jay (50 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\qiaqjjrrz.qyj (50 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\iirrqyrab.rra (50 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\zyiyaibyq.yaj (50 bytes)
%WinDir%\ime\imjp8_1\qqjyzbzby.qqj (50 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\rarqqjyzb.zby (50 bytes)
%Program Files%\WinPcap\rabriazzz.arijzbyjay.aya.rari (50 bytes)
%WinDir%\pchealth\helpctr\binaries\aribyqabi.jra (50 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\qqjbyjzby.jay (50 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\aribyqabi.jra (50 bytes)
%WinDir%\xwrm.exe (50 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\iirrqyrab.rra (50 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\qqjyzbzby.qqj (50 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjzbyjay.aya (50 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\ayarabria.zzz (50 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\rarqqjyzb.zby (50 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\qqjbyjzby.jay (50 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\iirrqyrab.rra (50 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\zyiyaibyq.yaj (50 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\aribyqabi.jra (50 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\aribyqabi.jra (50 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\aribyqabi.jra (50 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\aribyqabi.jra (50 bytes)
%WinDir%\ime\imjp8_1\yaibyqyaj.qia (50 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\qjjrrzqyj.aaa (50 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\qqjbyjzby.jay (50 bytes)
%Program Files%\Outlook Express\rabriazzz.ariijra.zyi (50 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\zyiyaibyq.yaj (50 bytes)
%Program Files%\MSN Gaming Zone\Windows\rabriazzz.arir (50 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\zyiyaibyq.yaj (50 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rqyrabrra.rar (50 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\qqjbyjzby.jay (50 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\aribyqabi.jra (50 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\zyiyaibyq.yaj (50 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\aribyqabi.jra (50 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\iirrqyrab.rra (50 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\yaibyqyaj.qia (50 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\qiaqjjrrz.qyj (50 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\ayarabria.zzz (50 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\iirrqyrab.rra (50 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\rarqqjyzb.zby (50 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\qqjbyjzby.jay (50 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\byqabijra.zyi (50 bytes)
%Program Files%\MSN Gaming Zone\Windows\byjzbyjay.ayar (50 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\rabriazzz.ari (50 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\zyiyaibyq.yaj (50 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\qiaqjjrrz.qyj (50 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\aaarizarr.rzi (50 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\iirrqyrab.rra (50 bytes)
%Program Files%\MSN Gaming Zone\Windows\qqjyzbzby.qqjr (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iirrjz.qbra.rib (50 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\aaarizarr.rzi (50 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\qiaqjjrrz.qyj (50 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\rarqqjyzb.zby (50 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\ayarabria.zzz (50 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\qiaqjjrrz.qyj (50 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\iirrqyrab.rra (50 bytes)
%WinDir%\ime\imjp8_1\qjjrrzqyj.aaa (50 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\aribyqabi.jra (50 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\qiaqjjrrz.qyj (50 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\aaarizarr.rzi (50 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\zyiyaibyq.yaj (50 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\qqjbyjzby.jay (50 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\aaarizarr.rzi (50 bytes)
%Program Files%\Windows NT\Pinball\byjzbyjay.aya.rari (50 bytes)
%Program Files%\Windows NT\qqjyzbzby.qqj (50 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\iirrqyrab.rra (50 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\zyiyaibyq.yaj (50 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\iirrqyrab.rra (50 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\rarqqjyzb.zby (50 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\rarqqjyzb.zby (50 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\zyiyaibyq.yaj (50 bytes)

The process rqyrabrra.rar:1652 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\yazrir.ajya.rib (50 bytes)

The process rqyrabrra.rar:1644 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jizjbr.jaja.rib (50 bytes)

Registry activity

The process %original file name%.exe:1224 makes changes in the system registry.


The Virus creates and/or sets the following values in system registry:


To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"

Dropped PE files

MD5 File path
3b37bb712a726e1d5c5d71aba276cb43c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\yaibyqyaj.qia
3b37bb712a726e1d5c5d71aba276cb43c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\qjjrrzqyj.aaaqyaj.qia
6c5f728350a544b7805cbb19ae048ec2c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\iirrjz.qbra.rib
3b37bb712a726e1d5c5d71aba276cb43c:\Perl\bin\byjzbyjay.aya
3b37bb712a726e1d5c5d71aba276cb43c:\Perl\bin\qqjyzbzby.qqj
3b37bb712a726e1d5c5d71aba276cb43c:\Perl\bin\rabriazzz.ari
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Adobe\Reader 9.0\Reader\byjzbyjay.aya
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Adobe\Reader 9.0\Reader\byqabijra.zyi
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Adobe\Reader 9.0\Reader\qqjyzbzby.qqj
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Adobe\Reader 9.0\Reader\rabriazzz.ari
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Adobe\Reader 9.0\Reader\rizarrrzi.iir
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Adobe\Reader 9.0\Reader\yaibyqyaj.qia
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\byqabijra.zyiyj.aaaqyaj.qia
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Common Files\Adobe\ARM\1.0\qjjrrzqyj.aaa
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Common Files\Adobe\ARM\1.0\rizarrrzi.iir
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Common Files\Adobe\ARM\1.0\rqyrabrra.rar
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Common Files\Adobe\ARM\1.0\yaibyqyaj.qia
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Common Files\Adobe\Updater6\byjzbyjay.aya
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Common Files\Microsoft Shared\DW\byqabijra.zyi
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Common Files\Microsoft Shared\DW\rabriazzz.ari
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Common Files\Microsoft Shared\MSInfo\yaibyqyaj.qia
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\MSN Gaming Zone\Windows\byjzbyjay.ayar
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\MSN Gaming Zone\Windows\byqabijra.zyi
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\MSN Gaming Zone\Windows\qqjyzbzby.qqjr
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\MSN Gaming Zone\Windows\rabriazzz.arir
5ac6cd4642fc24dc829bf5025a557efbc:\Program Files\MSN Gaming Zone\Windows\zClientm.exe
5ac6cd4642fc24dc829bf5025a557efbc:\Program Files\MSN Gaming Zone\Windows\zclientm.exe
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\NetMeeting\qjjrrzqyj.aaabyqabijra.zyi
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\NetMeeting\rizarrrzi.iirbyqabijra.zyi
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\NetMeeting\yaibyqyaj.qiabyqabijra.zyi
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Outlook Express\byqabijra.zyiijra.zyi
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Outlook Express\qqjyzbzby.qqjijra.zyi
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Outlook Express\rabriazzz.ariijra.zyi
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Outlook Express\rqyrabrra.rarijra.zyi
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\WinPcap\rabriazzz.arijzbyjay.aya.rari
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Windows Media Player\qjjrrzqyj.aaa
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Windows Media Player\rizarrrzi.iir
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Windows Media Player\yaibyqyaj.qiazyi
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Windows NT\Accessories\rqyrabrra.rari
faa1fde004b3c60b5a8068a7c3aab151c:\Program Files\Windows NT\Pinball\PINBALL.EXE
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Windows NT\Pinball\byjzbyjay.aya.rari
faa1fde004b3c60b5a8068a7c3aab151c:\Program Files\Windows NT\Pinball\pinball.exe
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Windows NT\qqjyzbzby.qqj
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Wireshark\byjzbyjay.aya
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Wireshark\qjjrrzqyj.aaa
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Wireshark\qqjyzbzby.qqj
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Wireshark\rizarrrzi.iir
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Wireshark\rqyrabrra.rar
3b37bb712a726e1d5c5d71aba276cb43c:\Program Files\Wireshark\yaibyqyaj.qia
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\$NtUninstallKB898461$\spuninst\qjjrrzqyj.aaa
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\$hf_mig$\KB898461\byqabijra.zyi
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\$hf_mig$\KB898461\update\yaibyqyaj.qia.rari
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjzbyjay.aya
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qjjrrzqyj.aaa
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qqjyzbzby.qqj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rabriazzz.ari
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rqyrabrra.rar
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yaibyqyaj.qia
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\Microsoft.NET\Framework\yraraajjr.qzi
5e28284f9b5f9097640d58a73d38ad4cc:\WINDOWS\NOTEPAD.EXE
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\Network Diagnostic\qqjbyjzby.jay
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\ayarabria.zzz
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\aribyqabi.jra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\qiaqjjrrz.qyj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\zyiyaibyq.yaj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\aaarizarr.rzi
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\iirrqyrab.rra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\ayarabria.zzz
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\qqjbyjzby.jay
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\rarqqjyzb.zby
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\aribyqabi.jra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\qiaqjjrrz.qyj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\zyiyaibyq.yaj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\aaarizarr.rzi
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\iirrqyrab.rra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\rarqqjyzb.zby
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\qqjbyjzby.jay
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\ayarabria.zzz
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\aribyqabi.jra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\qiaqjjrrz.qyj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\zyiyaibyq.yaj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\aaarizarr.rzi
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\iirrqyrab.rra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\rarqqjyzb.zby
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\qqjbyjzby.jay
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\ayarabria.zzz
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\aribyqabi.jra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\qiaqjjrrz.qyj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\zyiyaibyq.yaj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\iirrqyrab.rra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\aaarizarr.rzi
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\rarqqjyzb.zby
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\qqjbyjzby.jay
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\ayarabria.zzz
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\aribyqabi.jra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\zyiyaibyq.yaj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\qiaqjjrrz.qyj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\aaarizarr.rzi
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\iirrqyrab.rra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\rarqqjyzb.zby
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\qqjbyjzby.jay
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\ayarabria.zzz
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\aribyqabi.jra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\zyiyaibyq.yaj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\qiaqjjrrz.qyj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\aaarizarr.rzi
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\iirrqyrab.rra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\rarqqjyzb.zby
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\qqjbyjzby.jay
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\ayarabria.zzz
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\aribyqabi.jra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\zyiyaibyq.yaj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\qiaqjjrrz.qyj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\aaarizarr.rzi
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\iirrqyrab.rra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\rarqqjyzb.zby
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\qqjbyjzby.jay
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\ayarabria.zzz
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\aribyqabi.jra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\zyiyaibyq.yaj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\qiaqjjrrz.qyj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\aaarizarr.rzi
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\iirrqyrab.rra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\rarqqjyzb.zby
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\qqjbyjzby.jay
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\ayarabria.zzz
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\aribyqabi.jra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\zyiyaibyq.yaj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\qiaqjjrrz.qyj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\aaarizarr.rzi
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\iirrqyrab.rra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\rarqqjyzb.zby
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\qqjbyjzby.jay
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\ayarabria.zzz
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\aribyqabi.jra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\qiaqjjrrz.qyj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\zyiyaibyq.yaj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\aaarizarr.rzi
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\iirrqyrab.rra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\rarqqjyzb.zby
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\qqjbyjzby.jay
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\ayarabria.zzz
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\aribyqabi.jra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\qiaqjjrrz.qyj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\zyiyaibyq.yaj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\aaarizarr.rzi
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\iirrqyrab.rra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\rarqqjyzb.zby
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\qqjbyjzby.jay
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\ayarabria.zzz
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\aribyqabi.jra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\qiaqjjrrz.qyj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\zyiyaibyq.yaj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\aaarizarr.rzi
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\iirrqyrab.rra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\rarqqjyzb.zby
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\qqjbyjzby.jay
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\ayarabria.zzz
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\aribyqabi.jra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\qiaqjjrrz.qyj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\zyiyaibyq.yaj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\aaarizarr.rzi
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\iirrqyrab.rra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\rarqqjyzb.zby
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\qqjbyjzby.jay
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\ayarabria.zzz
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\aribyqabi.jra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\qiaqjjrrz.qyj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\zyiyaibyq.yaj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\aaarizarr.rzi
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\iirrqyrab.rra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\rarqqjyzb.zby
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\qqjbyjzby.jay
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\aribyqabi.jra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\zyiyaibyq.yaj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\qiaqjjrrz.qyj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\aaarizarr.rzi
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\iirrqyrab.rra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\rarqqjyzb.zby
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\qqjbyjzby.jay
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\ayarabria.zzz
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\aribyqabi.jra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\zyiyaibyq.yaj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\qiaqjjrrz.qyj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\aaarizarr.rzi
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\iirrqyrab.rra
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\rarqqjyzb.zby
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\ayarabria.zzz
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\ime\imjp8_1\byjzbyjay.aya
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\ime\imjp8_1\byqabijra.zyi
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\ime\imjp8_1\qjjrrzqyj.aaa
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\ime\imjp8_1\qqjyzbzby.qqj
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\ime\imjp8_1\rabriazzz.ari
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\ime\imjp8_1\rizarrrzi.iir
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\ime\imjp8_1\yaibyqyaj.qia
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\ime\imkr6_1\rqyrabrra.rar
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\inf\byjzbyjay.aya
5e28284f9b5f9097640d58a73d38ad4cc:\WINDOWS\notepad.exe
b32a4db8fa8ba07afb1e86f8c9fb852ec:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\pchealth\helpctr\binaries\aaarizarr.rzi
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\pchealth\helpctr\binaries\aribyqabi.jra
b32a4db8fa8ba07afb1e86f8c9fb852ec:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe
3b37bb712a726e1d5c5d71aba276cb43c:\WINDOWS\xwrm.exe
3b37bb712a726e1d5c5d71aba276cb43c:\totalcmd\rabriazzz.ari
3b37bb712a726e1d5c5d71aba276cb43c:\totalcmd\rizarrrzi.iir
3b37bb712a726e1d5c5d71aba276cb43c:\totalcmd\rqyrabrra.rar

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:1224
    rqyrabrra.rar:1652
    rqyrabrra.rar:1644

  2. Delete the original Virus file.
  3. Delete or disinfect the following files created/modified by the Virus:

    %Program Files%\Windows Media Player\qjjrrzqyj.aaa (50 bytes)
    %Program Files%\Windows NT\Accessories\rqyrabrra.rari (50 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\rarqqjyzb.zby (50 bytes)
    %WinDir%\pchealth\helpctr\binaries\aaarizarr.rzi (50 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\aaarizarr.rzi (50 bytes)
    %Program Files%\Windows Media Player\rizarrrzi.iir (50 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\aaarizarr.rzi (50 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\zyiyaibyq.yaj (50 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\rizarrrzi.iir (50 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\ayarabria.zzz (50 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\aribyqabi.jra (50 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\rizarrrzi.iir (50 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\rabriazzz.ari (50 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\qiaqjjrrz.qyj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\iirrqyrab.rra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\qiaqjjrrz.qyj (50 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yaibyqyaj.qia (50 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\aribyqabi.jra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\ayarabria.zzz (50 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\zyiyaibyq.yaj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\qqjbyjzby.jay (50 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\aaarizarr.rzi (50 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\iirrqyrab.rra (50 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\qjjrrzqyj.aaaqyaj.qia (50 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\zyiyaibyq.yaj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\rarqqjyzb.zby (50 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\aribyqabi.jra (50 bytes)
    %Program Files%\Windows Media Player\yaibyqyaj.qiazyi (50 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qqjyzbzby.qqj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\zyiyaibyq.yaj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\aaarizarr.rzi (50 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\aaarizarr.rzi (50 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\rarqqjyzb.zby (50 bytes)
    %WinDir%\ime\imkr6_1\rqyrabrra.rar (50 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\rarqqjyzb.zby (50 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\iirrqyrab.rra (50 bytes)
    %WinDir%\Microsoft.NET\Framework\yraraajjr.qzi (50 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\iirrqyrab.rra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\qqjbyjzby.jay (50 bytes)
    %Program Files%\Outlook Express\qqjyzbzby.qqjijra.zyi (50 bytes)
    %WinDir%\ime\imjp8_1\byjzbyjay.aya (50 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\rarqqjyzb.zby (50 bytes)
    C:\totalcmd\rabriazzz.ari (50 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\aaarizarr.rzi (50 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\aaarizarr.rzi (50 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rabriazzz.ari (50 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\zyiyaibyq.yaj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\iirrqyrab.rra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\iirrqyrab.rra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\aaarizarr.rzi (50 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\yaibyqyaj.qia (50 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\qiaqjjrrz.qyj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\qqjbyjzby.jay (50 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\aaarizarr.rzi (50 bytes)
    %Program Files%\Outlook Express\byqabijra.zyiijra.zyi (50 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\qiaqjjrrz.qyj (50 bytes)
    %WinDir%\ime\imjp8_1\byqabijra.zyi (50 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\ayarabria.zzz (50 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\ayarabria.zzz (50 bytes)
    %WinDir%\$hf_mig$\KB898461\byqabijra.zyi (50 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\ayarabria.zzz (50 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\qqjbyjzby.jay (50 bytes)
    %Program Files%\Outlook Express\rqyrabrra.rarijra.zyi (50 bytes)
    %WinDir%\$NtUninstallKB898461$\spuninst\qjjrrzqyj.aaa (50 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\aaarizarr.rzi (50 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\qiaqjjrrz.qyj (50 bytes)
    C:\totalcmd\rqyrabrra.rar (50 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qjjrrzqyj.aaa (50 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\aribyqabi.jra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\aribyqabi.jra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\rarqqjyzb.zby (50 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\aaarizarr.rzi (50 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\qiaqjjrrz.qyj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\aribyqabi.jra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\rarqqjyzb.zby (50 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\qiaqjjrrz.qyj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\zyiyaibyq.yaj (50 bytes)
    %Program Files%\NetMeeting\qjjrrzqyj.aaabyqabijra.zyi (50 bytes)
    %Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\byqabijra.zyiyj.aaaqyaj.qia (50 bytes)
    %Program Files%\NetMeeting\rizarrrzi.iirbyqabijra.zyi (50 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\qqjbyjzby.jay (50 bytes)
    C:\totalcmd\rizarrrzi.iir (50 bytes)
    %WinDir%\Network Diagnostic\qqjbyjzby.jay (50 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\aribyqabi.jra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\ayarabria.zzz (50 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\ayarabria.zzz (50 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\qiaqjjrrz.qyj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\rarqqjyzb.zby (50 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\ayarabria.zzz (50 bytes)
    %Program Files%\Common Files\Microsoft Shared\MSInfo\yaibyqyaj.qia (50 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\rarqqjyzb.zby (50 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\ayarabria.zzz (50 bytes)
    %WinDir%\ime\imjp8_1\rabriazzz.ari (50 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\qiaqjjrrz.qyj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\iirrqyrab.rra (50 bytes)
    %Program Files%\MSN Gaming Zone\Windows\byqabijra.zyi (50 bytes)
    %WinDir%\inf\byjzbyjay.aya (50 bytes)
    %WinDir%\$hf_mig$\KB898461\update\yaibyqyaj.qia.rari (50 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\aaarizarr.rzi (50 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\byjzbyjay.aya (50 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\qqjbyjzby.jay (50 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\ayarabria.zzz (50 bytes)
    %Program Files%\Common Files\Adobe\Updater6\byjzbyjay.aya (50 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\rarqqjyzb.zby (50 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\byqabijra.zyi (50 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\zyiyaibyq.yaj (50 bytes)
    %WinDir%\ayarabria.zzz (50 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\aribyqabi.jra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\ayarabria.zzz (50 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\qqjbyjzby.jay (50 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\qqjbyjzby.jay (50 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\yaibyqyaj.qia (50 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\qiaqjjrrz.qyj (50 bytes)
    %WinDir%\ime\imjp8_1\rizarrrzi.iir (50 bytes)
    %Program Files%\NetMeeting\yaibyqyaj.qiabyqabijra.zyi (50 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\ayarabria.zzz (50 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\rqyrabrra.rar (50 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\qqjbyjzby.jay (50 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\qiaqjjrrz.qyj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\iirrqyrab.rra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\zyiyaibyq.yaj (50 bytes)
    %WinDir%\ime\imjp8_1\qqjyzbzby.qqj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\rarqqjyzb.zby (50 bytes)
    %Program Files%\WinPcap\rabriazzz.arijzbyjay.aya.rari (50 bytes)
    %WinDir%\pchealth\helpctr\binaries\aribyqabi.jra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\qqjbyjzby.jay (50 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\aribyqabi.jra (50 bytes)
    %WinDir%\xwrm.exe (50 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\iirrqyrab.rra (50 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\qqjyzbzby.qqj (50 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjzbyjay.aya (50 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\ayarabria.zzz (50 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\rarqqjyzb.zby (50 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\qqjbyjzby.jay (50 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\iirrqyrab.rra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\zyiyaibyq.yaj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\aribyqabi.jra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\aribyqabi.jra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\aribyqabi.jra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\aribyqabi.jra (50 bytes)
    %WinDir%\ime\imjp8_1\yaibyqyaj.qia (50 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\qjjrrzqyj.aaa (50 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\qqjbyjzby.jay (50 bytes)
    %Program Files%\Outlook Express\rabriazzz.ariijra.zyi (50 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\zyiyaibyq.yaj (50 bytes)
    %Program Files%\MSN Gaming Zone\Windows\rabriazzz.arir (50 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\zyiyaibyq.yaj (50 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rqyrabrra.rar (50 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\qqjbyjzby.jay (50 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\aribyqabi.jra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\zyiyaibyq.yaj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\aribyqabi.jra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\iirrqyrab.rra (50 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\yaibyqyaj.qia (50 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\qiaqjjrrz.qyj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\ayarabria.zzz (50 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\iirrqyrab.rra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\rarqqjyzb.zby (50 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\qqjbyjzby.jay (50 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\byqabijra.zyi (50 bytes)
    %Program Files%\MSN Gaming Zone\Windows\byjzbyjay.ayar (50 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\rabriazzz.ari (50 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\zyiyaibyq.yaj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\qiaqjjrrz.qyj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\aaarizarr.rzi (50 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\iirrqyrab.rra (50 bytes)
    %Program Files%\MSN Gaming Zone\Windows\qqjyzbzby.qqjr (50 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\iirrjz.qbra.rib (50 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\aaarizarr.rzi (50 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\qiaqjjrrz.qyj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\rarqqjyzb.zby (50 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\ayarabria.zzz (50 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\qiaqjjrrz.qyj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\iirrqyrab.rra (50 bytes)
    %WinDir%\ime\imjp8_1\qjjrrzqyj.aaa (50 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\aribyqabi.jra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\qiaqjjrrz.qyj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\aaarizarr.rzi (50 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\zyiyaibyq.yaj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\qqjbyjzby.jay (50 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\aaarizarr.rzi (50 bytes)
    %Program Files%\Windows NT\Pinball\byjzbyjay.aya.rari (50 bytes)
    %Program Files%\Windows NT\qqjyzbzby.qqj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\iirrqyrab.rra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\zyiyaibyq.yaj (50 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\iirrqyrab.rra (50 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\rarqqjyzb.zby (50 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\rarqqjyzb.zby (50 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\zyiyaibyq.yaj (50 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\yazrir.ajya.rib (50 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\jizjbr.jaja.rib (50 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "x32x" = "%WinDir%\xwrm.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
yiyaibyq4096409615360.565461b46f711e790d844cda7d22127780d602
yajqiaqj819232768322564.79465491fca0b6cf94b86012b9a2e31e508a7
jrrzqyja4096040965120.46801303990ce32513f25d3855296b7bc8aa4d
aarizarr45056409620483.924736481060bb77e469e5fdb95d8e5c6ab31

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Virus connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1224:

\xwrm.exe

\xwrm.exe

%WinDir%\xwrm.exe

%WinDir%\xwrm.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

USER %s 8 * :%s

USER %s 8 * :%s

NICK %s

NICK %s

PONG %s

PONG %s

JOIN #england

JOIN #england

PRIVMSG #england :.-:[X-Worm]:-.

PRIVMSG #england :.-:[X-Worm]:-.

irc.undernet.org

irc.undernet.org

MAIL FROM:<%s>

MAIL FROM:<%s>

RCPT TO:<%s>

RCPT TO:<%s>

--%s--

--%s--

From:<%s>

From:<%s>

To: %s

To: %s

Subject:%s

Subject:%s

boundary="%s"

boundary="%s"

X-Mailer: Microsoft Outlook Express 6.00.2800.1106

X-Mailer: Microsoft Outlook Express 6.00.2800.1106

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

charset="windows-1255"

charset="windows-1255"

name= "%s%s"

name= "%s%s"

Content-Disposition: attachment; filename="%s%s"

Content-Disposition: attachment; filename="%s%s"

Support

Support

No.reply

No.reply

8.txtt:

8.txtt:

8.htmt2

8.htmt2

8.rtft*

8.rtft*

8.doct"

8.doct"

8.bdxt

8.bdxt

8.phpt

8.phpt

8.jspt

8.jspt

8.cgit

8.cgit

smtp

smtp

ws2_32.dll

ws2_32.dll

Word.Document.6

Word.Document.6

ADVAPI32.DLL

ADVAPI32.DLL

RegOpenKeyExA

RegOpenKeyExA

RegCloseKey

RegCloseKey

User32.dll

User32.dll

winword2.doc

winword2.doc

Player.lnk

Player.lnk

ard.lnk

ard.lnk

aa58-4c8e-a8ea-3cad7c47ab03

aa58-4c8e-a8ea-3cad7c47ab03

8.exe

8.exe

8.scrtt

8.scrtt

8.avitJ

8.avitJ

8.doctB

8.doctB

8.mp3t:

8.mp3t:

8.mpgt2

8.mpgt2

8.xlst*

8.xlst*

8.jpgt"

8.jpgt"

8.zipt

8.zipt

8.isot

8.isot

8.pdft

8.pdft

8.pptt

8.pptt

8.rart

8.rart

c:\WINDOWS\_default.pif

c:\WINDOWS\_default.pif

stem.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll

stem.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll

nSolicitedRCUI.htm

nSolicitedRCUI.htm

rs.Soap.dll

rs.Soap.dll

SFC.DLL

SFC.DLL

WinExec

WinExec

aribyqabi.jra

aribyqabi.jra

c:\WINDOWS\aribyqabi.jra

c:\WINDOWS\aribyqabi.jra

bution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\rarqqjyzb.zby

bution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\rarqqjyzb.zby

qyaj.qia

qyaj.qia

ReadMe.exe

ReadMe.exe

c:\%original file name%.exe

c:\%original file name%.exe

t Menu\Programs\Startup\Ec0lMbEwo.exe

t Menu\Programs\Startup\Ec0lMbEwo.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\iirrjz.qbra.rib

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\iirrjz.qbra.rib

GetWindowsDirectoryA

GetWindowsDirectoryA

FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj

FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj

KERNEL32.dll

KERNEL32.dll


Related articles