Susp_Dropper (Kaspersky), DeepScan:Generic.Malware.SIM!g.FCA7DA70 (B) (Emsisoft), DeepScan:Generic.Malware.SIM!g.FCA7DA70 (AdAware), Virus.Win32.Duel.FD, GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)Behaviour: Worm, EmailWorm, Virus, IRCBot
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: d3eec486bdbe6b4222541131c8fea648
SHA1: 6dc5dec2c5c48d07329f571d5abc96cde9def050
SHA256: 1430b88d47a3fbbe82ab5d47b4b560060b8112ec874a3f37fcf22fd9c8ab9651
SSDeep: 384:nGaiTf8mMz3dL33uiBhSn4Aedk9iCuPZTgWTadRvANBUwWmyWsJt8b/dk:bjNBInhwSZRvAHyPjts/2
Size: 56320 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company:
Created at: 1975-12-17 22:24:40
Analyzed on: WindowsXP SP3 32-bit
Summary: Virus. A program that recursively replicates a possibly evolved copy of itself.
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
EmailWorm | Worm can send e-mails. |
IRCBot | A bot can communicate with command and control servers via IRC channel. |
Process activity
The Virus creates the following process(es):
%original file name%.exe:516
zbzbyqqjb.yjz:224
zbzbyqqjb.yjz:880
The Virus injects its code into the following process(es):No processes have been created.
File activity
The process %original file name%.exe:516 makes changes in the file system.
The Virus creates and/or writes to the following file(s):
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\rzqyjaaar.iza (56 bytes)
%Program Files%\MSN Gaming Zone\Windows\bijrazyiy.aibz (56 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\byjayayar.abr (56 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rrrziiirr.qyr (56 bytes)
%Program Files%\Outlook Express\yqyajqiaq.jjrqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\bijrazyiy.aib (56 bytes)
%WinDir%\pchealth\helpctr\binaries\abrrararq.qjy (56 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\rrrziiirr.qyr (56 bytes)
%Program Files%\NetMeeting\rzqyjaaar.izayqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\abrrararq.qjy (56 bytes)
C:\totalcmd\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\yqyajqiaq.jjr (56 bytes)
%Program Files%\Windows NT\Pinball\iazzzarib.yqa.yjzr (56 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\bijrazyiy.aib (56 bytes)
%WinDir%\Microsoft.NET\Framework\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\iazzzarib.yqa (56 bytes)
%WinDir%\ime\imkr6_1\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\rrrziiirr.qyr (56 bytes)
%WinDir%\ime\imjp8_1\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\rrrziiirr.qyr (56 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\iazzzarib.yqa (56 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\byjayayar.abr (56 bytes)
C:\totalcmd\zbzbyqqjb.yjz (56 bytes)
%WinDir%\ime\imjp8_1\iazzzarib.yqa (56 bytes)
%Program Files%\Windows Media Player\rzqyjaaar.izajjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\abrrararq.qjy (56 bytes)
%WinDir%\$hf_mig$\KB898461\update\rzqyjaaar.iza.yjzr (56 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\zbzbyqqjb.yjz (56 bytes)
%Program Files%\MSN Gaming Zone\Windows\byjayayar.abrz (56 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\rrrziiirr.qyr (56 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\iazzzarib.yqa (56 bytes)
%Program Files%\Windows Media Player\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\iazzzarib.yqa (56 bytes)
%Program Files%\Windows Media Player\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\bijrazyiy.aib (56 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\yqyajqiaq.jjrrr.qyraaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\yqyajqiaq.jjr (56 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\rrrziiirr.qyr (56 bytes)
%WinDir%\$hf_mig$\KB898461\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\rzqyjaaar.iza (56 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\bijrazyiy.aib (56 bytes)
%Program Files%\MSN Gaming Zone\Windows\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\byjayayar.abr (56 bytes)
%WinDir%\Network Diagnostic\iazzzarib.yqa (56 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\byjayayar.abr (56 bytes)
%Program Files%\NetMeeting\abrrararq.qjyyqyajqiaq.jjr (56 bytes)
%WinDir%\xwrm.exe (56 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\ime\imjp8_1\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\bijrazyiy.aib (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ijjzza.iyjj.yjr (56 bytes)
%WinDir%\ime\imjp8_1\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\yqyajqiaq.jjr (56 bytes)
%Program Files%\Common Files\Adobe\Updater6\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\rrrziiirr.qyr (56 bytes)
%WinDir%\ime\imjp8_1\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\zbzbyqqjb.yjz (56 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\bijrazyiy.aib (56 bytes)
%Program Files%\Outlook Express\zbzbyqqjb.yjzqiaq.jjr (56 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\bijrazyiy.aib (56 bytes)
%Program Files%\Windows NT\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\yqyajqiaq.jjr (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\rrrziiirr.qyraaar.iza (56 bytes)
%Program Files%\WinPcap\bijrazyiy.aibzzzarib.yqa.yjzr (56 bytes)
%Program Files%\MSN Gaming Zone\Windows\iazzzarib.yqaz (56 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\abrrararq.qjy (56 bytes)
%Program Files%\NetMeeting\rrrziiirr.qyryqyajqiaq.jjr (56 bytes)
%Program Files%\Windows NT\Accessories\zbzbyqqjb.yjzr (56 bytes)
%WinDir%\ime\imjp8_1\rrrziiirr.qyr (56 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib (56 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\rrrziiirr.qyr (56 bytes)
%WinDir%\pchealth\helpctr\binaries\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\byjayayar.abr (56 bytes)
%WinDir%\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\abrrararq.qjy (56 bytes)
%Program Files%\Outlook Express\byjayayar.abrqiaq.jjr (56 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\rzqyjaaar.iza (56 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\rzqyjaaar.iza (56 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr (56 bytes)
%WinDir%\ime\imjp8_1\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\bijrazyiy.aib (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\rzqyjaaar.iza (56 bytes)
C:\totalcmd\bijrazyiy.aib (56 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\yqyajqiaq.jjr (56 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\rzqyjaaar.iza (56 bytes)
%Program Files%\Outlook Express\bijrazyiy.aibqiaq.jjr (56 bytes)
%WinDir%\inf\iazzzarib.yqa (56 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\bijrazyiy.aib (56 bytes)
The process zbzbyqqjb.yjz:224 makes changes in the file system.
The Virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\yryrqb.jaaj.yjr (56 bytes)
The process zbzbyqqjb.yjz:880 makes changes in the file system.
The Virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\yjirir.ajyj.yjr (56 bytes)
Registry activity
The process %original file name%.exe:516 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"
The process zbzbyqqjb.yjz:224 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CE 4E F4 28 B9 1D 4C F4 CF 1C 0B 78 62 FB 5F 54"
The process zbzbyqqjb.yjz:880 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C9 6E 8A D6 B2 36 77 46 06 9C 35 5C FE 04 11 38"
Dropped PE files
MD5 | File path |
---|---|
9f59cf85354f105e509fdc1908900ea3 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\rrrziiirr.qyraaar.iza |
d4e83379874cedfc15bdd9bec61bba3f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ijjzza.iyjj.yjr |
9f59cf85354f105e509fdc1908900ea3 | c:\Perl\bin\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\Perl\bin\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\Perl\bin\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Adobe\Reader 9.0\Reader\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Adobe\Reader 9.0\Reader\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Adobe\Reader 9.0\Reader\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Adobe\Reader 9.0\Reader\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Adobe\Reader 9.0\Reader\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\yqyajqiaq.jjrrr.qyraaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Common Files\Adobe\ARM\1.0\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Common Files\Adobe\ARM\1.0\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Common Files\Adobe\ARM\1.0\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Common Files\Adobe\Updater6\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Common Files\Microsoft Shared\DW\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Common Files\Microsoft Shared\DW\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Common Files\Microsoft Shared\MSInfo\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\MSN Gaming Zone\Windows\bijrazyiy.aibz |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\MSN Gaming Zone\Windows\byjayayar.abrz |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\MSN Gaming Zone\Windows\iazzzarib.yqaz |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\MSN Gaming Zone\Windows\yqyajqiaq.jjr |
5ac6cd4642fc24dc829bf5025a557efb | c:\Program Files\MSN Gaming Zone\Windows\zClientm.exe |
5ac6cd4642fc24dc829bf5025a557efb | c:\Program Files\MSN Gaming Zone\Windows\zclientm.exe |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\NetMeeting\abrrararq.qjyyqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\NetMeeting\rrrziiirr.qyryqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\NetMeeting\rzqyjaaar.izayqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Outlook Express\bijrazyiy.aibqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Outlook Express\byjayayar.abrqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Outlook Express\yqyajqiaq.jjrqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Outlook Express\zbzbyqqjb.yjzqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\WinPcap\bijrazyiy.aibzzzarib.yqa.yjzr |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Windows Media Player\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Windows Media Player\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Windows Media Player\rzqyjaaar.izajjr |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Windows NT\Accessories\zbzbyqqjb.yjzr |
faa1fde004b3c60b5a8068a7c3aab151 | c:\Program Files\Windows NT\Pinball\PINBALL.EXE |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Windows NT\Pinball\iazzzarib.yqa.yjzr |
faa1fde004b3c60b5a8068a7c3aab151 | c:\Program Files\Windows NT\Pinball\pinball.exe |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Windows NT\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Wireshark\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Wireshark\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Wireshark\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Wireshark\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Wireshark\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\Program Files\Wireshark\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\$NtUninstallKB898461$\spuninst\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\$hf_mig$\KB898461\update\rzqyjaaar.iza.yjzr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\$hf_mig$\KB898461\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\Microsoft.NET\Framework\abrrararq.qjy |
5e28284f9b5f9097640d58a73d38ad4c | c:\WINDOWS\NOTEPAD.EXE |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\Network Diagnostic\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\ime\imjp8_1\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\ime\imjp8_1\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\ime\imjp8_1\byjayayar.abr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\ime\imjp8_1\iazzzarib.yqa |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\ime\imjp8_1\rrrziiirr.qyr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\ime\imjp8_1\rzqyjaaar.iza |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\ime\imjp8_1\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\ime\imkr6_1\zbzbyqqjb.yjz |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\inf\iazzzarib.yqa |
5e28284f9b5f9097640d58a73d38ad4c | c:\WINDOWS\notepad.exe |
b32a4db8fa8ba07afb1e86f8c9fb852e | c:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\pchealth\helpctr\binaries\abrrararq.qjy |
b32a4db8fa8ba07afb1e86f8c9fb852e | c:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\pchealth\helpctr\binaries\yqyajqiaq.jjr |
9f59cf85354f105e509fdc1908900ea3 | c:\WINDOWS\xwrm.exe |
9f59cf85354f105e509fdc1908900ea3 | c:\totalcmd\abrrararq.qjy |
9f59cf85354f105e509fdc1908900ea3 | c:\totalcmd\bijrazyiy.aib |
9f59cf85354f105e509fdc1908900ea3 | c:\totalcmd\zbzbyqqjb.yjz |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:516
zbzbyqqjb.yjz:224
zbzbyqqjb.yjz:880 - Delete the original Virus file.
- Delete or disinfect the following files created/modified by the Virus:
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\rzqyjaaar.iza (56 bytes)
%Program Files%\MSN Gaming Zone\Windows\bijrazyiy.aibz (56 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\byjayayar.abr (56 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rrrziiirr.qyr (56 bytes)
%Program Files%\Outlook Express\yqyajqiaq.jjrqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\bijrazyiy.aib (56 bytes)
%WinDir%\pchealth\helpctr\binaries\abrrararq.qjy (56 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\rrrziiirr.qyr (56 bytes)
%Program Files%\NetMeeting\rzqyjaaar.izayqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\abrrararq.qjy (56 bytes)
C:\totalcmd\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\yqyajqiaq.jjr (56 bytes)
%Program Files%\Windows NT\Pinball\iazzzarib.yqa.yjzr (56 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\bijrazyiy.aib (56 bytes)
%WinDir%\Microsoft.NET\Framework\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\iazzzarib.yqa (56 bytes)
%WinDir%\ime\imkr6_1\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\rrrziiirr.qyr (56 bytes)
%WinDir%\ime\imjp8_1\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\rrrziiirr.qyr (56 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\iazzzarib.yqa (56 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\byjayayar.abr (56 bytes)
C:\totalcmd\zbzbyqqjb.yjz (56 bytes)
%WinDir%\ime\imjp8_1\iazzzarib.yqa (56 bytes)
%Program Files%\Windows Media Player\rzqyjaaar.izajjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\abrrararq.qjy (56 bytes)
%WinDir%\$hf_mig$\KB898461\update\rzqyjaaar.iza.yjzr (56 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\zbzbyqqjb.yjz (56 bytes)
%Program Files%\MSN Gaming Zone\Windows\byjayayar.abrz (56 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\rrrziiirr.qyr (56 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\iazzzarib.yqa (56 bytes)
%Program Files%\Windows Media Player\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\iazzzarib.yqa (56 bytes)
%Program Files%\Windows Media Player\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\bijrazyiy.aib (56 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\yqyajqiaq.jjrrr.qyraaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\yqyajqiaq.jjr (56 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\rrrziiirr.qyr (56 bytes)
%WinDir%\$hf_mig$\KB898461\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\rzqyjaaar.iza (56 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\bijrazyiy.aib (56 bytes)
%Program Files%\MSN Gaming Zone\Windows\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\byjayayar.abr (56 bytes)
%WinDir%\Network Diagnostic\iazzzarib.yqa (56 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\byjayayar.abr (56 bytes)
%Program Files%\NetMeeting\abrrararq.qjyyqyajqiaq.jjr (56 bytes)
%WinDir%\xwrm.exe (56 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\ime\imjp8_1\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\bijrazyiy.aib (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ijjzza.iyjj.yjr (56 bytes)
%WinDir%\ime\imjp8_1\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\yqyajqiaq.jjr (56 bytes)
%Program Files%\Common Files\Adobe\Updater6\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\rrrziiirr.qyr (56 bytes)
%WinDir%\ime\imjp8_1\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\zbzbyqqjb.yjz (56 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\bijrazyiy.aib (56 bytes)
%Program Files%\Outlook Express\zbzbyqqjb.yjzqiaq.jjr (56 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\bijrazyiy.aib (56 bytes)
%Program Files%\Windows NT\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\yqyajqiaq.jjr (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\rrrziiirr.qyraaar.iza (56 bytes)
%Program Files%\WinPcap\bijrazyiy.aibzzzarib.yqa.yjzr (56 bytes)
%Program Files%\MSN Gaming Zone\Windows\iazzzarib.yqaz (56 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\abrrararq.qjy (56 bytes)
%Program Files%\NetMeeting\rrrziiirr.qyryqyajqiaq.jjr (56 bytes)
%Program Files%\Windows NT\Accessories\zbzbyqqjb.yjzr (56 bytes)
%WinDir%\ime\imjp8_1\rrrziiirr.qyr (56 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib (56 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\rrrziiirr.qyr (56 bytes)
%WinDir%\pchealth\helpctr\binaries\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\byjayayar.abr (56 bytes)
%WinDir%\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\abrrararq.qjy (56 bytes)
%Program Files%\Outlook Express\byjayayar.abrqiaq.jjr (56 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\rzqyjaaar.iza (56 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\rzqyjaaar.iza (56 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr (56 bytes)
%WinDir%\ime\imjp8_1\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\bijrazyiy.aib (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\rzqyjaaar.iza (56 bytes)
C:\totalcmd\bijrazyiy.aib (56 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\yqyajqiaq.jjr (56 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\rzqyjaaar.iza (56 bytes)
%Program Files%\Outlook Express\bijrazyiy.aibqiaq.jjr (56 bytes)
%WinDir%\inf\iazzzarib.yqa (56 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\bijrazyiy.aib (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yryrqb.jaaj.yjr (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yjirir.ajyj.yjr (56 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
jajybjab | 4096 | 4096 | 1536 | 0.668487 | d815a70e0afe2676a8f19fed42cec13c |
iqrbzijq | 8192 | 32768 | 32256 | 4.59076 | c406487831f49daf27afb70a7555e1b2 |
qrrzziib | 40960 | 4096 | 512 | 0.468013 | 03990ce32513f25d3855296b7bc8aa4d |
iiqjrqjy | 45056 | 4096 | 2048 | 3.92473 | 6481060bb77e469e5fdb95d8e5c6ab31 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Virus connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_516:
\xwrm.exe
\xwrm.exe
%WinDir%\xwrm.exe
%WinDir%\xwrm.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
USER %s 8 * :%s
USER %s 8 * :%s
NICK %s
NICK %s
PONG %s
PONG %s
JOIN #england
JOIN #england
PRIVMSG #england :.-:[X-Worm]:-.
PRIVMSG #england :.-:[X-Worm]:-.
irc.undernet.org
irc.undernet.org
MAIL FROM:<%s>
MAIL FROM:<%s>
RCPT TO:<%s>
RCPT TO:<%s>
--%s--
--%s--
From:<%s>
From:<%s>
To: %s
To: %s
Subject:%s
Subject:%s
boundary="%s"
boundary="%s"
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
charset="windows-1255"
charset="windows-1255"
name= "%s%s"
name= "%s%s"
Content-Disposition: attachment; filename="%s%s"
Content-Disposition: attachment; filename="%s%s"
Support
Support
No.reply
No.reply
8.txtt:
8.txtt:
8.htmt2
8.htmt2
8.rtft*
8.rtft*
8.doct"
8.doct"
8.bdxt
8.bdxt
8.phpt
8.phpt
8.jspt
8.jspt
8.cgit
8.cgit
smtp
smtp
ws2_32.dll
ws2_32.dll
HTTP 200 OK
HTTP 200 OK
server. Please contact the web site administrator.
server. Please contact the web site administrator.
ADVAPI32.DLL
ADVAPI32.DLL
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
User32.dll
User32.dll
adrot.txt
adrot.txt
cts.bat
cts.bat
aa58-4c8e-a8ea-3cad7c47ab03
aa58-4c8e-a8ea-3cad7c47ab03
8.exe
8.exe
8.scrtt
8.scrtt
8.avitJ
8.avitJ
8.doctB
8.doctB
8.mp3t:
8.mp3t:
8.mpgt2
8.mpgt2
8.xlst*
8.xlst*
8.jpgt"
8.jpgt"
8.zipt
8.zipt
8.isot
8.isot
8.pdft
8.pdft
8.pptt
8.pptt
8.rart
8.rart
c:\WINDOWS\_default.pif
c:\WINDOWS\_default.pif
stem.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll
stem.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll
nSolicitedRCUI.htm
nSolicitedRCUI.htm
rs.Soap.dll
rs.Soap.dll
SFC.DLL
SFC.DLL
WinExec
WinExec
yqyajqiaq.jjr
yqyajqiaq.jjr
c:\WINDOWS\yqyajqiaq.jjr
c:\WINDOWS\yqyajqiaq.jjr
bution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\byjayayar.abr
bution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\byjayayar.abr
aaar.iza
aaar.iza
ReadMe.exe
ReadMe.exe
c:\%original file name%.exe
c:\%original file name%.exe
t Menu\Programs\Startup\d8n8JNLkI.exe
t Menu\Programs\Startup\d8n8JNLkI.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ijjzza.iyjj.yjr
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ijjzza.iyjj.yjr
GetWindowsDirectoryA
GetWindowsDirectoryA
FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj
FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj
KERNEL32.dll
KERNEL32.dll