Skip to main content

Virus.Win32.Duel_d3eec486bd


Susp_Dropper (Kaspersky), DeepScan:Generic.Malware.SIM!g.FCA7DA70 (B) (Emsisoft), DeepScan:Generic.Malware.SIM!g.FCA7DA70 (AdAware), Virus.Win32.Duel.FD, GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)Behaviour: Worm, EmailWorm, Virus, IRCBot

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: d3eec486bdbe6b4222541131c8fea648

SHA1: 6dc5dec2c5c48d07329f571d5abc96cde9def050

SHA256: 1430b88d47a3fbbe82ab5d47b4b560060b8112ec874a3f37fcf22fd9c8ab9651

SSDeep: 384:nGaiTf8mMz3dL33uiBhSn4Aedk9iCuPZTgWTadRvANBUwWmyWsJt8b/dk:bjNBInhwSZRvAHyPjts/2

Size: 56320 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company:

Created at: 1975-12-17 22:24:40

Analyzed on: WindowsXP SP3 32-bit

Summary: Virus. A program that recursively replicates a possibly evolved copy of itself.

Dynamic Analysis

Payload

Behaviour Description
EmailWormWorm can send e-mails.
IRCBotA bot can communicate with command and control servers via IRC channel.


Process activity

The Virus creates the following process(es):

%original file name%.exe:516
zbzbyqqjb.yjz:224
zbzbyqqjb.yjz:880

The Virus injects its code into the following process(es):No processes have been created.

File activity

The process %original file name%.exe:516 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\rzqyjaaar.iza (56 bytes)
%Program Files%\MSN Gaming Zone\Windows\bijrazyiy.aibz (56 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\byjayayar.abr (56 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rrrziiirr.qyr (56 bytes)
%Program Files%\Outlook Express\yqyajqiaq.jjrqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\bijrazyiy.aib (56 bytes)
%WinDir%\pchealth\helpctr\binaries\abrrararq.qjy (56 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\rrrziiirr.qyr (56 bytes)
%Program Files%\NetMeeting\rzqyjaaar.izayqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\abrrararq.qjy (56 bytes)
C:\totalcmd\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\yqyajqiaq.jjr (56 bytes)
%Program Files%\Windows NT\Pinball\iazzzarib.yqa.yjzr (56 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\bijrazyiy.aib (56 bytes)
%WinDir%\Microsoft.NET\Framework\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\iazzzarib.yqa (56 bytes)
%WinDir%\ime\imkr6_1\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\rrrziiirr.qyr (56 bytes)
%WinDir%\ime\imjp8_1\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\rrrziiirr.qyr (56 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\iazzzarib.yqa (56 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\byjayayar.abr (56 bytes)
C:\totalcmd\zbzbyqqjb.yjz (56 bytes)
%WinDir%\ime\imjp8_1\iazzzarib.yqa (56 bytes)
%Program Files%\Windows Media Player\rzqyjaaar.izajjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\abrrararq.qjy (56 bytes)
%WinDir%\$hf_mig$\KB898461\update\rzqyjaaar.iza.yjzr (56 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\zbzbyqqjb.yjz (56 bytes)
%Program Files%\MSN Gaming Zone\Windows\byjayayar.abrz (56 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\rrrziiirr.qyr (56 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\iazzzarib.yqa (56 bytes)
%Program Files%\Windows Media Player\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\iazzzarib.yqa (56 bytes)
%Program Files%\Windows Media Player\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\bijrazyiy.aib (56 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\yqyajqiaq.jjrrr.qyraaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\yqyajqiaq.jjr (56 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\rrrziiirr.qyr (56 bytes)
%WinDir%\$hf_mig$\KB898461\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\rzqyjaaar.iza (56 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\bijrazyiy.aib (56 bytes)
%Program Files%\MSN Gaming Zone\Windows\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\byjayayar.abr (56 bytes)
%WinDir%\Network Diagnostic\iazzzarib.yqa (56 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\byjayayar.abr (56 bytes)
%Program Files%\NetMeeting\abrrararq.qjyyqyajqiaq.jjr (56 bytes)
%WinDir%\xwrm.exe (56 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\zbzbyqqjb.yjz (56 bytes)
%WinDir%\ime\imjp8_1\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\bijrazyiy.aib (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ijjzza.iyjj.yjr (56 bytes)
%WinDir%\ime\imjp8_1\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\yqyajqiaq.jjr (56 bytes)
%Program Files%\Common Files\Adobe\Updater6\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\rrrziiirr.qyr (56 bytes)
%WinDir%\ime\imjp8_1\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\zbzbyqqjb.yjz (56 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\iazzzarib.yqa (56 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\bijrazyiy.aib (56 bytes)
%Program Files%\Outlook Express\zbzbyqqjb.yjzqiaq.jjr (56 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\bijrazyiy.aib (56 bytes)
%Program Files%\Windows NT\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\yqyajqiaq.jjr (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\rrrziiirr.qyraaar.iza (56 bytes)
%Program Files%\WinPcap\bijrazyiy.aibzzzarib.yqa.yjzr (56 bytes)
%Program Files%\MSN Gaming Zone\Windows\iazzzarib.yqaz (56 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\abrrararq.qjy (56 bytes)
%Program Files%\NetMeeting\rrrziiirr.qyryqyajqiaq.jjr (56 bytes)
%Program Files%\Windows NT\Accessories\zbzbyqqjb.yjzr (56 bytes)
%WinDir%\ime\imjp8_1\rrrziiirr.qyr (56 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib (56 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\rrrziiirr.qyr (56 bytes)
%WinDir%\pchealth\helpctr\binaries\yqyajqiaq.jjr (56 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\byjayayar.abr (56 bytes)
%WinDir%\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\abrrararq.qjy (56 bytes)
%Program Files%\Outlook Express\byjayayar.abrqiaq.jjr (56 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\rzqyjaaar.iza (56 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\bijrazyiy.aib (56 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\zbzbyqqjb.yjz (56 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\rzqyjaaar.iza (56 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr (56 bytes)
%WinDir%\ime\imjp8_1\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\byjayayar.abr (56 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\bijrazyiy.aib (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\rzqyjaaar.iza (56 bytes)
C:\totalcmd\bijrazyiy.aib (56 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\rrrziiirr.qyr (56 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\yqyajqiaq.jjr (56 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\abrrararq.qjy (56 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\rzqyjaaar.iza (56 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\rzqyjaaar.iza (56 bytes)
%Program Files%\Outlook Express\bijrazyiy.aibqiaq.jjr (56 bytes)
%WinDir%\inf\iazzzarib.yqa (56 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\bijrazyiy.aib (56 bytes)

The process zbzbyqqjb.yjz:224 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\yryrqb.jaaj.yjr (56 bytes)

The process zbzbyqqjb.yjz:880 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\yjirir.ajyj.yjr (56 bytes)

Registry activity

The process %original file name%.exe:516 makes changes in the system registry.


The Virus creates and/or sets the following values in system registry:


To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"

The process zbzbyqqjb.yjz:224 makes changes in the system registry.


The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CE 4E F4 28 B9 1D 4C F4 CF 1C 0B 78 62 FB 5F 54"

The process zbzbyqqjb.yjz:880 makes changes in the system registry.


The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C9 6E 8A D6 B2 36 77 46 06 9C 35 5C FE 04 11 38"

Dropped PE files

MD5 File path
9f59cf85354f105e509fdc1908900ea3c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\rrrziiirr.qyraaar.iza
d4e83379874cedfc15bdd9bec61bba3fc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ijjzza.iyjj.yjr
9f59cf85354f105e509fdc1908900ea3c:\Perl\bin\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\Perl\bin\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\Perl\bin\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Adobe\Reader 9.0\Reader\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Adobe\Reader 9.0\Reader\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Adobe\Reader 9.0\Reader\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Adobe\Reader 9.0\Reader\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Adobe\Reader 9.0\Reader\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\yqyajqiaq.jjrrr.qyraaar.iza
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Common Files\Adobe\ARM\1.0\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Common Files\Adobe\ARM\1.0\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Common Files\Adobe\ARM\1.0\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Common Files\Adobe\Updater6\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Common Files\Microsoft Shared\DW\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Common Files\Microsoft Shared\DW\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Common Files\Microsoft Shared\MSInfo\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\Program Files\MSN Gaming Zone\Windows\bijrazyiy.aibz
9f59cf85354f105e509fdc1908900ea3c:\Program Files\MSN Gaming Zone\Windows\byjayayar.abrz
9f59cf85354f105e509fdc1908900ea3c:\Program Files\MSN Gaming Zone\Windows\iazzzarib.yqaz
9f59cf85354f105e509fdc1908900ea3c:\Program Files\MSN Gaming Zone\Windows\yqyajqiaq.jjr
5ac6cd4642fc24dc829bf5025a557efbc:\Program Files\MSN Gaming Zone\Windows\zClientm.exe
5ac6cd4642fc24dc829bf5025a557efbc:\Program Files\MSN Gaming Zone\Windows\zclientm.exe
9f59cf85354f105e509fdc1908900ea3c:\Program Files\NetMeeting\abrrararq.qjyyqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\Program Files\NetMeeting\rrrziiirr.qyryqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\Program Files\NetMeeting\rzqyjaaar.izayqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Outlook Express\bijrazyiy.aibqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Outlook Express\byjayayar.abrqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Outlook Express\yqyajqiaq.jjrqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Outlook Express\zbzbyqqjb.yjzqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\Program Files\WinPcap\bijrazyiy.aibzzzarib.yqa.yjzr
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Windows Media Player\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Windows Media Player\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Windows Media Player\rzqyjaaar.izajjr
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Windows NT\Accessories\zbzbyqqjb.yjzr
faa1fde004b3c60b5a8068a7c3aab151c:\Program Files\Windows NT\Pinball\PINBALL.EXE
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Windows NT\Pinball\iazzzarib.yqa.yjzr
faa1fde004b3c60b5a8068a7c3aab151c:\Program Files\Windows NT\Pinball\pinball.exe
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Windows NT\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Wireshark\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Wireshark\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Wireshark\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Wireshark\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Wireshark\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\Program Files\Wireshark\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\$NtUninstallKB898461$\spuninst\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\$hf_mig$\KB898461\update\rzqyjaaar.iza.yjzr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\$hf_mig$\KB898461\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\Microsoft.NET\Framework\abrrararq.qjy
5e28284f9b5f9097640d58a73d38ad4cc:\WINDOWS\NOTEPAD.EXE
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\Network Diagnostic\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\ime\imjp8_1\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\ime\imjp8_1\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\ime\imjp8_1\byjayayar.abr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\ime\imjp8_1\iazzzarib.yqa
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\ime\imjp8_1\rrrziiirr.qyr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\ime\imjp8_1\rzqyjaaar.iza
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\ime\imjp8_1\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\ime\imkr6_1\zbzbyqqjb.yjz
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\inf\iazzzarib.yqa
5e28284f9b5f9097640d58a73d38ad4cc:\WINDOWS\notepad.exe
b32a4db8fa8ba07afb1e86f8c9fb852ec:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\pchealth\helpctr\binaries\abrrararq.qjy
b32a4db8fa8ba07afb1e86f8c9fb852ec:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\pchealth\helpctr\binaries\yqyajqiaq.jjr
9f59cf85354f105e509fdc1908900ea3c:\WINDOWS\xwrm.exe
9f59cf85354f105e509fdc1908900ea3c:\totalcmd\abrrararq.qjy
9f59cf85354f105e509fdc1908900ea3c:\totalcmd\bijrazyiy.aib
9f59cf85354f105e509fdc1908900ea3c:\totalcmd\zbzbyqqjb.yjz

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:516
    zbzbyqqjb.yjz:224
    zbzbyqqjb.yjz:880

  2. Delete the original Virus file.
  3. Delete or disinfect the following files created/modified by the Virus:

    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\rzqyjaaar.iza (56 bytes)
    %Program Files%\MSN Gaming Zone\Windows\bijrazyiy.aibz (56 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\byjayayar.abr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\byjayayar.abr (56 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\rrrziiirr.qyr (56 bytes)
    %Program Files%\Outlook Express\yqyajqiaq.jjrqiaq.jjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\zbzbyqqjb.yjz (56 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\rrrziiirr.qyr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\zbzbyqqjb.yjz (56 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\yqyajqiaq.jjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\byjayayar.abr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\abrrararq.qjy (56 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\abrrararq.qjy (56 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\zbzbyqqjb.yjz (56 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\iazzzarib.yqa (56 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\iazzzarib.yqa (56 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\iazzzarib.yqa (56 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\bijrazyiy.aib (56 bytes)
    %WinDir%\pchealth\helpctr\binaries\abrrararq.qjy (56 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\yqyajqiaq.jjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\rrrziiirr.qyr (56 bytes)
    %Program Files%\NetMeeting\rzqyjaaar.izayqyajqiaq.jjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\iazzzarib.yqa (56 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\iazzzarib.yqa (56 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\abrrararq.qjy (56 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\zbzbyqqjb.yjz (56 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\bijrazyiy.aib (56 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\byjayayar.abr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\abrrararq.qjy (56 bytes)
    C:\totalcmd\abrrararq.qjy (56 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\bijrazyiy.aib (56 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\yqyajqiaq.jjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\yqyajqiaq.jjr (56 bytes)
    %Program Files%\Windows NT\Pinball\iazzzarib.yqa.yjzr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\yqyajqiaq.jjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\bijrazyiy.aib (56 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\bijrazyiy.aib (56 bytes)
    %WinDir%\Microsoft.NET\Framework\abrrararq.qjy (56 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\rrrziiirr.qyr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\byjayayar.abr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\rzqyjaaar.iza (56 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\zbzbyqqjb.yjz (56 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\iazzzarib.yqa (56 bytes)
    %WinDir%\ime\imkr6_1\zbzbyqqjb.yjz (56 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\abrrararq.qjy (56 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\rrrziiirr.qyr (56 bytes)
    %WinDir%\ime\imjp8_1\abrrararq.qjy (56 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\zbzbyqqjb.yjz (56 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\zbzbyqqjb.yjz (56 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\rrrziiirr.qyr (56 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\abrrararq.qjy (56 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\zbzbyqqjb.yjz (56 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\iazzzarib.yqa (56 bytes)
    %Program Files%\Common Files\Microsoft Shared\MSInfo\rzqyjaaar.iza (56 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\rzqyjaaar.iza (56 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\byjayayar.abr (56 bytes)
    C:\totalcmd\zbzbyqqjb.yjz (56 bytes)
    %WinDir%\ime\imjp8_1\iazzzarib.yqa (56 bytes)
    %Program Files%\Windows Media Player\rzqyjaaar.izajjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\abrrararq.qjy (56 bytes)
    %WinDir%\$hf_mig$\KB898461\update\rzqyjaaar.iza.yjzr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\yqyajqiaq.jjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\iazzzarib.yqa (56 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\bijrazyiy.aib (56 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\yqyajqiaq.jjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\iazzzarib.yqa (56 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\zbzbyqqjb.yjz (56 bytes)
    %Program Files%\MSN Gaming Zone\Windows\byjayayar.abrz (56 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\byjayayar.abr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\yqyajqiaq.jjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\rzqyjaaar.iza (56 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\rrrziiirr.qyr (56 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\zbzbyqqjb.yjz (56 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\rzqyjaaar.iza (56 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\rrrziiirr.qyr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\iazzzarib.yqa (56 bytes)
    %Program Files%\Windows Media Player\abrrararq.qjy (56 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\zbzbyqqjb.yjz (56 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\iazzzarib.yqa (56 bytes)
    %Program Files%\Windows Media Player\rrrziiirr.qyr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\rrrziiirr.qyr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\yqyajqiaq.jjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\byjayayar.abr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\byjayayar.abr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\byjayayar.abr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\rrrziiirr.qyr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\bijrazyiy.aib (56 bytes)
    %Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\yqyajqiaq.jjrrr.qyraaar.iza (56 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\iazzzarib.yqa (56 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\yqyajqiaq.jjr (56 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\rzqyjaaar.iza (56 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\rzqyjaaar.iza (56 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\rrrziiirr.qyr (56 bytes)
    %WinDir%\$hf_mig$\KB898461\yqyajqiaq.jjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\iazzzarib.yqa (56 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\rzqyjaaar.iza (56 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza (56 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\abrrararq.qjy (56 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\yqyajqiaq.jjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\rrrziiirr.qyr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\bijrazyiy.aib (56 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\abrrararq.qjy (56 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\byjayayar.abr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\bijrazyiy.aib (56 bytes)
    %Program Files%\MSN Gaming Zone\Windows\yqyajqiaq.jjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\rzqyjaaar.iza (56 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\yqyajqiaq.jjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\zbzbyqqjb.yjz (56 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\zbzbyqqjb.yjz (56 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\yqyajqiaq.jjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\byjayayar.abr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\byjayayar.abr (56 bytes)
    %WinDir%\Network Diagnostic\iazzzarib.yqa (56 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjayayar.abr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\abrrararq.qjy (56 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\byjayayar.abr (56 bytes)
    %Program Files%\NetMeeting\abrrararq.qjyyqyajqiaq.jjr (56 bytes)
    %WinDir%\xwrm.exe (56 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\zbzbyqqjb.yjz (56 bytes)
    %WinDir%\ime\imjp8_1\bijrazyiy.aib (56 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\byjayayar.abr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\abrrararq.qjy (56 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\rzqyjaaar.iza (56 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\iazzzarib.yqa (56 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\iazzzarib.yqa (56 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\bijrazyiy.aib (56 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ijjzza.iyjj.yjr (56 bytes)
    %WinDir%\ime\imjp8_1\rzqyjaaar.iza (56 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\yqyajqiaq.jjr (56 bytes)
    %Program Files%\Common Files\Adobe\Updater6\iazzzarib.yqa (56 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\rzqyjaaar.iza (56 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\rrrziiirr.qyr (56 bytes)
    %WinDir%\ime\imjp8_1\yqyajqiaq.jjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\rzqyjaaar.iza (56 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\rrrziiirr.qyr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\zbzbyqqjb.yjz (56 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\iazzzarib.yqa (56 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\iazzzarib.yqa (56 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\bijrazyiy.aib (56 bytes)
    %Program Files%\Outlook Express\zbzbyqqjb.yjzqiaq.jjr (56 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\bijrazyiy.aib (56 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\bijrazyiy.aib (56 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\rrrziiirr.qyr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\yqyajqiaq.jjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\bijrazyiy.aib (56 bytes)
    %Program Files%\Windows NT\byjayayar.abr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\yqyajqiaq.jjr (56 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\rrrziiirr.qyraaar.iza (56 bytes)
    %Program Files%\WinPcap\bijrazyiy.aibzzzarib.yqa.yjzr (56 bytes)
    %Program Files%\MSN Gaming Zone\Windows\iazzzarib.yqaz (56 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\abrrararq.qjy (56 bytes)
    %Program Files%\NetMeeting\rrrziiirr.qyryqyajqiaq.jjr (56 bytes)
    %Program Files%\Windows NT\Accessories\zbzbyqqjb.yjzr (56 bytes)
    %WinDir%\ime\imjp8_1\rrrziiirr.qyr (56 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib (56 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\rrrziiirr.qyr (56 bytes)
    %WinDir%\pchealth\helpctr\binaries\yqyajqiaq.jjr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\byjayayar.abr (56 bytes)
    %WinDir%\bijrazyiy.aib (56 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\abrrararq.qjy (56 bytes)
    %Program Files%\Outlook Express\byjayayar.abrqiaq.jjr (56 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rzqyjaaar.iza (56 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\rzqyjaaar.iza (56 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\abrrararq.qjy (56 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\zbzbyqqjb.yjz (56 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\rzqyjaaar.iza (56 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz (56 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\bijrazyiy.aib (56 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\zbzbyqqjb.yjz (56 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\rzqyjaaar.iza (56 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr (56 bytes)
    %WinDir%\ime\imjp8_1\byjayayar.abr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\abrrararq.qjy (56 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\abrrararq.qjy (56 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\byjayayar.abr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\bijrazyiy.aib (56 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\rzqyjaaar.iza (56 bytes)
    C:\totalcmd\bijrazyiy.aib (56 bytes)
    %WinDir%\$NtUninstallKB898461$\spuninst\rrrziiirr.qyr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\rrrziiirr.qyr (56 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\abrrararq.qjy (56 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\yqyajqiaq.jjr (56 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\abrrararq.qjy (56 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\rzqyjaaar.iza (56 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\rzqyjaaar.iza (56 bytes)
    %Program Files%\Outlook Express\bijrazyiy.aibqiaq.jjr (56 bytes)
    %WinDir%\inf\iazzzarib.yqa (56 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\bijrazyiy.aib (56 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\yryrqb.jaaj.yjr (56 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\yjirir.ajyj.yjr (56 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "x32x" = "%WinDir%\xwrm.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
jajybjab4096409615360.668487d815a70e0afe2676a8f19fed42cec13c
iqrbzijq819232768322564.59076c406487831f49daf27afb70a7555e1b2
qrrzziib4096040965120.46801303990ce32513f25d3855296b7bc8aa4d
iiqjrqjy45056409620483.924736481060bb77e469e5fdb95d8e5c6ab31

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Virus connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_516:

\xwrm.exe

\xwrm.exe

%WinDir%\xwrm.exe

%WinDir%\xwrm.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

USER %s 8 * :%s

USER %s 8 * :%s

NICK %s

NICK %s

PONG %s

PONG %s

JOIN #england

JOIN #england

PRIVMSG #england :.-:[X-Worm]:-.

PRIVMSG #england :.-:[X-Worm]:-.

irc.undernet.org

irc.undernet.org

MAIL FROM:<%s>

MAIL FROM:<%s>

RCPT TO:<%s>

RCPT TO:<%s>

--%s--

--%s--

From:<%s>

From:<%s>

To: %s

To: %s

Subject:%s

Subject:%s

boundary="%s"

boundary="%s"

X-Mailer: Microsoft Outlook Express 6.00.2800.1106

X-Mailer: Microsoft Outlook Express 6.00.2800.1106

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

charset="windows-1255"

charset="windows-1255"

name= "%s%s"

name= "%s%s"

Content-Disposition: attachment; filename="%s%s"

Content-Disposition: attachment; filename="%s%s"

Support

Support

No.reply

No.reply

8.txtt:

8.txtt:

8.htmt2

8.htmt2

8.rtft*

8.rtft*

8.doct"

8.doct"

8.bdxt

8.bdxt

8.phpt

8.phpt

8.jspt

8.jspt

8.cgit

8.cgit

smtp

smtp

ws2_32.dll

ws2_32.dll

HTTP 200 OK

HTTP 200 OK

server. Please contact the web site administrator.

server. Please contact the web site administrator.

ADVAPI32.DLL

ADVAPI32.DLL

RegOpenKeyExA

RegOpenKeyExA

RegCloseKey

RegCloseKey

User32.dll

User32.dll

adrot.txt

adrot.txt

cts.bat

cts.bat

aa58-4c8e-a8ea-3cad7c47ab03

aa58-4c8e-a8ea-3cad7c47ab03

8.exe

8.exe

8.scrtt

8.scrtt

8.avitJ

8.avitJ

8.doctB

8.doctB

8.mp3t:

8.mp3t:

8.mpgt2

8.mpgt2

8.xlst*

8.xlst*

8.jpgt"

8.jpgt"

8.zipt

8.zipt

8.isot

8.isot

8.pdft

8.pdft

8.pptt

8.pptt

8.rart

8.rart

c:\WINDOWS\_default.pif

c:\WINDOWS\_default.pif

stem.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll

stem.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll

nSolicitedRCUI.htm

nSolicitedRCUI.htm

rs.Soap.dll

rs.Soap.dll

SFC.DLL

SFC.DLL

WinExec

WinExec

yqyajqiaq.jjr

yqyajqiaq.jjr

c:\WINDOWS\yqyajqiaq.jjr

c:\WINDOWS\yqyajqiaq.jjr

bution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\byjayayar.abr

bution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\byjayayar.abr

aaar.iza

aaar.iza

ReadMe.exe

ReadMe.exe

c:\%original file name%.exe

c:\%original file name%.exe

t Menu\Programs\Startup\d8n8JNLkI.exe

t Menu\Programs\Startup\d8n8JNLkI.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ijjzza.iyjj.yjr

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ijjzza.iyjj.yjr

GetWindowsDirectoryA

GetWindowsDirectoryA

FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj

FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj

KERNEL32.dll

KERNEL32.dll


Related articles