Skip to main content

Virus.Win32.Duel_2342e85f06


Susp_Dropper (Kaspersky), DeepScan:Generic.Malware.SIM!g.4949519C (B) (Emsisoft), DeepScan:Generic.Malware.SIM!g.4949519C (AdAware), Virus.Win32.Duel.FD, GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)Behaviour: Worm, EmailWorm, Virus, IRCBot

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 2342e85f0607aa268dce106f4d1b3c71

SHA1: a9bb2a75e43d5d985799f896de2b60d94f74b43c

SHA256: cb5a15449ac1dbb057dafea66db084e677f6b1dae7f87a9cf2abf3c6bcbc33eb

SSDeep: 768:LmuP5ZwgnYJGIUvUjyREIpdvygNWDByToVHvyMnQd/cC2:LV4kUjyCDBimHU

Size: 43520 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company: Piriform Ltd

Created at: 2001-10-21 14:38:29

Analyzed on: WindowsXP SP3 32-bit

Summary: Virus. A program that recursively replicates a possibly evolved copy of itself.

Dynamic Analysis

Payload

Behaviour Description
EmailWormWorm can send e-mails.
IRCBotA bot can communicate with command and control servers via IRC channel.


Process activity

The Virus creates the following process(es):

iazzzarib.yqa:1488
iazzzarib.yqa:1640
wuauclt.exe:540
rzqyjaaar.iza:664
rzqyjaaar.iza:484
%original file name%.exe:512

The Virus injects its code into the following process(es):No processes have been created.

File activity

The process iazzzarib.yqa:1488 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\yjrabq.jzaa.rab (43 bytes)

The process iazzzarib.yqa:1640 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qiyziz.rqja.rab (43 bytes)

The process wuauclt.exe:540 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2016 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)

The Virus deletes the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\tmp.edb (0 bytes)

The process rzqyjaaar.iza:664 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\rzrbii.bzia.rab (43 bytes)

The process rzqyjaaar.iza:484 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Program Files%\MSN Gaming Zone\Windows\zbzbyqqjb.yjzy (43 bytes)
%WinDir%\inf\bijrazyiy.aib (43 bytes)
%Program Files%\Windows Media Player\yqyajqiaq.jjraib (43 bytes)
%WinDir%\byjayayar.abr.yjz (43 bytes)
%Program Files%\MSN Gaming Zone\Windows\iazzzarib.yqay (43 bytes)
%Program Files%\Windows Media Player\rzqyjaaar.iza (43 bytes)
%WinDir%\pchealth\helpctr\binaries\rzqyjaaar.iza (43 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\rzqyjaaar.iza (43 bytes)
%Program Files%\NetMeeting\rzqyjaaar.izabijrazyiy.aib (43 bytes)
%Program Files%\MSN Gaming Zone\Windows\bijrazyiy.aib (43 bytes)
%Program Files%\NetMeeting\yqyajqiaq.jjrbijrazyiy.aib (43 bytes)
%Program Files%\MSN Gaming Zone\Windows\byjayayar.abry (43 bytes)
%Program Files%\Outlook Express\iazzzarib.yqazyiy.aib (43 bytes)
%Program Files%\Windows NT\Accessories\abrrararq.qjyb (43 bytes)
%Program Files%\NetMeeting\rrrziiirr.qyrbijrazyiy.aib (43 bytes)
%Program Files%\Outlook Express\abrrararq.qjyzyiy.aib (43 bytes)
%Program Files%\Outlook Express\bijrazyiy.aibzyiy.aib (43 bytes)
%WinDir%\ime\imkr6_1\byjayayar.abr (43 bytes)
%WinDir%\ime\imjp8_1\rzqyjaaar.iza (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iiyara.bria.rab (43 bytes)
%Program Files%\Windows Media Player\rrrziiirr.qyr (43 bytes)
%Program Files%\Outlook Express\zbzbyqqjb.yjzzyiy.aib (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\bijrazyiy.aib (43 bytes)
%WinDir%\bijrazyiy.aib (43 bytes)
%Program Files%\Windows NT\Pinball\zbzbyqqjb.yjz.qjyb (43 bytes)

The process %original file name%.exe:512 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\rrrziiirr.qyr (43 bytes)
%Program Files%\Windows NT\Accessories\rzqyjaaar.izar (43 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\iazzzarib.yqa (43 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\bijrazyiy.aib (43 bytes)
%Program Files%\Common Files\Adobe\Updater6\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\zbzbyqqjb.yjz (43 bytes)
%Program Files%\WinPcap\zbzbyqqjb.yjzrrararq.qjy.izar (43 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\rrrziiirr.qyr (43 bytes)
%WinDir%\ime\imjp8_1\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\rrrziiirr.qyr (43 bytes)
%Program Files%\Outlook Express\zbzbyqqjb.yjzayar.abr (43 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\byjayayar.abriy.aibarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\bijrazyiy.aib (43 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza (43 bytes)
%WinDir%\ime\imjp8_1\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\byjayayar.abr (43 bytes)
%Program Files%\Windows Media Player\iazzzarib.yqaabr (43 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\byjayayar.abr (43 bytes)
C:\totalcmd\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\rrrziiirr.qyr (43 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\bijrazyiy.aib (43 bytes)
%WinDir%\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\rrrziiirr.qyr (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\abrrararq.qjy (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\abrrararq.qjy (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\abrrararq.qjy (43 bytes)
%WinDir%\Microsoft.NET\Framework\yqyajqiaq.jjr (43 bytes)
%Program Files%\MSN Gaming Zone\Windows\zbzbyqqjb.yjza (43 bytes)
%Program Files%\Windows NT\Pinball\abrrararq.qjy.izar (43 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\rzqyjaaar.iza (43 bytes)
%WinDir%\ime\imjp8_1\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\rzqyjaaar.iza (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\byjayayar.abr (43 bytes)
%Program Files%\Windows Media Player\bijrazyiy.aib (43 bytes)
%Program Files%\Windows NT\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\yqyajqiaq.jjr (43 bytes)
%Program Files%\Outlook Express\rzqyjaaar.izaayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\iazzzarib.yqa (43 bytes)
C:\totalcmd\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\abrrararq.qjy (43 bytes)
%WinDir%\inf\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\abrrararq.qjy (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bibzyj.ybra.rab (43 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\yqyajqiaq.jjr (43 bytes)
%Program Files%\NetMeeting\iazzzarib.yqabyjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\rzqyjaaar.iza (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\rrrziiirr.qyr (43 bytes)
%Program Files%\MSN Gaming Zone\Windows\abrrararq.qjya (43 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\rrrziiirr.qyr (43 bytes)
%Program Files%\NetMeeting\yqyajqiaq.jjrbyjayayar.abr (43 bytes)
%WinDir%\xwrm.exe (43 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\rrrziiirr.qyr (43 bytes)
%WinDir%\ime\imjp8_1\bijrazyiy.aib (43 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\iazzzarib.yqa (43 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\bijrazyiy.aib (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\bijrazyiy.aibarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\bijrazyiy.aib (43 bytes)
%WinDir%\ime\imjp8_1\yqyajqiaq.jjr (43 bytes)
%WinDir%\Network Diagnostic\abrrararq.qjy (43 bytes)
%Program Files%\NetMeeting\bijrazyiy.aibbyjayayar.abr (43 bytes)
%WinDir%\$hf_mig$\KB898461\update\iazzzarib.yqa.izar (43 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\bijrazyiy.aib (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\iazzzarib.yqa (43 bytes)
%WinDir%\$hf_mig$\KB898461\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\byjayayar.abr (43 bytes)
%WinDir%\pchealth\helpctr\binaries\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\abrrararq.qjy (43 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\yqyajqiaq.jjr (43 bytes)
%WinDir%\ime\imkr6_1\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\zbzbyqqjb.yjz (43 bytes)
%WinDir%\ime\imjp8_1\rrrziiirr.qyr (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib (43 bytes)
%Program Files%\MSN Gaming Zone\Windows\byjayayar.abr (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr (43 bytes)
%WinDir%\pchealth\helpctr\binaries\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\abrrararq.qjy (43 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\byjayayar.abr (43 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\rzqyjaaar.iza (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rzqyjaaar.iza (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\rzqyjaaar.iza (43 bytes)
%Program Files%\Windows Media Player\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\bijrazyiy.aib (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz (43 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\bijrazyiy.aib (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr (43 bytes)
%WinDir%\ime\imjp8_1\byjayayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\abrrararq.qjy (43 bytes)
C:\totalcmd\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\rrrziiirr.qyr (43 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\rzqyjaaar.iza (43 bytes)
%Program Files%\Outlook Express\byjayayar.abrayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\yqyajqiaq.jjr (43 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\iazzzarib.yqa (43 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\bijrazyiy.aib (43 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\byjayayar.abr (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\abrrararq.qjy (43 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\bijrazyiy.aib (43 bytes)
%Program Files%\MSN Gaming Zone\Windows\rrrziiirr.qyra (43 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\byjayayar.abr (43 bytes)
%Program Files%\Outlook Express\rrrziiirr.qyrayar.abr (43 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\rzqyjaaar.iza (43 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\rzqyjaaar.iza (43 bytes)

Registry activity

The process rzqyjaaar.iza:484 makes changes in the system registry.


The Virus creates and/or sets the following values in system registry:


To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"

The process %original file name%.exe:512 makes changes in the system registry.


The Virus creates and/or sets the following values in system registry:


To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"

Dropped PE files

MD5 File path
1f05b84537dfb8a5d027131edaffe105c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\bijrazyiy.aibarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\bibzyj.ybra.rab
1f05b84537dfb8a5d027131edaffe105c:\Perl\bin\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\Perl\bin\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\Perl\bin\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Adobe\Reader 9.0\Reader\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Adobe\Reader 9.0\Reader\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Adobe\Reader 9.0\Reader\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Adobe\Reader 9.0\Reader\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Adobe\Reader 9.0\Reader\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\byjayayar.abriy.aibarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Common Files\Adobe\ARM\1.0\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Common Files\Adobe\ARM\1.0\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Common Files\Adobe\ARM\1.0\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Common Files\Adobe\Updater6\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Common Files\Microsoft Shared\DW\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Common Files\Microsoft Shared\DW\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Common Files\Microsoft Shared\MSInfo\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\Program Files\MSN Gaming Zone\Windows\abrrararq.qjya
1f05b84537dfb8a5d027131edaffe105c:\Program Files\MSN Gaming Zone\Windows\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\Program Files\MSN Gaming Zone\Windows\rrrziiirr.qyra
5ac6cd4642fc24dc829bf5025a557efbc:\Program Files\MSN Gaming Zone\Windows\zClientm.exe
1f05b84537dfb8a5d027131edaffe105c:\Program Files\MSN Gaming Zone\Windows\zbzbyqqjb.yjza
5ac6cd4642fc24dc829bf5025a557efbc:\Program Files\MSN Gaming Zone\Windows\zclientm.exe
1f05b84537dfb8a5d027131edaffe105c:\Program Files\NetMeeting\bijrazyiy.aibbyjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\Program Files\NetMeeting\iazzzarib.yqabyjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\Program Files\NetMeeting\yqyajqiaq.jjrbyjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Outlook Express\byjayayar.abrayar.abr
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Outlook Express\rrrziiirr.qyrayar.abr
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Outlook Express\rzqyjaaar.izaayar.abr
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Outlook Express\zbzbyqqjb.yjzayar.abr
1f05b84537dfb8a5d027131edaffe105c:\Program Files\WinPcap\zbzbyqqjb.yjzrrararq.qjy.izar
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Windows Media Player\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Windows Media Player\iazzzarib.yqaabr
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Windows Media Player\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Windows NT\Accessories\rzqyjaaar.izar
faa1fde004b3c60b5a8068a7c3aab151c:\Program Files\Windows NT\Pinball\PINBALL.EXE
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Windows NT\Pinball\abrrararq.qjy.izar
faa1fde004b3c60b5a8068a7c3aab151c:\Program Files\Windows NT\Pinball\pinball.exe
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Windows NT\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Wireshark\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Wireshark\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Wireshark\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Wireshark\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Wireshark\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\Program Files\Wireshark\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\$NtUninstallKB898461$\spuninst\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\$hf_mig$\KB898461\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\$hf_mig$\KB898461\update\iazzzarib.yqa.izar
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\Microsoft.NET\Framework\yqyajqiaq.jjr
5e28284f9b5f9097640d58a73d38ad4cc:\WINDOWS\NOTEPAD.EXE
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\Network Diagnostic\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\ime\imjp8_1\abrrararq.qjy
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\ime\imjp8_1\bijrazyiy.aib
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\ime\imjp8_1\byjayayar.abr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\ime\imjp8_1\iazzzarib.yqa
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\ime\imjp8_1\rrrziiirr.qyr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\ime\imjp8_1\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\ime\imjp8_1\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\ime\imkr6_1\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\inf\abrrararq.qjy
5e28284f9b5f9097640d58a73d38ad4cc:\WINDOWS\notepad.exe
b32a4db8fa8ba07afb1e86f8c9fb852ec:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\pchealth\helpctr\binaries\byjayayar.abr
b32a4db8fa8ba07afb1e86f8c9fb852ec:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\pchealth\helpctr\binaries\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\xwrm.exe
1f05b84537dfb8a5d027131edaffe105c:\WINDOWS\zbzbyqqjb.yjz
1f05b84537dfb8a5d027131edaffe105c:\totalcmd\rzqyjaaar.iza
1f05b84537dfb8a5d027131edaffe105c:\totalcmd\yqyajqiaq.jjr
1f05b84537dfb8a5d027131edaffe105c:\totalcmd\zbzbyqqjb.yjz

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    iazzzarib.yqa:1488
    iazzzarib.yqa:1640
    wuauclt.exe:540
    rzqyjaaar.iza:664
    rzqyjaaar.iza:484
    %original file name%.exe:512

  2. Delete the original Virus file.
  3. Delete or disinfect the following files created/modified by the Virus:

    %Documents and Settings%\%current user%\Local Settings\Temp\yjrabq.jzaa.rab (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\qiyziz.rqja.rab (43 bytes)
    %WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
    %WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2016 bytes)
    %WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\rzrbii.bzia.rab (43 bytes)
    %Program Files%\MSN Gaming Zone\Windows\zbzbyqqjb.yjzy (43 bytes)
    %WinDir%\inf\bijrazyiy.aib (43 bytes)
    %Program Files%\Windows Media Player\yqyajqiaq.jjraib (43 bytes)
    %WinDir%\byjayayar.abr.yjz (43 bytes)
    %Program Files%\MSN Gaming Zone\Windows\iazzzarib.yqay (43 bytes)
    %Program Files%\Windows Media Player\rzqyjaaar.iza (43 bytes)
    %WinDir%\pchealth\helpctr\binaries\rzqyjaaar.iza (43 bytes)
    %Program Files%\Common Files\Microsoft Shared\MSInfo\rzqyjaaar.iza (43 bytes)
    %Program Files%\NetMeeting\rzqyjaaar.izabijrazyiy.aib (43 bytes)
    %Program Files%\MSN Gaming Zone\Windows\bijrazyiy.aib (43 bytes)
    %Program Files%\NetMeeting\yqyajqiaq.jjrbijrazyiy.aib (43 bytes)
    %Program Files%\MSN Gaming Zone\Windows\byjayayar.abry (43 bytes)
    %Program Files%\Outlook Express\iazzzarib.yqazyiy.aib (43 bytes)
    %Program Files%\Windows NT\Accessories\abrrararq.qjyb (43 bytes)
    %Program Files%\NetMeeting\rrrziiirr.qyrbijrazyiy.aib (43 bytes)
    %Program Files%\Outlook Express\abrrararq.qjyzyiy.aib (43 bytes)
    %Program Files%\Outlook Express\bijrazyiy.aibzyiy.aib (43 bytes)
    %WinDir%\ime\imkr6_1\byjayayar.abr (43 bytes)
    %WinDir%\ime\imjp8_1\rzqyjaaar.iza (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\iiyara.bria.rab (43 bytes)
    %Program Files%\Windows Media Player\rrrziiirr.qyr (43 bytes)
    %Program Files%\Outlook Express\zbzbyqqjb.yjzzyiy.aib (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\bijrazyiy.aib (43 bytes)
    %WinDir%\bijrazyiy.aib (43 bytes)
    %Program Files%\Windows NT\Pinball\zbzbyqqjb.yjz.qjyb (43 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\rrrziiirr.qyr (43 bytes)
    %Program Files%\Windows NT\Accessories\rzqyjaaar.izar (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\iazzzarib.yqa (43 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\bijrazyiy.aib (43 bytes)
    %Program Files%\Common Files\Adobe\Updater6\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\zbzbyqqjb.yjz (43 bytes)
    %Program Files%\WinPcap\zbzbyqqjb.yjzrrararq.qjy.izar (43 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\rrrziiirr.qyr (43 bytes)
    %WinDir%\ime\imjp8_1\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\rrrziiirr.qyr (43 bytes)
    %Program Files%\Outlook Express\zbzbyqqjb.yjzayar.abr (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\byjayayar.abriy.aibarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\bijrazyiy.aib (43 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza (43 bytes)
    %WinDir%\ime\imjp8_1\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\byjayayar.abr (43 bytes)
    %Program Files%\Windows Media Player\iazzzarib.yqaabr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\byjayayar.abr (43 bytes)
    C:\totalcmd\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\rrrziiirr.qyr (43 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\bijrazyiy.aib (43 bytes)
    %WinDir%\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\rrrziiirr.qyr (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\abrrararq.qjy (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\abrrararq.qjy (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\abrrararq.qjy (43 bytes)
    %WinDir%\Microsoft.NET\Framework\yqyajqiaq.jjr (43 bytes)
    %Program Files%\MSN Gaming Zone\Windows\zbzbyqqjb.yjza (43 bytes)
    %Program Files%\Windows NT\Pinball\abrrararq.qjy.izar (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\rzqyjaaar.iza (43 bytes)
    %WinDir%\ime\imjp8_1\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\rzqyjaaar.iza (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\byjayayar.abr (43 bytes)
    %Program Files%\Windows Media Player\bijrazyiy.aib (43 bytes)
    %Program Files%\Windows NT\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\yqyajqiaq.jjr (43 bytes)
    %Program Files%\Outlook Express\rzqyjaaar.izaayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\iazzzarib.yqa (43 bytes)
    C:\totalcmd\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\abrrararq.qjy (43 bytes)
    %WinDir%\inf\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\abrrararq.qjy (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\bibzyj.ybra.rab (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\yqyajqiaq.jjr (43 bytes)
    %Program Files%\NetMeeting\iazzzarib.yqabyjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\rzqyjaaar.iza (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\rrrziiirr.qyr (43 bytes)
    %Program Files%\MSN Gaming Zone\Windows\abrrararq.qjya (43 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\rrrziiirr.qyr (43 bytes)
    %Program Files%\NetMeeting\yqyajqiaq.jjrbyjayayar.abr (43 bytes)
    %WinDir%\xwrm.exe (43 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\rrrziiirr.qyr (43 bytes)
    %WinDir%\ime\imjp8_1\bijrazyiy.aib (43 bytes)
    %WinDir%\$NtUninstallKB898461$\spuninst\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\iazzzarib.yqa (43 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\bijrazyiy.aib (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\bijrazyiy.aibarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\bijrazyiy.aib (43 bytes)
    %WinDir%\ime\imjp8_1\yqyajqiaq.jjr (43 bytes)
    %WinDir%\Network Diagnostic\abrrararq.qjy (43 bytes)
    %Program Files%\NetMeeting\bijrazyiy.aibbyjayayar.abr (43 bytes)
    %WinDir%\$hf_mig$\KB898461\update\iazzzarib.yqa.izar (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\bijrazyiy.aib (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\iazzzarib.yqa (43 bytes)
    %WinDir%\$hf_mig$\KB898461\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\byjayayar.abr (43 bytes)
    %WinDir%\pchealth\helpctr\binaries\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\abrrararq.qjy (43 bytes)
    %Program Files%\Common Files\Microsoft Shared\MSInfo\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\yqyajqiaq.jjr (43 bytes)
    %WinDir%\ime\imkr6_1\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\ime\imjp8_1\rrrziiirr.qyr (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr (43 bytes)
    %WinDir%\pchealth\helpctr\binaries\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\abrrararq.qjy (43 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\byjayayar.abr (43 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\rzqyjaaar.iza (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rzqyjaaar.iza (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\bijrazyiy.aib (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\bijrazyiy.aib (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr (43 bytes)
    %WinDir%\ime\imjp8_1\byjayayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\abrrararq.qjy (43 bytes)
    C:\totalcmd\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\rrrziiirr.qyr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\rzqyjaaar.iza (43 bytes)
    %Program Files%\Outlook Express\byjayayar.abrayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\yqyajqiaq.jjr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\iazzzarib.yqa (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\bijrazyiy.aib (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\byjayayar.abr (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\abrrararq.qjy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\bijrazyiy.aib (43 bytes)
    %Program Files%\MSN Gaming Zone\Windows\rrrziiirr.qyra (43 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\byjayayar.abr (43 bytes)
    %Program Files%\Outlook Express\rrrziiirr.qyrayar.abr (43 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\rzqyjaaar.iza (43 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\rzqyjaaar.iza (43 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "x32x" = "%WinDir%\xwrm.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
byqabijr4096409615360.488602f2759d77180cc09ba2cc6c4b0928d167
azyiyaib819232768322565.083290c28de9733462720f17ac85f5b604233
yqyajqia4096040965120.46801303990ce32513f25d3855296b7bc8aa4d
qjjrrzqy45056409620483.924736481060bb77e469e5fdb95d8e5c6ab31

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

Strings from Dumps

rzqyjaaar.iza_484:

%U:mf

%U:mf

\xwrm.exe

\xwrm.exe

%WinDir%\xwrm.exe

%WinDir%\xwrm.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

USER %s 8 * :%s

USER %s 8 * :%s

NICK %s

NICK %s

PONG %s

PONG %s

JOIN #england

JOIN #england

PRIVMSG #england :.-:[X-Worm]:-.

PRIVMSG #england :.-:[X-Worm]:-.

irc.undernet.org

irc.undernet.org

MAIL FROM:<%s>

MAIL FROM:<%s>

RCPT TO:<%s>

RCPT TO:<%s>

--%s--

--%s--

From:<%s>

From:<%s>

To: %s

To: %s

Subject:%s

Subject:%s

boundary="%s"

boundary="%s"

X-Mailer: Microsoft Outlook Express 6.00.2800.1106

X-Mailer: Microsoft Outlook Express 6.00.2800.1106

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

charset="windows-1255"

charset="windows-1255"

name= "%s%s"

name= "%s%s"

Content-Disposition: attachment; filename="%s%s"

Content-Disposition: attachment; filename="%s%s"

Support

Support

No.reply

No.reply

8.txtt:

8.txtt:

8.htmt2

8.htmt2

8.rtft*

8.rtft*

8.doct"

8.doct"

8.bdxt

8.bdxt

8.phpt

8.phpt

8.jspt

8.jspt

8.cgit

8.cgit

smtp

smtp

ws2_32.dll

ws2_32.dll

youtube.com/

youtube.com/

3066501504

3066501504

30413451

30413451

3647761472

3647761472

30364468

30364468

174724992

174724992

30364473

30364473

f1=50000000&fv=11.6.602

f1=50000000&fv=11.6.602

3417176576

3417176576

30511319

30511319

3664171472

3664171472

1662467840

1662467840

30384585

30384585

3523231472

3523231472

51309bca6f1ff950.nXDDZaPivgeZvumVrvN5vWl8CTJPtoN02W3RMoLJs0rM7paMbRHuhAlAB9dHmax7o12GjM8vfF_FgHJgxSRJ7xZHBP3nONJPzXQyUDpPmiF6slA7VztIL-WFvJYOhRuK

51309bca6f1ff950.nXDDZaPivgeZvumVrvN5vWl8CTJPtoN02W3RMoLJs0rM7paMbRHuhAlAB9dHmax7o12GjM8vfF_FgHJgxSRJ7xZHBP3nONJPzXQyUDpPmiF6slA7VztIL-WFvJYOhRuK

yandex.ua/

yandex.ua/

2277636992

2277636992

31098723

31098723

3497761472

3497761472

1571151008

1571151008

ADVAPI32.DLL

ADVAPI32.DLL

RegOpenKeyExA

RegOpenKeyExA

RegCloseKey

RegCloseKey

User32.dll

User32.dll

temp_wincheck.txt

temp_wincheck.txt

08961-1801674531-1003

08961-1801674531-1003

TEMP_W~1.TXT

TEMP_W~1.TXT

8.exe

8.exe

8.scrtt

8.scrtt

8.avitJ

8.avitJ

8.doctB

8.doctB

8.mp3t:

8.mp3t:

8.mpgt2

8.mpgt2

8.xlst*

8.xlst*

8.jpgt"

8.jpgt"

8.zipt

8.zipt

8.isot

8.isot

8.pdft

8.pdft

8.pptt

8.pptt

8.rart

8.rart

c:\WINDOWS\_default.pif

c:\WINDOWS\_default.pif

tem.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll

tem.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll

nSolicitedRCUI.htm

nSolicitedRCUI.htm

rs.Soap.dll

rs.Soap.dll

SFC.DLL

SFC.DLL

WinExec

WinExec

yqyajqiaq.jjr

yqyajqiaq.jjr

c:\WINDOWS\yqyajqiaq.jjr

c:\WINDOWS\yqyajqiaq.jjr

bution\Download\e104dcd29adf1c6c473a5efad2d509be\sp3qfe\byjayayar.abr

bution\Download\e104dcd29adf1c6c473a5efad2d509be\sp3qfe\byjayayar.abr

ReadMe.exe

ReadMe.exe

c:\Program Files\Wireshark\rzqyjaaar.iza

c:\Program Files\Wireshark\rzqyjaaar.iza

1e.exe

1e.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\iiyara.bria.rab

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\iiyara.bria.rab

GetWindowsDirectoryA

GetWindowsDirectoryA

FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj

FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj

KERNEL32.dll

KERNEL32.dll