Virus.Win32.Duel_0eccf8ffae – Adaware

Susp_Dropper (Kaspersky), LooksLike.Win32.Malware!B (v) (VIPRE), Email-Worm.Win32.Brontok!IK (Emsisoft), Virus.Win32.Duel.FD, GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)Behaviour: Worm, Email-Worm, Virus, IRCBot

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 0eccf8ffaedfa97ac378dc5d35bdfbed

SHA1: 1d31e828cf2879eb42a6078ad29dc833e49c6509

SHA256: cf69e689e62bd9e75443114a809136c0df9203435f1c2ca9b800feef44fb5c0d

SSDeep: 384:b9pjxtBFdB1sU8zdd7H2o3UEUD4g94xtX8lsdFjJo7AzJdk:bDlFdB1sUPf94XXBdFOOJ2

Size: 53760 bytes

File type: PE32

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: no data

Summary: Email-Worm. Worm that spreads its copies in attachments included in emails.

Dynamic Analysis

Process activity

The Virus creates the following process(es):

zzzaribyq.abi:1328
zzzaribyq.abi:1520
0eccf8ffaedfa97ac378dc5d35bdfbed.exe:456

The Virus injects its code into the following process(es):

File activity

The process zzzaribyq.abi:1328 makes changes in a file system.

The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ariajb.jrqr.aba (53 bytes)

The process zzzaribyq.abi:1520 makes changes in a file system.

The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iyqyri.zjzr.aba (53 bytes)

The process 0eccf8ffaedfa97ac378dc5d35bdfbed.exe:456 makes changes in a file system.

The Virus creates and/or writes to the following file(s):

%WinDir%\ime\imjp8_1\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\jrazyiyai.byq (53 bytes)
%Program Files%\Outlook Express\yajqiaqjj.rrzrqqj.yzb (53 bytes)
%Program Files%\Windows NT\yajqiaqjj.rrz (53 bytes)
%WinDir%\$hf_mig$\KB898461\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\zzzaribyq.abi (53 bytes)
%Program Files%\Windows Media Player\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\rrararqqj.yzb (53 bytes)
%Program Files%\Wireshark\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\rziiirrqy.rab (53 bytes)
C:\Perl\bin\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\jayayarab.ria (53 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\rrararqqj.yzb (53 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\rziiirrqy.rab (53 bytes)
D:\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\rrararqqj.yzb (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\yajqiaqjj.rrz (53 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\jrazyiyai.byq (53 bytes)
%Program Files%\Windows Media Player\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\zbyqqjbyj.zby (53 bytes)
%WinDir%\pchealth\helpctr\binaries\zzzaribyq.abi (53 bytes)
%WinDir%\ime\imjp8_1\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\jayayarab.ria (53 bytes)
%WinDir%\Network Diagnostic\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\jrazyiyai.byq (53 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jayayarab.ria (53 bytes)
%WinDir%\ime\imjp8_1\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\zzzaribyq.abi (53 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qyjaaariz.arr (53 bytes)
%WinDir%\ime\imjp8_1\zzzaribyq.abi (53 bytes)
%Program Files%\NetMeeting\zbyqqjbyj.zbyrrararqqj.yzb (53 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\qyjaaariz.arr (53 bytes)
%WinDir%\ime\imkr6_1\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\yajqiaqjj.rrz (53 bytes)
%Program Files%\Wireshark\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\yajqiaqjj.rrz (53 bytes)
%Program Files%\WinPcap\rziiirrqy.rabjaaariz.arr.byqb (53 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\zzzaribyq.abi (53 bytes)
%WinDir%\ime\imjp8_1\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\qyjaaariz.arr (53 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yajqiaqjj.rrz (53 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\jrazyiyai.byq (53 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\zzzaribyq.abi (53 bytes)
%Program Files%\NetMeeting\jayayarab.riarrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\yajqiaqjj.rrz (53 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\zbyqqjbyj.zby (53 bytes)
%Program Files%\Outlook Express\rziiirrqy.rabrqqj.yzb (53 bytes)
C:\Perl\bin\qyjaaariz.arr (53 bytes)
C:\totalcmd\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\jrazyiyai.byq (53 bytes)
%WinDir%\Microsoft.NET\Framework\zzzaribyq.abi (53 bytes)
%WinDir%\rziiirrqy.rab (53 bytes)
%Program Files%\Common Files\Adobe\Updater6\qyjaaariz.arr (53 bytes)
%Program Files%\Wireshark\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\yajqiaqjj.rrz (53 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\jayayarab.ria (53 bytes)
C:\Perl\bin\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\jrazyiyai.byq (53 bytes)
%Program Files%\Outlook Express\jrazyiyai.byqrqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\jayayarab.ria (53 bytes)
%Program Files%\MSN Gaming Zone\Windows\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\zzzaribyq.abi (53 bytes)
%Program Files%\Windows NT\Pinball\qyjaaariz.arr.byqb (53 bytes)
%Program Files%\Wireshark\qyjaaariz.arr (53 bytes)
%Program Files%\MSN Gaming Zone\Windows\qyjaaariz.arrq (53 bytes)
%WinDir%\xwrm.exe (53 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\rrararqqj.yzb (53 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\rrararqqj.yzb (53 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yajqiaqjj.rrz (53 bytes)
%Program Files%\Outlook Express\rrararqqj.yzbrqqj.yzb (53 bytes)
%Program Files%\Windows NT\Accessories\jrazyiyai.byqb (53 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\zbyqqjbyj.zby (53 bytes)
C:\totalcmd\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\qyjaaariz.arr (53 bytes)
%WinDir%\pchealth\helpctr\binaries\rrararqqj.yzb (53 bytes)
%WinDir%\inf\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\qyjaaariz.arr (53 bytes)
%WinDir%\ime\imjp8_1\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\rrararqqj.yzb (53 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\rziiirrqy.rab (53 bytes)
%WinDir%\ime\imjp8_1\qyjaaariz.arr (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\zbyqqjbyj.zbyrqqj.yzb (53 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\qyjaaariz.arr (53 bytes)
%WinDir%\$hf_mig$\KB898461\update\zbyqqjbyj.zby.byqb (53 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\jayayarab.ria (53 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\rziiirrqy.rab (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bzaaiy.rbrr.aba (53 bytes)
%Program Files%\MSN Gaming Zone\Windows\rziiirrqy.rabq (53 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\qyjaaariz.arr (53 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\zbyqqjbyj.zby (53 bytes)
%Program Files%\Windows Media Player\zbyqqjbyj.zbyyzb (53 bytes)
%Program Files%\NetMeeting\zzzaribyq.abirrararqqj.yzb (53 bytes)
%Program Files%\Wireshark\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\qyjaaariz.arr (53 bytes)
%Program Files%\Wireshark\yajqiaqjj.rrz (53 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\zbyqqjbyj.zby (53 bytes)
%Program Files%\MSN Gaming Zone\Windows\yajqiaqjj.rrzq (53 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\rrararqqj.yzbyj.zbyrqqj.yzb (53 bytes)
C:\totalcmd\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\qyjaaariz.arr (53 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\jayayarab.ria (53 bytes)

Registry activity

The process 0eccf8ffaedfa97ac378dc5d35bdfbed.exe:456 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"

Network activity (URLs)

A bot communicates with command and control servers via IRC channel.No activity has been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Worm that spreads its copies in attachments included in emails.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
zzzaribyq.abi:1328
zzzaribyq.abi:1520
0eccf8ffaedfa97ac378dc5d35bdfbed.exe:456
Delete the original Virus file.
Delete or disinfect the following files created/modified by the Virus:
%Documents and Settings%\%current user%\Local Settings\Temp\ariajb.jrqr.aba (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iyqyri.zjzr.aba (53 bytes)
%WinDir%\ime\imjp8_1\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\jrazyiyai.byq (53 bytes)
%Program Files%\Outlook Express\yajqiaqjj.rrzrqqj.yzb (53 bytes)
%Program Files%\Windows NT\yajqiaqjj.rrz (53 bytes)
%WinDir%\$hf_mig$\KB898461\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\zzzaribyq.abi (53 bytes)
%Program Files%\Windows Media Player\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\rrararqqj.yzb (53 bytes)
%Program Files%\Wireshark\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\rziiirrqy.rab (53 bytes)
C:\Perl\bin\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\jayayarab.ria (53 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\rrararqqj.yzb (53 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\rziiirrqy.rab (53 bytes)
D:\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\rrararqqj.yzb (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\yajqiaqjj.rrz (53 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\jrazyiyai.byq (53 bytes)
%Program Files%\Windows Media Player\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\zbyqqjbyj.zby (53 bytes)
%WinDir%\pchealth\helpctr\binaries\zzzaribyq.abi (53 bytes)
%WinDir%\ime\imjp8_1\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\jayayarab.ria (53 bytes)
%WinDir%\Network Diagnostic\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\jrazyiyai.byq (53 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jayayarab.ria (53 bytes)
%WinDir%\ime\imjp8_1\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\zzzaribyq.abi (53 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qyjaaariz.arr (53 bytes)
%WinDir%\ime\imjp8_1\zzzaribyq.abi (53 bytes)
%Program Files%\NetMeeting\zbyqqjbyj.zbyrrararqqj.yzb (53 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\qyjaaariz.arr (53 bytes)
%WinDir%\ime\imkr6_1\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\yajqiaqjj.rrz (53 bytes)
%Program Files%\Wireshark\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\yajqiaqjj.rrz (53 bytes)
%Program Files%\WinPcap\rziiirrqy.rabjaaariz.arr.byqb (53 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\zzzaribyq.abi (53 bytes)
%WinDir%\ime\imjp8_1\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\qyjaaariz.arr (53 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yajqiaqjj.rrz (53 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\jrazyiyai.byq (53 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\zzzaribyq.abi (53 bytes)
%Program Files%\NetMeeting\jayayarab.riarrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\yajqiaqjj.rrz (53 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\zbyqqjbyj.zby (53 bytes)
%Program Files%\Outlook Express\rziiirrqy.rabrqqj.yzb (53 bytes)
C:\Perl\bin\qyjaaariz.arr (53 bytes)
C:\totalcmd\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\jrazyiyai.byq (53 bytes)
%WinDir%\Microsoft.NET\Framework\zzzaribyq.abi (53 bytes)
%WinDir%\rziiirrqy.rab (53 bytes)
%Program Files%\Common Files\Adobe\Updater6\qyjaaariz.arr (53 bytes)
%Program Files%\Wireshark\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\yajqiaqjj.rrz (53 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\jayayarab.ria (53 bytes)
C:\Perl\bin\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\jrazyiyai.byq (53 bytes)
%Program Files%\Outlook Express\jrazyiyai.byqrqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\jayayarab.ria (53 bytes)
%Program Files%\MSN Gaming Zone\Windows\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\zzzaribyq.abi (53 bytes)
%Program Files%\Windows NT\Pinball\qyjaaariz.arr.byqb (53 bytes)
%Program Files%\Wireshark\qyjaaariz.arr (53 bytes)
%Program Files%\MSN Gaming Zone\Windows\qyjaaariz.arrq (53 bytes)
%WinDir%\xwrm.exe (53 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\rrararqqj.yzb (53 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\rrararqqj.yzb (53 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yajqiaqjj.rrz (53 bytes)
%Program Files%\Outlook Express\rrararqqj.yzbrqqj.yzb (53 bytes)
%Program Files%\Windows NT\Accessories\jrazyiyai.byqb (53 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\zbyqqjbyj.zby (53 bytes)
C:\totalcmd\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\qyjaaariz.arr (53 bytes)
%WinDir%\pchealth\helpctr\binaries\rrararqqj.yzb (53 bytes)
%WinDir%\inf\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\qyjaaariz.arr (53 bytes)
%WinDir%\ime\imjp8_1\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\rrararqqj.yzb (53 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\rrararqqj.yzb (53 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\rziiirrqy.rab (53 bytes)
%WinDir%\ime\imjp8_1\qyjaaariz.arr (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\zbyqqjbyj.zbyrqqj.yzb (53 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\qyjaaariz.arr (53 bytes)
%WinDir%\$hf_mig$\KB898461\update\zbyqqjbyj.zby.byqb (53 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\jayayarab.ria (53 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\rziiirrqy.rab (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bzaaiy.rbrr.aba (53 bytes)
%Program Files%\MSN Gaming Zone\Windows\rziiirrqy.rabq (53 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\qyjaaariz.arr (53 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\qyjaaariz.arr (53 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\zbyqqjbyj.zby (53 bytes)
%Program Files%\Windows Media Player\zbyqqjbyj.zbyyzb (53 bytes)
%Program Files%\NetMeeting\zzzaribyq.abirrararqqj.yzb (53 bytes)
%Program Files%\Wireshark\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\qyjaaariz.arr (53 bytes)
%Program Files%\Wireshark\yajqiaqjj.rrz (53 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\zbyqqjbyj.zby (53 bytes)
%Program Files%\MSN Gaming Zone\Windows\yajqiaqjj.rrzq (53 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\rrararqqj.yzbyj.zbyrqqj.yzb (53 bytes)
C:\totalcmd\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\rziiirrqy.rab (53 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\jayayarab.ria (53 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\yajqiaqjj.rrz (53 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\zbyqqjbyj.zby (53 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\qyjaaariz.arr (53 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\zzzaribyq.abi (53 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\jrazyiyai.byq (53 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\jayayarab.ria (53 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

Network Activity

Map

Strings from Dumps