Skip to main content

Virus.Win32.Duel_cf3661dcd2


HEUR:Trojan.Win32.Generic (Kaspersky), LooksLike.Win32.Malware!B (v) (VIPRE), Email-Worm.Win32.Brontok!IK (Emsisoft), Virus.Win32.Duel.FD, GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)Behaviour: Trojan, Worm, Email-Worm, Virus, IRCBot

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: cf3661dcd24f11b7380366fda6a5acef

SHA1: 24578403052b1767205126d1f12a4e22b0f066e5

SHA256: f71a974ddac7a3fbd5da31d6e746563230f2bd47b8d15227c0a12e54dd09c49e

SSDeep: 768: C88KC9mdElNT8tPmEit1B8BTy1iWU2HRGk32stAE2:VHHmENB0y142HRGcb

Size: 39936 bytes

File type: PE32

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 1984-02-11 03:05:10

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Process activity

The Virus creates the following process(es):

rqyrabrra.rar:4012
rqyrabrra.rar:1576

The Virus injects its code into the following process(es):

cf3661dcd24f11b7380366fda6a5acef.exe:2576

File activity

The process rqyrabrra.rar:4012 makes changes in a file system.


The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zrjzaz.zzyz.jri (39 bytes)

The process rqyrabrra.rar:1576 makes changes in a file system.


The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qarzbj.rajz.jri (39 bytes)

The process cf3661dcd24f11b7380366fda6a5acef.exe:2576 makes changes in a file system.


The Virus creates and/or writes to the following file(s):

%WinDir%\$NtUninstallKB2508429$\spuninst\abijrazyi.yai (39 bytes)
%WinDir%\$hf_mig$\KB2481109\yzbzbyqqj.byj (39 bytes)
%WinDir%\$hf_mig$\KB2779030\rabrrarar.qqj (39 bytes)
%WinDir%\$hf_mig$\KB973815\abijrazyi.yai (39 bytes)
%WinDir%\$hf_mig$\KB2483185\update\abijrazyi.yai (39 bytes)
%WinDir%\$hf_mig$\KB2624667\update\rrzqyjaaa.riz.riz (39 bytes)
%WinDir%\$hf_mig$\KB975560\update\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB971657\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB2749655\update\arrrziiir.rqy.qjj (39 bytes)
%Program Files%\Windows Media Player\rizarrrzi.iir (39 bytes)
%WinDir%\$hf_mig$\KB979309\update\abijrazyi.yai (39 bytes)
%WinDir%\$hf_mig$\KB2585542\zbyjayaya.rab (39 bytes)
%WinDir%\$hf_mig$\KB979482\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB923561\SP3QFE\rrzqyjaaa.rizq.qjj (39 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rizarrrzi.iir (39 bytes)
%WinDir%\$hf_mig$\KB2506212\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB2584146\update\yzbzbyqqj.byj (39 bytes)
%WinDir%\$NtUninstallKB2485663$\spuninst\yzbzbyqqj.byj (39 bytes)
%Program Files%\MSN Gaming Zone\Windows\yaibyqyaj.qia (39 bytes)
%WinDir%\$hf_mig$\KB2598479\rrzqyjaaa.riz (39 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rabriazzz.ari (39 bytes)
%WinDir%\$hf_mig$\KB2393802\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2393802\SP3QFE\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB959426\update\yzbzbyqqj.byj (39 bytes)
%Program Files%\Windows Media Player\rqyrabrra.rar (39 bytes)
%WinDir%\$hf_mig$\KB974392\update\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB956802\abijrazyi.yai (39 bytes)
%WinDir%\$hf_mig$\KB952287\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2393802\update\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB2676562\update\rrzqyjaaa.riz (39 bytes)
%WinDir%\$NtUninstallKB2387149$\spuninst\rabrrarar.qqj (39 bytes)
%WinDir%\$hf_mig$\KB2592799\abijrazyi.yai (39 bytes)
%WinDir%\$hf_mig$\KB2712808\update\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB975560\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB946648\yzbzbyqqj.byj (39 bytes)
%WinDir%\$hf_mig$\KB982381-IE8\SP3QFE\byqyajqia.qjj (39 bytes)
C:\Perl\bin\byjzbyjay.aya (39 bytes)
%Program Files%\Wireshark\rizarrrzi.iir (39 bytes)
%WinDir%\$hf_mig$\KB2655992\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2618444-IE8\update\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB2229593\update\zbyjayaya.rabqqja (39 bytes)
%WinDir%\$hf_mig$\KB2603381\zbyjayaya.rab (39 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\yaibyqyaj.qia (39 bytes)
%WinDir%\$hf_mig$\KB975025\update\riazzzari.byq (39 bytes)
%Program Files%\MSN Gaming Zone\Windows\byjzbyjay.ayaj (39 bytes)
%WinDir%\$hf_mig$\KB2508429\update\abijrazyi.yai (39 bytes)
%WinDir%\$hf_mig$\KB2631813\arrrziiir.rqy (39 bytes)
C:\totalcmd\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB950974\byqyajqia.qjj (39 bytes)
%WinDir%\$NtUninstallKB2479943$\spuninst\abijrazyi.yai (39 bytes)
%Program Files%\Windows NT\byjzbyjay.aya (39 bytes)
%WinDir%\$hf_mig$\KB979482\update\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB2799329\zbyjayaya.rab (39 bytes)
%WinDir%\$hf_mig$\KB978542\update\arrrziiir.rqy (39 bytes)
%Program Files%\Windows NT\Accessories\qqjyzbzby.qqja (39 bytes)
%WinDir%\$hf_mig$\KB982132\update\abijrazyi.yai (39 bytes)
%WinDir%\$hf_mig$\KB2698365\update\abijrazyi.yai (39 bytes)
%WinDir%\$hf_mig$\KB956844\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB974571\update\yzbzbyqqj.byj (39 bytes)
%WinDir%\$hf_mig$\KB2478960\update\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2476490\zbyjayaya.rab (39 bytes)
%WinDir%\$hf_mig$\KB956744\update\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB955759\yzbzbyqqj.byj (39 bytes)
%WinDir%\$hf_mig$\KB2229593\yzbzbyqqj.byj (39 bytes)
%WinDir%\$hf_mig$\KB952287\update\rrzqyjaaa.rizq.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2603381\update\riazzzari.byq.byj (39 bytes)
%WinDir%\$hf_mig$\KB898461\abijrazyi.yai (39 bytes)
%WinDir%\$hf_mig$\KB974318\abijrazyi.yai (39 bytes)
%Program Files%\NetMeeting\rizarrrzi.iiryaibyqyaj.qia (39 bytes)
%WinDir%\$hf_mig$\KB2758857\zbyjayaya.rab (39 bytes)
%WinDir%\$NtUninstallKB2544521$\spuninst\arrrziiir.rqy (39 bytes)
%WinDir%\$NtUninstallKB2478960$\spuninst\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB2570947\update\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB2598845-IE8\update\yzbzbyqqj.byj (39 bytes)
%WinDir%\$hf_mig$\KB2719985\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB2570947\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB960859\SP3QFE\abijrazyi.yai (39 bytes)
%WinDir%\$hf_mig$\KB968389\update\yzbzbyqqj.byj (39 bytes)
%WinDir%\$hf_mig$\KB2481109\update\zbyjayaya.rab (39 bytes)
%WinDir%\$hf_mig$\KB982132\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB973507\update\riazzzari.byq (39 bytes)
C:\Perl\bin\rabriazzz.ari (39 bytes)
%WinDir%\$hf_mig$\KB2686509\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB959426\rabrrarar.qqj (39 bytes)
%WinDir%\$hf_mig$\KB2585542\update\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB2506212\update\rabrrarar.qqj (39 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yaibyqyaj.qia (39 bytes)
%Program Files%\Wireshark\qqjyzbzby.qqj (39 bytes)
%WinDir%\$hf_mig$\KB975025\zbyjayaya.rab (39 bytes)
%WinDir%\$hf_mig$\KB2655992\update\rrzqyjaaa.riz.riz (39 bytes)
%WinDir%\$hf_mig$\KB2387149\update\rabrrarar.qqjqqja (39 bytes)
%WinDir%\$hf_mig$\KB2115168\update\rabrrarar.qqjqqja (39 bytes)
%WinDir%\$hf_mig$\KB2749655\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB946648\update\zbyjayaya.rabq.qjj (39 bytes)
%WinDir%\$hf_mig$\KB978338\update\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2758857\update\riazzzari.byq.qjj (39 bytes)
%WinDir%\$hf_mig$\KB982665\update\yzbzbyqqj.byj.rqy (39 bytes)
%WinDir%\$hf_mig$\KB960803\update\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB974112\update\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB952954\update\rabrrarar.qqjq.qjj (39 bytes)
%WinDir%\$hf_mig$\KB956744\zbyjayaya.rab (39 bytes)
%WinDir%\$hf_mig$\KB981997\yzbzbyqqj.byj (39 bytes)
%WinDir%\$hf_mig$\KB971029\abijrazyi.yai (39 bytes)
%WinDir%\$NtUninstallKB2566454$\spuninst\yzbzbyqqj.byj (39 bytes)
%WinDir%\$hf_mig$\KB952004\update\abijrazyi.yaiq.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2686509\update\rabrrarar.qqj (39 bytes)
%WinDir%\$hf_mig$\KB2770660\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB2544521\update\zbyjayaya.rab (39 bytes)
%WinDir%\$NtUninstallKB2584146$\spuninst\abijrazyi.yai (39 bytes)
%WinDir%\$hf_mig$\KB2347290\update\abijrazyi.yaiqqja (39 bytes)
%WinDir%\$hf_mig$\KB951978\yzbzbyqqj.byj (39 bytes)
%Program Files%\Wireshark\qjjrrzqyj.aaa (39 bytes)
%WinDir%\$hf_mig$\KB2691442\yzbzbyqqj.byj (39 bytes)
%Documents and Settings%\All Users\Application Data\Adobe\Reader\9.3\ARM\18298\yaibyqyaj.qia (39 bytes)
%WinDir%\$NtUninstallKB2443105$\spuninst\rabrrarar.qqj (39 bytes)
%WinDir%\$NtUninstallKB2510581$\spuninst\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2115168\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB960803\zbyjayaya.rab (39 bytes)
%WinDir%\$hf_mig$\KB2347290\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB2724197\update\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB2799329\update\riazzzari.byq.qjj (39 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\qjjrrzqyj.aaa (39 bytes)
%WinDir%\$hf_mig$\KB2620712\update\abijrazyi.yai.riz (39 bytes)
%WinDir%\$hf_mig$\KB975467\update\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2467659\rabrrarar.qqj (39 bytes)
%WinDir%\$hf_mig$\KB2712808\byqyajqia.qjj (39 bytes)
%WinDir%\$NtUninstallKB2570947$\spuninst\zbyjayaya.rab (39 bytes)
%WinDir%\$hf_mig$\KB973904\update\yzbzbyqqj.byj (39 bytes)
%Program Files%\Wireshark\rqyrabrra.rar (39 bytes)
%WinDir%\$hf_mig$\KB950974\update\rrzqyjaaa.rizq.qjj (39 bytes)
%Program Files%\MSN Gaming Zone\Windows\byqabijra.zyij (39 bytes)
%WinDir%\$hf_mig$\KB973815\update\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2761465\update\byqyajqia.qjj.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2479943\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB2661637\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB977816\update\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB978706\update\zbyjayaya.rab (39 bytes)
%WinDir%\$hf_mig$\KB898461\update\byqyajqia.qjjq.qjj (39 bytes)
%WinDir%\$hf_mig$\KB969059\zbyjayaya.rab (39 bytes)
%WinDir%\$hf_mig$\KB2584146\rabrrarar.qqj (39 bytes)
%WinDir%\$hf_mig$\KB956572\SP3QFE\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2481109\SP3QFE\rabrrarar.qqj (39 bytes)
C:\totalcmd\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB973869\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB950762\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB2757638\rabrrarar.qqj (39 bytes)
%WinDir%\$hf_mig$\KB2508429\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB2592799\update\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2535512\update\rabrrarar.qqj (39 bytes)
%WinDir%\$hf_mig$\KB2727528\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB979309\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB973507\zbyjayaya.rab (39 bytes)
%WinDir%\$hf_mig$\KB2744842-IE8\abijrazyi.yai (39 bytes)
%WinDir%\$hf_mig$\KB2661637\update\rabrrarar.qqj.riz (39 bytes)
%WinDir%\$hf_mig$\KB974112\zbyjayaya.rab (39 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byqabijra.zyi (39 bytes)
%WinDir%\$hf_mig$\KB2423089\zbyjayaya.rab (39 bytes)
%WinDir%\$hf_mig$\KB977816\zbyjayaya.rab (39 bytes)
%WinDir%\$NtUninstallKB2481109$\spuninst\arrrziiir.rqy (39 bytes)
%Documents and Settings%\All Users\Application Data\Adobe\Reader\9.3\ARM\18298\byqabijra.zyi (39 bytes)
%WinDir%\$hf_mig$\KB2646524\update\zbyjayaya.rab.riz (39 bytes)
%WinDir%\$hf_mig$\KB956572\SP3QFE\riazzzari.byq (39 bytes)
%Program Files%\Wireshark\jrabayyrr.azj (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\byjzbyjay.ayabzby.qqj (39 bytes)
%WinDir%\$NtUninstallKB2535512$\spuninst\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB2620712\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB2618444-IE8\SP3QFE\abijrazyi.yai (39 bytes)
%WinDir%\$NtUninstallKB2440591$\spuninst\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB2483185\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB982381-IE8\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB956572\rabrrarar.qqj (39 bytes)
%WinDir%\$hf_mig$\KB2535512\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB2544521\yzbzbyqqj.byj (39 bytes)
%Program Files%\NetMeeting\rqyrabrra.raryaibyqyaj.qia (39 bytes)
%WinDir%\$hf_mig$\KB2507938\update\zbyjayaya.rab (39 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rqyrabrra.rar (39 bytes)
%WinDir%\$hf_mig$\KB2440591\abijrazyi.yai (39 bytes)
%WinDir%\$hf_mig$\KB2619339\update\zbyjayaya.rab.riz (39 bytes)
%WinDir%\$NtUninstallKB2592799$\spuninst\rrzqyjaaa.riz (39 bytes)
C:\Perl\bin\qqjyzbzby.qqj (39 bytes)
%WinDir%\$hf_mig$\KB2387149\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB2691442\update\zbyjayaya.rab (39 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\yaibyqyaj.qia (39 bytes)
%WinDir%\$hf_mig$\KB2624667\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2360937\update\rrzqyjaaa.rizqqja (39 bytes)
%Program Files%\WinPcap\byqabijra.zyibriazzz.ari.qqja (39 bytes)
%WinDir%\$hf_mig$\KB951978\update\zbyjayaya.rabq.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2618451\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB2479943\update\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB2727528\update\rabrrarar.qqj (39 bytes)
%WinDir%\$hf_mig$\KB2631813\update\rabrrarar.qqj.riz (39 bytes)
%WinDir%\$hf_mig$\KB955759\update\zbyjayaya.rabq.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2566454\update\abijrazyi.yai (39 bytes)
%WinDir%\$hf_mig$\KB960859\SP3QFE\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2724197\byqyajqia.qjj (39 bytes)
%WinDir%\xwrm.exe (39 bytes)
%WinDir%\$hf_mig$\KB2478960\abijrazyi.yai (39 bytes)
%WinDir%\$hf_mig$\KB2744842-IE8\SP3QFE\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB974392\rrzqyjaaa.riz (39 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\qqjyzbzby.qqj (39 bytes)
%WinDir%\$NtUninstallKB2506212$\spuninst\zbyjayaya.rab (39 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\qjjrrzqyj.aaa (39 bytes)
%WinDir%\$NtUninstallKB2378111_WM9$\spuninst\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB2507938\yzbzbyqqj.byj (39 bytes)
%WinDir%\$hf_mig$\KB2510581\update\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB975467\abijrazyi.yai (39 bytes)
%WinDir%\$hf_mig$\KB2646524\yzbzbyqqj.byj (39 bytes)
%WinDir%\$hf_mig$\KB956572\update\yzbzbyqqj.byj (39 bytes)
%WinDir%\$hf_mig$\KB2618451\update\rabrrarar.qqj.riz (39 bytes)
%WinDir%\$hf_mig$\KB2676562\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2598845-IE8\rabrrarar.qqj (39 bytes)
%WinDir%\$NtUninstallKB2507938$\spuninst\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB982665\rabrrarar.qqj (39 bytes)
%Program Files%\Wireshark\zbzijaarr.jbz (39 bytes)
%Documents and Settings%\All Users\Application Data\Adobe\Reader\9.3\ARM\18298\rabriazzz.ari (39 bytes)
%WinDir%\$hf_mig$\KB960859\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB972270\update\yzbzbyqqj.byj (39 bytes)
%WinDir%\$hf_mig$\KB2440591\update\byqyajqia.qjj (39 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byjzbyjay.aya (39 bytes)
%WinDir%\$hf_mig$\KB2618444-IE8\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2423089\SP3QFE\yzbzbyqqj.byj (39 bytes)
%WinDir%\$NtUninstallKB2483185$\spuninst\rabrrarar.qqj (39 bytes)
%WinDir%\$NtUninstallKB2393802$\spuninst\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB2467659\update\yzbzbyqqj.byj (39 bytes)
%WinDir%\$hf_mig$\KB923561\arrrziiir.rqy (39 bytes)
%Program Files%\Windows Media Player\qjjrrzqyj.aaaqia (39 bytes)
%WinDir%\$NtUninstallKB2476490$\spuninst\zbyjayaya.rab (39 bytes)
%WinDir%\$hf_mig$\KB978706\SP3QFE\rabrrarar.qqj (39 bytes)
%Program Files%\Common Files\Adobe\Updater6\rabriazzz.ari (39 bytes)
%WinDir%\$hf_mig$\KB2757638\update\yzbzbyqqj.byj.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2443105\update\arrrziiir.rqy (39 bytes)
%WinDir%\$NtUninstallKB2467659$\spuninst\yzbzbyqqj.byj (39 bytes)
%WinDir%\$NtUninstallKB2585542$\spuninst\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB923561\update\rabrrarar.qqjq.qjj (39 bytes)
%Program Files%\Outlook Express\byjzbyjay.ayaqyaj.qia (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\qqjyzbzby.qqj (39 bytes)
%WinDir%\$hf_mig$\KB2653956\update\abijrazyi.yai.riz (39 bytes)
%Program Files%\MSN Gaming Zone\Windows\rabriazzz.arij (39 bytes)
%WinDir%\$hf_mig$\KB2566454\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB952004\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB981322\update\rabrrarar.qqj (39 bytes)
%Program Files%\NetMeeting\qjjrrzqyj.aaayaibyqyaj.qia (39 bytes)
%WinDir%\$hf_mig$\KB2598479\update\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB982381-IE8\update\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB950762\update\abijrazyi.yaiq.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2476490\update\riazzzari.byq (39 bytes)
%WinDir%\$NtUninstallKB2598479$\spuninst\arrrziiir.rqy (39 bytes)
%WinDir%\$NtUninstallKB2584146$\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB2761465\abijrazyi.yai (39 bytes)
%WinDir%\$hf_mig$\KB973869\update\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB2779030\update\yzbzbyqqj.byj.qjj (39 bytes)
%WinDir%\$NtUninstallKB2423089$\spuninst\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB952954\arrrziiir.rqy (39 bytes)
%WinDir%\$NtUninstallKB2419632$\spuninst\abijrazyi.yai (39 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\byqabijra.zyi (39 bytes)
%WinDir%\$hf_mig$\KB951978\SP3QFE\rabrrarar.qqjq.qjj (39 bytes)
%WinDir%\$hf_mig$\KB973904\rabrrarar.qqj (39 bytes)
%WinDir%\$hf_mig$\KB956802\update\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB971657\update\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB2360937\byqyajqia.qjj (39 bytes)
C:\totalcmd\zbyjayaya.rab (39 bytes)
%WinDir%\$hf_mig$\KB2653956\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB969059\update\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB974318\update\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB975713\rabrrarar.qqj (39 bytes)
%WinDir%\$hf_mig$\KB2584146\SP3QFE\arrrziiir.rqy (39 bytes)
%WinDir%\$NtUninstallKB2564958$\spuninst\rabrrarar.qqj (39 bytes)
%WinDir%\$hf_mig$\KB2485663\update\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB2770660\update\arrrziiir.rqy.qjj (39 bytes)
%WinDir%\$hf_mig$\KB2419632\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB2698365\riazzzari.byq (39 bytes)
%WinDir%\$hf_mig$\KB974571\rabrrarar.qqj (39 bytes)
%WinDir%\$hf_mig$\KB978338\abijrazyi.yai (39 bytes)
%WinDir%\$hf_mig$\KB968389\rabrrarar.qqj (39 bytes)
%WinDir%\$hf_mig$\KB981322\arrrziiir.rqy (39 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\qqjyzbzby.qqj (39 bytes)
%WinDir%\$hf_mig$\KB2443105\rrzqyjaaa.riz (39 bytes)
%Documents and Settings%\All Users\Application Data\Adobe\Reader\9.3\ARM\18298\qjjrrzqyj.aaa (39 bytes)
%WinDir%\$hf_mig$\KB2719985\update\rabrrarar.qqj (39 bytes)
%WinDir%\$hf_mig$\KB975713\update\yzbzbyqqj.byj (39 bytes)
%WinDir%\$hf_mig$\KB978706\yzbzbyqqj.byj (39 bytes)
D:\rizarrrzi.iir (39 bytes)
%WinDir%\$hf_mig$\KB981997\update\zbyjayaya.rab (39 bytes)
%WinDir%\$hf_mig$\KB956844\update\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB2510581\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB960859\update\arrrziiir.rqy (39 bytes)
%WinDir%\$hf_mig$\KB972270\rabrrarar.qqj (39 bytes)
%WinDir%\$hf_mig$\KB2744842-IE8\update\byqyajqia.qjj (39 bytes)
%Program Files%\Outlook Express\yaibyqyaj.qiaqyaj.qia (39 bytes)
%WinDir%\$hf_mig$\KB2419632\update\rabrrarar.qqj (39 bytes)
%WinDir%\$hf_mig$\KB2736233\update\zbyjayaya.rab (39 bytes)
%WinDir%\$hf_mig$\KB2423089\update\riazzzari.byq (39 bytes)
%Program Files%\Outlook Express\qqjyzbzby.qqjqyaj.qia (39 bytes)
%WinDir%\$hf_mig$\KB971029\update\byqyajqia.qjj (39 bytes)
%Program Files%\Outlook Express\byqabijra.zyiqyaj.qia (39 bytes)
%Program Files%\Windows NT\Pinball\rabriazzz.ari.qqja (39 bytes)
%WinDir%\$hf_mig$\KB2485663\byqyajqia.qjj (39 bytes)
%WinDir%\$hf_mig$\KB978542\rrzqyjaaa.riz (39 bytes)
%WinDir%\$hf_mig$\KB2619339\yzbzbyqqj.byj (39 bytes)
%WinDir%\$hf_mig$\KB2736233\yzbzbyqqj.byj (39 bytes)

Registry activity

The process cf3661dcd24f11b7380366fda6a5acef.exe:2576 makes changes in a system registry.


The Virus creates and/or sets the following values in system registry:


To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"

Network activity (URLs)

A bot communicates with command and control servers via IRC channel.No activity has been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Worm that spreads its copies in attachments included in emails.

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    rqyrabrra.rar:4012
    rqyrabrra.rar:1576

  2. Delete the original Virus file.
  3. Delete or disinfect the following files created/modified by the Virus:

    %Documents and Settings%\%current user%\Local Settings\Temp\zrjzaz.zzyz.jri (39 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\qarzbj.rajz.jri (39 bytes)
    %WinDir%\$NtUninstallKB2508429$\spuninst\abijrazyi.yai (39 bytes)
    %WinDir%\$hf_mig$\KB2481109\yzbzbyqqj.byj (39 bytes)
    %WinDir%\$hf_mig$\KB2779030\rabrrarar.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB973815\abijrazyi.yai (39 bytes)
    %WinDir%\$hf_mig$\KB2483185\update\abijrazyi.yai (39 bytes)
    %WinDir%\$hf_mig$\KB2624667\update\rrzqyjaaa.riz.riz (39 bytes)
    %WinDir%\$hf_mig$\KB975560\update\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB971657\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB2749655\update\arrrziiir.rqy.qjj (39 bytes)
    %Program Files%\Windows Media Player\rizarrrzi.iir (39 bytes)
    %WinDir%\$hf_mig$\KB979309\update\abijrazyi.yai (39 bytes)
    %WinDir%\$hf_mig$\KB2585542\zbyjayaya.rab (39 bytes)
    %WinDir%\$hf_mig$\KB979482\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB923561\SP3QFE\rrzqyjaaa.rizq.qjj (39 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\rizarrrzi.iir (39 bytes)
    %WinDir%\$hf_mig$\KB2506212\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB2584146\update\yzbzbyqqj.byj (39 bytes)
    %WinDir%\$NtUninstallKB2485663$\spuninst\yzbzbyqqj.byj (39 bytes)
    %Program Files%\MSN Gaming Zone\Windows\yaibyqyaj.qia (39 bytes)
    %WinDir%\$hf_mig$\KB2598479\rrzqyjaaa.riz (39 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\rabriazzz.ari (39 bytes)
    %WinDir%\$hf_mig$\KB2393802\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2393802\SP3QFE\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB959426\update\yzbzbyqqj.byj (39 bytes)
    %Program Files%\Windows Media Player\rqyrabrra.rar (39 bytes)
    %WinDir%\$hf_mig$\KB974392\update\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB956802\abijrazyi.yai (39 bytes)
    %WinDir%\$hf_mig$\KB952287\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2393802\update\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB2676562\update\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$NtUninstallKB2387149$\spuninst\rabrrarar.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB2592799\abijrazyi.yai (39 bytes)
    %WinDir%\$hf_mig$\KB2712808\update\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB975560\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB946648\yzbzbyqqj.byj (39 bytes)
    %WinDir%\$hf_mig$\KB982381-IE8\SP3QFE\byqyajqia.qjj (39 bytes)
    C:\Perl\bin\byjzbyjay.aya (39 bytes)
    %Program Files%\Wireshark\rizarrrzi.iir (39 bytes)
    %WinDir%\$hf_mig$\KB2655992\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2618444-IE8\update\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB2229593\update\zbyjayaya.rabqqja (39 bytes)
    %WinDir%\$hf_mig$\KB2603381\zbyjayaya.rab (39 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\yaibyqyaj.qia (39 bytes)
    %WinDir%\$hf_mig$\KB975025\update\riazzzari.byq (39 bytes)
    %Program Files%\MSN Gaming Zone\Windows\byjzbyjay.ayaj (39 bytes)
    %WinDir%\$hf_mig$\KB2508429\update\abijrazyi.yai (39 bytes)
    %WinDir%\$hf_mig$\KB2631813\arrrziiir.rqy (39 bytes)
    C:\totalcmd\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB950974\byqyajqia.qjj (39 bytes)
    %WinDir%\$NtUninstallKB2479943$\spuninst\abijrazyi.yai (39 bytes)
    %Program Files%\Windows NT\byjzbyjay.aya (39 bytes)
    %WinDir%\$hf_mig$\KB979482\update\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB2799329\zbyjayaya.rab (39 bytes)
    %WinDir%\$hf_mig$\KB978542\update\arrrziiir.rqy (39 bytes)
    %Program Files%\Windows NT\Accessories\qqjyzbzby.qqja (39 bytes)
    %WinDir%\$hf_mig$\KB982132\update\abijrazyi.yai (39 bytes)
    %WinDir%\$hf_mig$\KB2698365\update\abijrazyi.yai (39 bytes)
    %WinDir%\$hf_mig$\KB956844\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB974571\update\yzbzbyqqj.byj (39 bytes)
    %WinDir%\$hf_mig$\KB2478960\update\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2476490\zbyjayaya.rab (39 bytes)
    %WinDir%\$hf_mig$\KB956744\update\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB955759\yzbzbyqqj.byj (39 bytes)
    %WinDir%\$hf_mig$\KB2229593\yzbzbyqqj.byj (39 bytes)
    %WinDir%\$hf_mig$\KB952287\update\rrzqyjaaa.rizq.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2603381\update\riazzzari.byq.byj (39 bytes)
    %WinDir%\$hf_mig$\KB898461\abijrazyi.yai (39 bytes)
    %WinDir%\$hf_mig$\KB974318\abijrazyi.yai (39 bytes)
    %Program Files%\NetMeeting\rizarrrzi.iiryaibyqyaj.qia (39 bytes)
    %WinDir%\$hf_mig$\KB2758857\zbyjayaya.rab (39 bytes)
    %WinDir%\$NtUninstallKB2544521$\spuninst\arrrziiir.rqy (39 bytes)
    %WinDir%\$NtUninstallKB2478960$\spuninst\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB2570947\update\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB2598845-IE8\update\yzbzbyqqj.byj (39 bytes)
    %WinDir%\$hf_mig$\KB2719985\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB2570947\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB960859\SP3QFE\abijrazyi.yai (39 bytes)
    %WinDir%\$hf_mig$\KB968389\update\yzbzbyqqj.byj (39 bytes)
    %WinDir%\$hf_mig$\KB2481109\update\zbyjayaya.rab (39 bytes)
    %WinDir%\$hf_mig$\KB982132\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB973507\update\riazzzari.byq (39 bytes)
    C:\Perl\bin\rabriazzz.ari (39 bytes)
    %WinDir%\$hf_mig$\KB2686509\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB959426\rabrrarar.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB2585542\update\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB2506212\update\rabrrarar.qqj (39 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\yaibyqyaj.qia (39 bytes)
    %Program Files%\Wireshark\qqjyzbzby.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB975025\zbyjayaya.rab (39 bytes)
    %WinDir%\$hf_mig$\KB2655992\update\rrzqyjaaa.riz.riz (39 bytes)
    %WinDir%\$hf_mig$\KB2387149\update\rabrrarar.qqjqqja (39 bytes)
    %WinDir%\$hf_mig$\KB2115168\update\rabrrarar.qqjqqja (39 bytes)
    %WinDir%\$hf_mig$\KB2749655\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB946648\update\zbyjayaya.rabq.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB978338\update\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2758857\update\riazzzari.byq.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB982665\update\yzbzbyqqj.byj.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB960803\update\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB974112\update\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB952954\update\rabrrarar.qqjq.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB956744\zbyjayaya.rab (39 bytes)
    %WinDir%\$hf_mig$\KB981997\yzbzbyqqj.byj (39 bytes)
    %WinDir%\$hf_mig$\KB971029\abijrazyi.yai (39 bytes)
    %WinDir%\$NtUninstallKB2566454$\spuninst\yzbzbyqqj.byj (39 bytes)
    %WinDir%\$hf_mig$\KB952004\update\abijrazyi.yaiq.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2686509\update\rabrrarar.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB2770660\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB2544521\update\zbyjayaya.rab (39 bytes)
    %WinDir%\$NtUninstallKB2584146$\spuninst\abijrazyi.yai (39 bytes)
    %WinDir%\$hf_mig$\KB2347290\update\abijrazyi.yaiqqja (39 bytes)
    %WinDir%\$hf_mig$\KB951978\yzbzbyqqj.byj (39 bytes)
    %Program Files%\Wireshark\qjjrrzqyj.aaa (39 bytes)
    %WinDir%\$hf_mig$\KB2691442\yzbzbyqqj.byj (39 bytes)
    %Documents and Settings%\All Users\Application Data\Adobe\Reader\9.3\ARM\18298\yaibyqyaj.qia (39 bytes)
    %WinDir%\$NtUninstallKB2443105$\spuninst\rabrrarar.qqj (39 bytes)
    %WinDir%\$NtUninstallKB2510581$\spuninst\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2115168\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB960803\zbyjayaya.rab (39 bytes)
    %WinDir%\$hf_mig$\KB2347290\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB2724197\update\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB2799329\update\riazzzari.byq.qjj (39 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\qjjrrzqyj.aaa (39 bytes)
    %WinDir%\$hf_mig$\KB2620712\update\abijrazyi.yai.riz (39 bytes)
    %WinDir%\$hf_mig$\KB975467\update\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2467659\rabrrarar.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB2712808\byqyajqia.qjj (39 bytes)
    %WinDir%\$NtUninstallKB2570947$\spuninst\zbyjayaya.rab (39 bytes)
    %WinDir%\$hf_mig$\KB973904\update\yzbzbyqqj.byj (39 bytes)
    %Program Files%\Wireshark\rqyrabrra.rar (39 bytes)
    %WinDir%\$hf_mig$\KB950974\update\rrzqyjaaa.rizq.qjj (39 bytes)
    %Program Files%\MSN Gaming Zone\Windows\byqabijra.zyij (39 bytes)
    %WinDir%\$hf_mig$\KB973815\update\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2761465\update\byqyajqia.qjj.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2479943\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB2661637\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB977816\update\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB978706\update\zbyjayaya.rab (39 bytes)
    %WinDir%\$hf_mig$\KB898461\update\byqyajqia.qjjq.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB969059\zbyjayaya.rab (39 bytes)
    %WinDir%\$hf_mig$\KB2584146\rabrrarar.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB956572\SP3QFE\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2481109\SP3QFE\rabrrarar.qqj (39 bytes)
    C:\totalcmd\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB973869\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB950762\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB2757638\rabrrarar.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB2508429\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB2592799\update\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2535512\update\rabrrarar.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB2727528\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB979309\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB973507\zbyjayaya.rab (39 bytes)
    %WinDir%\$hf_mig$\KB2744842-IE8\abijrazyi.yai (39 bytes)
    %WinDir%\$hf_mig$\KB2661637\update\rabrrarar.qqj.riz (39 bytes)
    %WinDir%\$hf_mig$\KB974112\zbyjayaya.rab (39 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\byqabijra.zyi (39 bytes)
    %WinDir%\$hf_mig$\KB2423089\zbyjayaya.rab (39 bytes)
    %WinDir%\$hf_mig$\KB977816\zbyjayaya.rab (39 bytes)
    %WinDir%\$NtUninstallKB2481109$\spuninst\arrrziiir.rqy (39 bytes)
    %Documents and Settings%\All Users\Application Data\Adobe\Reader\9.3\ARM\18298\byqabijra.zyi (39 bytes)
    %WinDir%\$hf_mig$\KB2646524\update\zbyjayaya.rab.riz (39 bytes)
    %WinDir%\$hf_mig$\KB956572\SP3QFE\riazzzari.byq (39 bytes)
    %Program Files%\Wireshark\jrabayyrr.azj (39 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\byjzbyjay.ayabzby.qqj (39 bytes)
    %WinDir%\$NtUninstallKB2535512$\spuninst\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB2620712\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB2618444-IE8\SP3QFE\abijrazyi.yai (39 bytes)
    %WinDir%\$NtUninstallKB2440591$\spuninst\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB2483185\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB982381-IE8\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB956572\rabrrarar.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB2535512\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB2544521\yzbzbyqqj.byj (39 bytes)
    %Program Files%\NetMeeting\rqyrabrra.raryaibyqyaj.qia (39 bytes)
    %WinDir%\$hf_mig$\KB2507938\update\zbyjayaya.rab (39 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\rqyrabrra.rar (39 bytes)
    %WinDir%\$hf_mig$\KB2440591\abijrazyi.yai (39 bytes)
    %WinDir%\$hf_mig$\KB2619339\update\zbyjayaya.rab.riz (39 bytes)
    %WinDir%\$NtUninstallKB2592799$\spuninst\rrzqyjaaa.riz (39 bytes)
    C:\Perl\bin\qqjyzbzby.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB2387149\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB2691442\update\zbyjayaya.rab (39 bytes)
    %Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\yaibyqyaj.qia (39 bytes)
    %WinDir%\$hf_mig$\KB2624667\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2360937\update\rrzqyjaaa.rizqqja (39 bytes)
    %Program Files%\WinPcap\byqabijra.zyibriazzz.ari.qqja (39 bytes)
    %WinDir%\$hf_mig$\KB951978\update\zbyjayaya.rabq.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2618451\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB2479943\update\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB2727528\update\rabrrarar.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB2631813\update\rabrrarar.qqj.riz (39 bytes)
    %WinDir%\$hf_mig$\KB955759\update\zbyjayaya.rabq.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2566454\update\abijrazyi.yai (39 bytes)
    %WinDir%\$hf_mig$\KB960859\SP3QFE\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2724197\byqyajqia.qjj (39 bytes)
    %WinDir%\xwrm.exe (39 bytes)
    %WinDir%\$hf_mig$\KB2478960\abijrazyi.yai (39 bytes)
    %WinDir%\$hf_mig$\KB2744842-IE8\SP3QFE\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB974392\rrzqyjaaa.riz (39 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\qqjyzbzby.qqj (39 bytes)
    %WinDir%\$NtUninstallKB2506212$\spuninst\zbyjayaya.rab (39 bytes)
    %Program Files%\Common Files\Microsoft Shared\MSInfo\qjjrrzqyj.aaa (39 bytes)
    %WinDir%\$NtUninstallKB2378111_WM9$\spuninst\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB2507938\yzbzbyqqj.byj (39 bytes)
    %WinDir%\$hf_mig$\KB2510581\update\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB975467\abijrazyi.yai (39 bytes)
    %WinDir%\$hf_mig$\KB2646524\yzbzbyqqj.byj (39 bytes)
    %WinDir%\$hf_mig$\KB956572\update\yzbzbyqqj.byj (39 bytes)
    %WinDir%\$hf_mig$\KB2618451\update\rabrrarar.qqj.riz (39 bytes)
    %WinDir%\$hf_mig$\KB2676562\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2598845-IE8\rabrrarar.qqj (39 bytes)
    %WinDir%\$NtUninstallKB2507938$\spuninst\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB982665\rabrrarar.qqj (39 bytes)
    %Program Files%\Wireshark\zbzijaarr.jbz (39 bytes)
    %Documents and Settings%\All Users\Application Data\Adobe\Reader\9.3\ARM\18298\rabriazzz.ari (39 bytes)
    %WinDir%\$hf_mig$\KB960859\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB972270\update\yzbzbyqqj.byj (39 bytes)
    %WinDir%\$hf_mig$\KB2440591\update\byqyajqia.qjj (39 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\byjzbyjay.aya (39 bytes)
    %WinDir%\$hf_mig$\KB2618444-IE8\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2423089\SP3QFE\yzbzbyqqj.byj (39 bytes)
    %WinDir%\$NtUninstallKB2483185$\spuninst\rabrrarar.qqj (39 bytes)
    %WinDir%\$NtUninstallKB2393802$\spuninst\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB2467659\update\yzbzbyqqj.byj (39 bytes)
    %WinDir%\$hf_mig$\KB923561\arrrziiir.rqy (39 bytes)
    %Program Files%\Windows Media Player\qjjrrzqyj.aaaqia (39 bytes)
    %WinDir%\$NtUninstallKB2476490$\spuninst\zbyjayaya.rab (39 bytes)
    %WinDir%\$hf_mig$\KB978706\SP3QFE\rabrrarar.qqj (39 bytes)
    %Program Files%\Common Files\Adobe\Updater6\rabriazzz.ari (39 bytes)
    %WinDir%\$hf_mig$\KB2757638\update\yzbzbyqqj.byj.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2443105\update\arrrziiir.rqy (39 bytes)
    %WinDir%\$NtUninstallKB2467659$\spuninst\yzbzbyqqj.byj (39 bytes)
    %WinDir%\$NtUninstallKB2585542$\spuninst\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB923561\update\rabrrarar.qqjq.qjj (39 bytes)
    %Program Files%\Outlook Express\byjzbyjay.ayaqyaj.qia (39 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\qqjyzbzby.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB2653956\update\abijrazyi.yai.riz (39 bytes)
    %Program Files%\MSN Gaming Zone\Windows\rabriazzz.arij (39 bytes)
    %WinDir%\$hf_mig$\KB2566454\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB952004\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB981322\update\rabrrarar.qqj (39 bytes)
    %Program Files%\NetMeeting\qjjrrzqyj.aaayaibyqyaj.qia (39 bytes)
    %WinDir%\$hf_mig$\KB2598479\update\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB982381-IE8\update\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB950762\update\abijrazyi.yaiq.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2476490\update\riazzzari.byq (39 bytes)
    %WinDir%\$NtUninstallKB2598479$\spuninst\arrrziiir.rqy (39 bytes)
    %WinDir%\$NtUninstallKB2584146$\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB2761465\abijrazyi.yai (39 bytes)
    %WinDir%\$hf_mig$\KB973869\update\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB2779030\update\yzbzbyqqj.byj.qjj (39 bytes)
    %WinDir%\$NtUninstallKB2423089$\spuninst\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB952954\arrrziiir.rqy (39 bytes)
    %WinDir%\$NtUninstallKB2419632$\spuninst\abijrazyi.yai (39 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\byqabijra.zyi (39 bytes)
    %WinDir%\$hf_mig$\KB951978\SP3QFE\rabrrarar.qqjq.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB973904\rabrrarar.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB956802\update\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB971657\update\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB2360937\byqyajqia.qjj (39 bytes)
    C:\totalcmd\zbyjayaya.rab (39 bytes)
    %WinDir%\$hf_mig$\KB2653956\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB969059\update\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB974318\update\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB975713\rabrrarar.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB2584146\SP3QFE\arrrziiir.rqy (39 bytes)
    %WinDir%\$NtUninstallKB2564958$\spuninst\rabrrarar.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB2485663\update\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB2770660\update\arrrziiir.rqy.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB2419632\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB2698365\riazzzari.byq (39 bytes)
    %WinDir%\$hf_mig$\KB974571\rabrrarar.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB978338\abijrazyi.yai (39 bytes)
    %WinDir%\$hf_mig$\KB968389\rabrrarar.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB981322\arrrziiir.rqy (39 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\qqjyzbzby.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB2443105\rrzqyjaaa.riz (39 bytes)
    %Documents and Settings%\All Users\Application Data\Adobe\Reader\9.3\ARM\18298\qjjrrzqyj.aaa (39 bytes)
    %WinDir%\$hf_mig$\KB2719985\update\rabrrarar.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB975713\update\yzbzbyqqj.byj (39 bytes)
    %WinDir%\$hf_mig$\KB978706\yzbzbyqqj.byj (39 bytes)
    D:\rizarrrzi.iir (39 bytes)
    %WinDir%\$hf_mig$\KB981997\update\zbyjayaya.rab (39 bytes)
    %WinDir%\$hf_mig$\KB956844\update\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB2510581\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB960859\update\arrrziiir.rqy (39 bytes)
    %WinDir%\$hf_mig$\KB972270\rabrrarar.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB2744842-IE8\update\byqyajqia.qjj (39 bytes)
    %Program Files%\Outlook Express\yaibyqyaj.qiaqyaj.qia (39 bytes)
    %WinDir%\$hf_mig$\KB2419632\update\rabrrarar.qqj (39 bytes)
    %WinDir%\$hf_mig$\KB2736233\update\zbyjayaya.rab (39 bytes)
    %WinDir%\$hf_mig$\KB2423089\update\riazzzari.byq (39 bytes)
    %Program Files%\Outlook Express\qqjyzbzby.qqjqyaj.qia (39 bytes)
    %WinDir%\$hf_mig$\KB971029\update\byqyajqia.qjj (39 bytes)
    %Program Files%\Outlook Express\byqabijra.zyiqyaj.qia (39 bytes)
    %Program Files%\Windows NT\Pinball\rabriazzz.ari.qqja (39 bytes)
    %WinDir%\$hf_mig$\KB2485663\byqyajqia.qjj (39 bytes)
    %WinDir%\$hf_mig$\KB978542\rrzqyjaaa.riz (39 bytes)
    %WinDir%\$hf_mig$\KB2619339\yzbzbyqqj.byj (39 bytes)
    %WinDir%\$hf_mig$\KB2736233\yzbzbyqqj.byj (39 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "x32x" = "%WinDir%\xwrm.exe"

  5. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

Network Activity

Map

Strings from Dumps