Skip to main content

Virus.Win32.Duel_34e546bcf4


Susp_Dropper (Kaspersky), Trojan.Crypt.DW (B) (Emsisoft), Trojan.Crypt.DW (AdAware), Virus.Win32.Duel.FD, GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)Behaviour: Trojan, Worm, EmailWorm, Virus, IRCBot

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 34e546bcf4928b756f420483eb063971

SHA1: 15ed5c12081f755cc346a404f0d6d1406a741c3d

SHA256: acb0c0c5447a8400d3f83304c7fbabc00a7613c6615a833d2b2bc1d644f9c680

SSDeep: 768:yUw/FjwyOgwVoZ/GM2ljQMbSbv5YJEdsZn/2:A/5MVoZqb8vSWdsZ

Size: 57856 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2031-11-23 18:55:49

Analyzed on: WindowsXP SP3 32-bit

Summary: Virus. A program that recursively replicates a possibly evolved copy of itself.

Dynamic Analysis

Payload

Behaviour Description
EmailWormWorm can send e-mails.
IRCBotA bot can communicate with command and control servers via IRC channel.


Process activity

The Virus creates the following process(es):

abrrararq.qjy:920
abrrararq.qjy:1844
%original file name%.exe:344

The Virus injects its code into the following process(es):No processes have been created.

File activity

The process abrrararq.qjy:920 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jrizzy.iqqy.qzz (57 bytes)

The process abrrararq.qjy:1844 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\arryia.briy.qzz (57 bytes)

The process %original file name%.exe:344 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\rzqyjaaar.iza (57 bytes)
%Program Files%\MSN Gaming Zone\Windows\bijrazyiy.aibz (57 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\byjayayar.abr (57 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\byjayayar.abr (57 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rrrziiirr.qyr (57 bytes)
%Program Files%\Outlook Express\yqyajqiaq.jjrqiaq.jjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\zbzbyqqjb.yjz (57 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\rrrziiirr.qyr (57 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\zbzbyqqjb.yjz (57 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\yqyajqiaq.jjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\byjayayar.abr (57 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\abrrararq.qjy (57 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\abrrararq.qjy (57 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\zbzbyqqjb.yjz (57 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\iazzzarib.yqa (57 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\iazzzarib.yqa (57 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\iazzzarib.yqa (57 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\bijrazyiy.aib (57 bytes)
%WinDir%\pchealth\helpctr\binaries\abrrararq.qjy (57 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\yqyajqiaq.jjr (57 bytes)
%WinDir%\Network Diagnostic\iazzzarib.yqa (57 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\rrrziiirr.qyr (57 bytes)
%Program Files%\NetMeeting\rzqyjaaar.izayqyajqiaq.jjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\iazzzarib.yqa (57 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\iazzzarib.yqa (57 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\abrrararq.qjy (57 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\yqyajqiaq.jjrar.izaqiaq.jjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\zbzbyqqjb.yjz (57 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\bijrazyiy.aib (57 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\abrrararq.qjy (57 bytes)
C:\totalcmd\abrrararq.qjy (57 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\bijrazyiy.aib (57 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\yqyajqiaq.jjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\yqyajqiaq.jjr (57 bytes)
%Program Files%\Windows NT\Pinball\iazzzarib.yqa.yjzr (57 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\yqyajqiaq.jjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\bijrazyiy.aib (57 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\bijrazyiy.aib (57 bytes)
%WinDir%\Microsoft.NET\Framework\abrrararq.qjy (57 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\rrrziiirr.qyr (57 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\byjayayar.abr (57 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\rzqyjaaar.iza (57 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\zbzbyqqjb.yjz (57 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\iazzzarib.yqa (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\yqyajqiaq.jjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\abrrararq.qjy (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\rzqyjaaar.izaqiaq.jjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\rrrziiirr.qyr (57 bytes)
%WinDir%\ime\imjp8_1\abrrararq.qjy (57 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\zbzbyqqjb.yjz (57 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\zbzbyqqjb.yjz (57 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\rrrziiirr.qyr (57 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\abrrararq.qjy (57 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\zbzbyqqjb.yjz (57 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\iazzzarib.yqa (57 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\rzqyjaaar.iza (57 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\rzqyjaaar.iza (57 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\byjayayar.abr (57 bytes)
C:\totalcmd\zbzbyqqjb.yjz (57 bytes)
%WinDir%\ime\imjp8_1\iazzzarib.yqa (57 bytes)
%Program Files%\Windows Media Player\rzqyjaaar.izajjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\rzqyjaaar.iza (57 bytes)
%WinDir%\$hf_mig$\KB898461\update\rzqyjaaar.iza.yjzr (57 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\yqyajqiaq.jjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\iazzzarib.yqa (57 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\bijrazyiy.aib (57 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\iazzzarib.yqa (57 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\zbzbyqqjb.yjz (57 bytes)
%Program Files%\MSN Gaming Zone\Windows\byjayayar.abrz (57 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byjayayar.abr (57 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\yqyajqiaq.jjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\rzqyjaaar.iza (57 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\rrrziiirr.qyr (57 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\zbzbyqqjb.yjz (57 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\rzqyjaaar.iza (57 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\rrrziiirr.qyr (57 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\iazzzarib.yqa (57 bytes)
%Program Files%\Windows Media Player\abrrararq.qjy (57 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\zbzbyqqjb.yjz (57 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\iazzzarib.yqa (57 bytes)
%Program Files%\Windows Media Player\rrrziiirr.qyr (57 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\rrrziiirr.qyr (57 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\yqyajqiaq.jjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\byjayayar.abr (57 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\byjayayar.abr (57 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\byjayayar.abr (57 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\rrrziiirr.qyr (57 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\bijrazyiy.aib (57 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\abrrararq.qjy (57 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\iazzzarib.yqa (57 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\yqyajqiaq.jjr (57 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rrrziiirr.qyr (57 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\rrrziiirr.qyr (57 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\rzqyjaaar.iza (57 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\rrrziiirr.qyr (57 bytes)
%WinDir%\$hf_mig$\KB898461\yqyajqiaq.jjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\iazzzarib.yqa (57 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\rzqyjaaar.iza (57 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza (57 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\abrrararq.qjy (57 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\yqyajqiaq.jjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\rrrziiirr.qyr (57 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\bijrazyiy.aib (57 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\abrrararq.qjy (57 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\byjayayar.abr (57 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\bijrazyiy.aib (57 bytes)
%Program Files%\MSN Gaming Zone\Windows\yqyajqiaq.jjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\rzqyjaaar.iza (57 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\yqyajqiaq.jjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\zbzbyqqjb.yjz (57 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\zbzbyqqjb.yjz (57 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\yqyajqiaq.jjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\byjayayar.abr (57 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\byjayayar.abr (57 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjayayar.abr (57 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\abrrararq.qjy (57 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\byjayayar.abr (57 bytes)
%Program Files%\NetMeeting\abrrararq.qjyyqyajqiaq.jjr (57 bytes)
%WinDir%\xwrm.exe (57 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\zbzbyqqjb.yjz (57 bytes)
%WinDir%\ime\imjp8_1\bijrazyiy.aib (57 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\byjayayar.abr (57 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\abrrararq.qjy (57 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\rzqyjaaar.iza (57 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\iazzzarib.yqa (57 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\iazzzarib.yqa (57 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\bijrazyiy.aib (57 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\yqyajqiaq.jjr (57 bytes)
%WinDir%\ime\imjp8_1\rzqyjaaar.iza (57 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\yqyajqiaq.jjr (57 bytes)
%Program Files%\Common Files\Adobe\Updater6\iazzzarib.yqa (57 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\rzqyjaaar.iza (57 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\rrrziiirr.qyr (57 bytes)
%WinDir%\ime\imjp8_1\yqyajqiaq.jjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\rzqyjaaar.iza (57 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\rrrziiirr.qyr (57 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\zbzbyqqjb.yjz (57 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\byjayayar.abr (57 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\iazzzarib.yqa (57 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\iazzzarib.yqa (57 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\bijrazyiy.aib (57 bytes)
%Program Files%\Outlook Express\zbzbyqqjb.yjzqiaq.jjr (57 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\bijrazyiy.aib (57 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\bijrazyiy.aib (57 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\yqyajqiaq.jjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\bijrazyiy.aib (57 bytes)
%Program Files%\Windows NT\byjayayar.abr (57 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\yqyajqiaq.jjr (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ryqjiy.rjry.qzz (57 bytes)
%Program Files%\WinPcap\bijrazyiy.aibzzzarib.yqa.yjzr (57 bytes)
%Program Files%\MSN Gaming Zone\Windows\iazzzarib.yqaz (57 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\abrrararq.qjy (57 bytes)
%Program Files%\NetMeeting\rrrziiirr.qyryqyajqiaq.jjr (57 bytes)
%Program Files%\Windows NT\Accessories\zbzbyqqjb.yjzr (57 bytes)
%WinDir%\ime\imjp8_1\rrrziiirr.qyr (57 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib (57 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr (57 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\rrrziiirr.qyr (57 bytes)
%WinDir%\ime\imkr6_1\zbzbyqqjb.yjz (57 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\byjayayar.abr (57 bytes)
%WinDir%\bijrazyiy.aib (57 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\abrrararq.qjy (57 bytes)
%Program Files%\Outlook Express\byjayayar.abrqiaq.jjr (57 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rzqyjaaar.iza (57 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\zbzbyqqjb.yjz (57 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\rzqyjaaar.iza (57 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\abrrararq.qjy (57 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\zbzbyqqjb.yjz (57 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\rzqyjaaar.iza (57 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz (57 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\bijrazyiy.aib (57 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\zbzbyqqjb.yjz (57 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr (57 bytes)
%WinDir%\ime\imjp8_1\byjayayar.abr (57 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\abrrararq.qjy (57 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\byjayayar.abr (57 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\bijrazyiy.aib (57 bytes)
C:\totalcmd\bijrazyiy.aib (57 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\abrrararq.qjy (57 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\rrrziiirr.qyr (57 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\rrrziiirr.qyr (57 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\abrrararq.qjy (57 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\yqyajqiaq.jjr (57 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\bijrazyiy.aib (57 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\rzqyjaaar.iza (57 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\rzqyjaaar.iza (57 bytes)
%Program Files%\Outlook Express\bijrazyiy.aibqiaq.jjr (57 bytes)
%WinDir%\inf\iazzzarib.yqa (57 bytes)
%WinDir%\pchealth\helpctr\binaries\yqyajqiaq.jjr (57 bytes)

Registry activity

The process %original file name%.exe:344 makes changes in the system registry.


The Virus creates and/or sets the following values in system registry:


To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"

Dropped PE files

MD5 File path
16272bf9608deb4bce664a849e6f9fa7c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\rzqyjaaar.izaqiaq.jjr
5b6840e505debb429bab20051cec0b89c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ryqjiy.rjry.qzz
16272bf9608deb4bce664a849e6f9fa7c:\Perl\bin\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\Perl\bin\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\Perl\bin\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Adobe\Reader 9.0\Reader\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Adobe\Reader 9.0\Reader\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Adobe\Reader 9.0\Reader\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Adobe\Reader 9.0\Reader\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Adobe\Reader 9.0\Reader\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\yqyajqiaq.jjrar.izaqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Common Files\Adobe\ARM\1.0\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Common Files\Adobe\ARM\1.0\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Common Files\Adobe\ARM\1.0\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Common Files\Adobe\Updater6\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Common Files\Microsoft Shared\DW\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Common Files\Microsoft Shared\DW\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Common Files\Microsoft Shared\MSInfo\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\MSN Gaming Zone\Windows\bijrazyiy.aibz
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\MSN Gaming Zone\Windows\byjayayar.abrz
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\MSN Gaming Zone\Windows\iazzzarib.yqaz
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\MSN Gaming Zone\Windows\yqyajqiaq.jjr
5ac6cd4642fc24dc829bf5025a557efbc:\Program Files\MSN Gaming Zone\Windows\zClientm.exe
5ac6cd4642fc24dc829bf5025a557efbc:\Program Files\MSN Gaming Zone\Windows\zclientm.exe
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\NetMeeting\abrrararq.qjyyqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\NetMeeting\rrrziiirr.qyryqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\NetMeeting\rzqyjaaar.izayqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Outlook Express\bijrazyiy.aibqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Outlook Express\byjayayar.abrqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Outlook Express\yqyajqiaq.jjrqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Outlook Express\zbzbyqqjb.yjzqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\WinPcap\bijrazyiy.aibzzzarib.yqa.yjzr
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Windows Media Player\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Windows Media Player\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Windows Media Player\rzqyjaaar.izajjr
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Windows NT\Accessories\zbzbyqqjb.yjzr
faa1fde004b3c60b5a8068a7c3aab151c:\Program Files\Windows NT\Pinball\PINBALL.EXE
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Windows NT\Pinball\iazzzarib.yqa.yjzr
faa1fde004b3c60b5a8068a7c3aab151c:\Program Files\Windows NT\Pinball\pinball.exe
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Windows NT\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Wireshark\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Wireshark\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Wireshark\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Wireshark\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Wireshark\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\Program Files\Wireshark\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\$NtUninstallKB898461$\spuninst\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\$hf_mig$\KB898461\update\rzqyjaaar.iza.yjzr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\$hf_mig$\KB898461\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\Microsoft.NET\Framework\abrrararq.qjy
5e28284f9b5f9097640d58a73d38ad4cc:\WINDOWS\NOTEPAD.EXE
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\Network Diagnostic\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\ime\imjp8_1\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\ime\imjp8_1\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\ime\imjp8_1\byjayayar.abr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\ime\imjp8_1\iazzzarib.yqa
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\ime\imjp8_1\rrrziiirr.qyr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\ime\imjp8_1\rzqyjaaar.iza
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\ime\imjp8_1\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\ime\imkr6_1\zbzbyqqjb.yjz
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\inf\iazzzarib.yqa
5e28284f9b5f9097640d58a73d38ad4cc:\WINDOWS\notepad.exe
b32a4db8fa8ba07afb1e86f8c9fb852ec:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\pchealth\helpctr\binaries\abrrararq.qjy
b32a4db8fa8ba07afb1e86f8c9fb852ec:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\pchealth\helpctr\binaries\yqyajqiaq.jjr
16272bf9608deb4bce664a849e6f9fa7c:\WINDOWS\xwrm.exe
16272bf9608deb4bce664a849e6f9fa7c:\totalcmd\abrrararq.qjy
16272bf9608deb4bce664a849e6f9fa7c:\totalcmd\bijrazyiy.aib
16272bf9608deb4bce664a849e6f9fa7c:\totalcmd\zbzbyqqjb.yjz

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    abrrararq.qjy:920
    abrrararq.qjy:1844
    %original file name%.exe:344

  2. Delete the original Virus file.
  3. Delete or disinfect the following files created/modified by the Virus:

    %Documents and Settings%\%current user%\Local Settings\Temp\jrizzy.iqqy.qzz (57 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\arryia.briy.qzz (57 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\rzqyjaaar.iza (57 bytes)
    %Program Files%\MSN Gaming Zone\Windows\bijrazyiy.aibz (57 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\byjayayar.abr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\byjayayar.abr (57 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\rrrziiirr.qyr (57 bytes)
    %Program Files%\Outlook Express\yqyajqiaq.jjrqiaq.jjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\rrrziiirr.qyr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\yqyajqiaq.jjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\byjayayar.abr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\abrrararq.qjy (57 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\abrrararq.qjy (57 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\iazzzarib.yqa (57 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\iazzzarib.yqa (57 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\iazzzarib.yqa (57 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\bijrazyiy.aib (57 bytes)
    %WinDir%\pchealth\helpctr\binaries\abrrararq.qjy (57 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\yqyajqiaq.jjr (57 bytes)
    %WinDir%\Network Diagnostic\iazzzarib.yqa (57 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\rrrziiirr.qyr (57 bytes)
    %Program Files%\NetMeeting\rzqyjaaar.izayqyajqiaq.jjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\iazzzarib.yqa (57 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\iazzzarib.yqa (57 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\abrrararq.qjy (57 bytes)
    %Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\yqyajqiaq.jjrar.izaqiaq.jjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\bijrazyiy.aib (57 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\abrrararq.qjy (57 bytes)
    C:\totalcmd\abrrararq.qjy (57 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\bijrazyiy.aib (57 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\yqyajqiaq.jjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\yqyajqiaq.jjr (57 bytes)
    %Program Files%\Windows NT\Pinball\iazzzarib.yqa.yjzr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\yqyajqiaq.jjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\bijrazyiy.aib (57 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\bijrazyiy.aib (57 bytes)
    %WinDir%\Microsoft.NET\Framework\abrrararq.qjy (57 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\rrrziiirr.qyr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\byjayayar.abr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\rzqyjaaar.iza (57 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\iazzzarib.yqa (57 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\yqyajqiaq.jjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\abrrararq.qjy (57 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\rzqyjaaar.izaqiaq.jjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\rrrziiirr.qyr (57 bytes)
    %WinDir%\ime\imjp8_1\abrrararq.qjy (57 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\rrrziiirr.qyr (57 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\abrrararq.qjy (57 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\iazzzarib.yqa (57 bytes)
    %Program Files%\Common Files\Microsoft Shared\MSInfo\rzqyjaaar.iza (57 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\rzqyjaaar.iza (57 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\byjayayar.abr (57 bytes)
    C:\totalcmd\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\ime\imjp8_1\iazzzarib.yqa (57 bytes)
    %Program Files%\Windows Media Player\rzqyjaaar.izajjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\rzqyjaaar.iza (57 bytes)
    %WinDir%\$hf_mig$\KB898461\update\rzqyjaaar.iza.yjzr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\yqyajqiaq.jjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\iazzzarib.yqa (57 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\bijrazyiy.aib (57 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\iazzzarib.yqa (57 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\zbzbyqqjb.yjz (57 bytes)
    %Program Files%\MSN Gaming Zone\Windows\byjayayar.abrz (57 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\byjayayar.abr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\yqyajqiaq.jjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\rzqyjaaar.iza (57 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\rrrziiirr.qyr (57 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\rzqyjaaar.iza (57 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\rrrziiirr.qyr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\iazzzarib.yqa (57 bytes)
    %Program Files%\Windows Media Player\abrrararq.qjy (57 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\iazzzarib.yqa (57 bytes)
    %Program Files%\Windows Media Player\rrrziiirr.qyr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\rrrziiirr.qyr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\yqyajqiaq.jjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\byjayayar.abr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\byjayayar.abr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\byjayayar.abr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\rrrziiirr.qyr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\bijrazyiy.aib (57 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\abrrararq.qjy (57 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\iazzzarib.yqa (57 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\yqyajqiaq.jjr (57 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\rrrziiirr.qyr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\rrrziiirr.qyr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\rzqyjaaar.iza (57 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\rrrziiirr.qyr (57 bytes)
    %WinDir%\$hf_mig$\KB898461\yqyajqiaq.jjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\iazzzarib.yqa (57 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\rzqyjaaar.iza (57 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza (57 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\abrrararq.qjy (57 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\yqyajqiaq.jjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\rrrziiirr.qyr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\bijrazyiy.aib (57 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\abrrararq.qjy (57 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\byjayayar.abr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\bijrazyiy.aib (57 bytes)
    %Program Files%\MSN Gaming Zone\Windows\yqyajqiaq.jjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\rzqyjaaar.iza (57 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\yqyajqiaq.jjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\yqyajqiaq.jjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\byjayayar.abr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\byjayayar.abr (57 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjayayar.abr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\abrrararq.qjy (57 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\byjayayar.abr (57 bytes)
    %Program Files%\NetMeeting\abrrararq.qjyyqyajqiaq.jjr (57 bytes)
    %WinDir%\xwrm.exe (57 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\ime\imjp8_1\bijrazyiy.aib (57 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\byjayayar.abr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\abrrararq.qjy (57 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\rzqyjaaar.iza (57 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\iazzzarib.yqa (57 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\iazzzarib.yqa (57 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\bijrazyiy.aib (57 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\yqyajqiaq.jjr (57 bytes)
    %WinDir%\ime\imjp8_1\rzqyjaaar.iza (57 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\yqyajqiaq.jjr (57 bytes)
    %Program Files%\Common Files\Adobe\Updater6\iazzzarib.yqa (57 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\rzqyjaaar.iza (57 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\rrrziiirr.qyr (57 bytes)
    %WinDir%\ime\imjp8_1\yqyajqiaq.jjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\rzqyjaaar.iza (57 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\rrrziiirr.qyr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\byjayayar.abr (57 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\iazzzarib.yqa (57 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\iazzzarib.yqa (57 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\bijrazyiy.aib (57 bytes)
    %Program Files%\Outlook Express\zbzbyqqjb.yjzqiaq.jjr (57 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\bijrazyiy.aib (57 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\bijrazyiy.aib (57 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\yqyajqiaq.jjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\bijrazyiy.aib (57 bytes)
    %Program Files%\Windows NT\byjayayar.abr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\yqyajqiaq.jjr (57 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ryqjiy.rjry.qzz (57 bytes)
    %Program Files%\WinPcap\bijrazyiy.aibzzzarib.yqa.yjzr (57 bytes)
    %Program Files%\MSN Gaming Zone\Windows\iazzzarib.yqaz (57 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\abrrararq.qjy (57 bytes)
    %Program Files%\NetMeeting\rrrziiirr.qyryqyajqiaq.jjr (57 bytes)
    %Program Files%\Windows NT\Accessories\zbzbyqqjb.yjzr (57 bytes)
    %WinDir%\ime\imjp8_1\rrrziiirr.qyr (57 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib (57 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\rrrziiirr.qyr (57 bytes)
    %WinDir%\ime\imkr6_1\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\byjayayar.abr (57 bytes)
    %WinDir%\bijrazyiy.aib (57 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\abrrararq.qjy (57 bytes)
    %Program Files%\Outlook Express\byjayayar.abrqiaq.jjr (57 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rzqyjaaar.iza (57 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\rzqyjaaar.iza (57 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\abrrararq.qjy (57 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\rzqyjaaar.iza (57 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\bijrazyiy.aib (57 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\zbzbyqqjb.yjz (57 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr (57 bytes)
    %WinDir%\ime\imjp8_1\byjayayar.abr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\abrrararq.qjy (57 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\byjayayar.abr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\bijrazyiy.aib (57 bytes)
    C:\totalcmd\bijrazyiy.aib (57 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\abrrararq.qjy (57 bytes)
    %WinDir%\$NtUninstallKB898461$\spuninst\rrrziiirr.qyr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\rrrziiirr.qyr (57 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\abrrararq.qjy (57 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\yqyajqiaq.jjr (57 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\bijrazyiy.aib (57 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\rzqyjaaar.iza (57 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\rzqyjaaar.iza (57 bytes)
    %Program Files%\Outlook Express\bijrazyiy.aibqiaq.jjr (57 bytes)
    %WinDir%\inf\iazzzarib.yqa (57 bytes)
    %WinDir%\pchealth\helpctr\binaries\yqyajqiaq.jjr (57 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "x32x" = "%WinDir%\xwrm.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
qzrajzai4096409615360.5036550393b7ed09e676eca5772cc295f27160
yyraraaj819232768322565.07891d8f17f41ee8b568ca578a4e81c35aca
jrqziiir4096040965120.46801303990ce32513f25d3855296b7bc8aa4d
rqyrabrr45056409620483.924736481060bb77e469e5fdb95d8e5c6ab31

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Virus connects to the servers at the folowing location(s):

Strings from Dumps


Related articles