Skip to main content

Virus.Win32.Duel_809697992c


Susp_Dropper (Kaspersky), DeepScan:Generic.Malware.SIM!g.C5BDF549 (B) (Emsisoft), DeepScan:Generic.Malware.SIM!g.C5BDF549 (AdAware), Virus.Win32.Duel.FD, GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)Behaviour: Worm, EmailWorm, Virus, IRCBot

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 809697992c45ca1696197909df7d93a6

SHA1: 187333ada3623b88aa1a9845131c4a1ede3d567a

SHA256: 7877b54bae4b9fa1126e1b9518d096d94242f4f08d2af7b525b1ff5873a443f2

SSDeep: 768:JDXFCFhcd6aX7KAyk6LLyTW63am/O8axI2x0Nh02:JjFCTw6arKAP6Ka63ashaN6P

Size: 43520 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: no data

Analyzed on: WindowsXP SP3 32-bit

Summary: Virus. A program that recursively replicates a possibly evolved copy of itself.

Dynamic Analysis

Payload

Behaviour Description
EmailWormWorm can send e-mails.
IRCBotA bot can communicate with command and control servers via IRC channel.


Process activity

The Virus creates the following process(es):

%original file name%.exe:1076
rabrrarar.qqj:1304
rabrrarar.qqj:264

The Virus injects its code into the following process(es):No processes have been created.

File activity

The process %original file name%.exe:1076 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\arrrziiir.rqy (43 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\arrrziiir.rqy (43 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\rrzqyjaaa.riz (43 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\rabrrarar.qqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\riazzzari.byq (43 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\byqyajqia.qjj (43 bytes)
%Program Files%\Outlook Express\byqyajqia.qjjjqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\byqyajqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\yzbzbyqqj.byj (43 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\yzbzbyqqj.byj (43 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\rrzqyjaaa.riz (43 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\abijrazyi.yai (43 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\byqyajqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\arrrziiir.rqy (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\arrrziiir.rqy (43 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\abijrazyi.yai (43 bytes)
%WinDir%\ime\imkr6_1\yzbzbyqqj.byj (43 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\abijrazyi.yai (43 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\yzbzbyqqj.byj (43 bytes)
%WinDir%\inf\riazzzari.byq (43 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\rabrrarar.qqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\arrrziiir.rqy (43 bytes)
%Program Files%\Windows NT\Pinball\riazzzari.byq.byjj (43 bytes)
%Program Files%\MSN Gaming Zone\Windows\abijrazyi.yaij (43 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\rabrrarar.qqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\rrzqyjaaa.riz (43 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\rabrrarar.qqj (43 bytes)
%Program Files%\WinPcap\abijrazyi.yaiazzzari.byq.byjj (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yzbzbyqqj.byj (43 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\riazzzari.byq (43 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\riazzzari.byq (43 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\riazzzari.byq (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbyjayaya.rab (43 bytes)
%WinDir%\ime\imjp8_1\byqyajqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\zbyjayaya.rab (43 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\rabrrarar.qqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\arrrziiir.rqy (43 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\arrrziiir.rqy (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrzqyjaaa.riz (43 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\abijrazyi.yai (43 bytes)
%Program Files%\Outlook Express\abijrazyi.yaijqia.qjj (43 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\rrzqyjaaa.riz (43 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\rrzqyjaaa.riz (43 bytes)
C:\totalcmd\rabrrarar.qqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\yzbzbyqqj.byj (43 bytes)
%Program Files%\Windows Media Player\rabrrarar.qqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\riazzzari.byq (43 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\byqyajqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\yzbzbyqqj.byj (43 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\byqyajqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\zbyjayaya.rab (43 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\byqyajqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\riazzzari.byq (43 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\abijrazyi.yai (43 bytes)
%WinDir%\ime\imjp8_1\arrrziiir.rqy (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\riazzzari.byq (43 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\zbyjayaya.rab (43 bytes)
%Program Files%\MSN Gaming Zone\Windows\byqyajqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\arrrziiir.rqy (43 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\arrrziiir.rqy (43 bytes)
%Program Files%\NetMeeting\rabrrarar.qqjbyqyajqia.qjj (43 bytes)
%WinDir%\pchealth\helpctr\binaries\rabrrarar.qqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\rabrrarar.qqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\zbyjayaya.rab (43 bytes)
%Program Files%\Common Files\Adobe\Updater6\riazzzari.byq (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\rabrrarar.qqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\rabrrarar.qqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\rrzqyjaaa.riz (43 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\rrzqyjaaa.riz (43 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\riazzzari.byq (43 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\rabrrarar.qqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\zbyjayaya.rab (43 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\rabrrarar.qqj (43 bytes)
C:\totalcmd\yzbzbyqqj.byj (43 bytes)
%Program Files%\Outlook Express\yzbzbyqqj.byjjqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\rabrrarar.qqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\rrzqyjaaa.riz (43 bytes)
%WinDir%\pchealth\helpctr\binaries\byqyajqia.qjj (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yzbzbyqqj.byj (43 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\byqyajqia.qjj (43 bytes)
%Program Files%\MSN Gaming Zone\Windows\riazzzari.byqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\yzbzbyqqj.byj (43 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\zbyjayaya.rab (43 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\abijrazyi.yai (43 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\arrrziiir.rqy (43 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\rabrrarar.qqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\riazzzari.byq (43 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\rrzqyjaaa.riz (43 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\zbyjayaya.rab (43 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\arrrziiir.rqy (43 bytes)
%Program Files%\Windows Media Player\rrzqyjaaa.rizqjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\rabrrarar.qqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\zbyjayaya.rab (43 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\abijrazyi.yai (43 bytes)
%WinDir%\$hf_mig$\KB898461\byqyajqia.qjj (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\byqyajqia.qjj (43 bytes)
C:\totalcmd\abijrazyi.yai (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byqyajqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\arrrziiir.rqy (43 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\abijrazyi.yai (43 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\riazzzari.byq (43 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\rrzqyjaaa.riz (43 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\abijrazyi.yai (43 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\riazzzari.byq (43 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\byqyajqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\abijrazyi.yai (43 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\zbyjayaya.rab (43 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\byqyajqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\byqyajqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\rrzqyjaaa.riz (43 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\rrzqyjaaa.riz (43 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\arrrziiir.rqy (43 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\abijrazyi.yai (43 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\byqyajqia.qjj (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\zbyjayaya.rab (43 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\rrzqyjaaa.riz (43 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\rrzqyjaaa.riz (43 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\zbyjayaya.rab (43 bytes)
%WinDir%\ime\imjp8_1\abijrazyi.yai (43 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\riazzzari.byq (43 bytes)
%WinDir%\xwrm.exe (43 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\yzbzbyqqj.byj (43 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\arrrziiir.rqy (43 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\yzbzbyqqj.byj (43 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\yzbzbyqqj.byj (43 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\yzbzbyqqj.byj (43 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\riazzzari.byq (43 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\riazzzari.byq (43 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\byqyajqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\yzbzbyqqj.byj (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abijrazyi.yai (43 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\yzbzbyqqj.byj (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\rrzqyjaaa.riz (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\abijrazyi.yai (43 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rabrrarar.qqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\zbyjayaya.rab (43 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\byqyajqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\rrzqyjaaa.riz (43 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\riazzzari.byq (43 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\arrrziiir.rqy (43 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\yzbzbyqqj.byj (43 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\yzbzbyqqj.byj (43 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\byqyajqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\arrrziiir.rqy (43 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\byqyajqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\zbyjayaya.rab (43 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\zbyjayaya.rab (43 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\abijrazyi.yai (43 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rrzqyjaaa.riz (43 bytes)
%WinDir%\Microsoft.NET\Framework\rabrrarar.qqj (43 bytes)
%WinDir%\ime\imjp8_1\rrzqyjaaa.riz (43 bytes)
%WinDir%\abijrazyi.yai (43 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\yzbzbyqqj.byj (43 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\riazzzari.byq (43 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\rabrrarar.qqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\yzbzbyqqj.byj (43 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\byqyajqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\byqyajqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\yzbzbyqqj.byj (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yybaiy.yrjj.aar (43 bytes)
%Program Files%\NetMeeting\arrrziiir.rqybyqyajqia.qjj (43 bytes)
%Program Files%\Windows NT\zbyjayaya.rab (43 bytes)
%Program Files%\NetMeeting\rrzqyjaaa.rizbyqyajqia.qjj (43 bytes)
%WinDir%\$hf_mig$\KB898461\update\rrzqyjaaa.riz.byjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\rabrrarar.qqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\zbyjayaya.rab (43 bytes)
%Program Files%\Windows NT\Accessories\yzbzbyqqj.byjj (43 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\byqyajqia.qjjaa.rizjqia.qjj (43 bytes)
%WinDir%\Network Diagnostic\riazzzari.byq (43 bytes)
%WinDir%\ime\imjp8_1\riazzzari.byq (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\rrzqyjaaa.rizjqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\abijrazyi.yai (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\riazzzari.byq (43 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\arrrziiir.rqy (43 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\rrzqyjaaa.riz (43 bytes)
%WinDir%\ime\imjp8_1\rabrrarar.qqj (43 bytes)
%WinDir%\ime\imjp8_1\zbyjayaya.rab (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\arrrziiir.rqy (43 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\abijrazyi.yai (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\arrrziiir.rqy (43 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\zbyjayaya.rab (43 bytes)
%Program Files%\Windows Media Player\arrrziiir.rqy (43 bytes)
%Program Files%\Outlook Express\zbyjayaya.rabjqia.qjj (43 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\abijrazyi.yai (43 bytes)
%Program Files%\MSN Gaming Zone\Windows\zbyjayaya.rabj (43 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\abijrazyi.yai (43 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\rabrrarar.qqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\arrrziiir.rqy (43 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\zbyjayaya.rab (43 bytes)

The process rabrrarar.qqj:1304 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ajyajy.yyyj.aar (43 bytes)

The process rabrrarar.qqj:264 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ryaizy.ybrj.aar (43 bytes)

Registry activity

The process %original file name%.exe:1076 makes changes in the system registry.


The Virus creates and/or sets the following values in system registry:


To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"

Dropped PE files

MD5 File path
0b9815723342621dfb40c07a4ca66a89c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\rrzqyjaaa.rizjqia.qjj
ae88b860cb1f3e14f35c9eccf641b886c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\yybaiy.yrjj.aar
0b9815723342621dfb40c07a4ca66a89c:\Perl\bin\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\Perl\bin\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\Perl\bin\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Adobe\Reader 9.0\Reader\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Adobe\Reader 9.0\Reader\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Adobe\Reader 9.0\Reader\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Adobe\Reader 9.0\Reader\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Adobe\Reader 9.0\Reader\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Adobe\Reader 9.0\Reader\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\byqyajqia.qjjaa.rizjqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Common Files\Adobe\ARM\1.0\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Common Files\Adobe\ARM\1.0\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Common Files\Adobe\ARM\1.0\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Common Files\Adobe\ARM\1.0\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Common Files\Adobe\Updater6\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Common Files\Microsoft Shared\DW\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Common Files\Microsoft Shared\DW\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Common Files\Microsoft Shared\MSInfo\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\Program Files\MSN Gaming Zone\Windows\abijrazyi.yaij
0b9815723342621dfb40c07a4ca66a89c:\Program Files\MSN Gaming Zone\Windows\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\MSN Gaming Zone\Windows\riazzzari.byqj
5ac6cd4642fc24dc829bf5025a557efbc:\Program Files\MSN Gaming Zone\Windows\zClientm.exe
0b9815723342621dfb40c07a4ca66a89c:\Program Files\MSN Gaming Zone\Windows\zbyjayaya.rabj
5ac6cd4642fc24dc829bf5025a557efbc:\Program Files\MSN Gaming Zone\Windows\zclientm.exe
0b9815723342621dfb40c07a4ca66a89c:\Program Files\NetMeeting\arrrziiir.rqybyqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\NetMeeting\rabrrarar.qqjbyqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\NetMeeting\rrzqyjaaa.rizbyqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Outlook Express\abijrazyi.yaijqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Outlook Express\byqyajqia.qjjjqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Outlook Express\yzbzbyqqj.byjjqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Outlook Express\zbyjayaya.rabjqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\WinPcap\abijrazyi.yaiazzzari.byq.byjj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Windows Media Player\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Windows Media Player\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Windows Media Player\rrzqyjaaa.rizqjj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Windows NT\Accessories\yzbzbyqqj.byjj
faa1fde004b3c60b5a8068a7c3aab151c:\Program Files\Windows NT\Pinball\PINBALL.EXE
faa1fde004b3c60b5a8068a7c3aab151c:\Program Files\Windows NT\Pinball\pinball.exe
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Windows NT\Pinball\riazzzari.byq.byjj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Windows NT\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Wireshark\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Wireshark\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Wireshark\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Wireshark\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Wireshark\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\Program Files\Wireshark\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\$NtUninstallKB898461$\spuninst\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\$hf_mig$\KB898461\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\$hf_mig$\KB898461\update\rrzqyjaaa.riz.byjj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\Microsoft.NET\Framework\rabrrarar.qqj
5e28284f9b5f9097640d58a73d38ad4cc:\WINDOWS\NOTEPAD.EXE
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\Network Diagnostic\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\248802b74506342031e926839639c729\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\ime\imjp8_1\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\ime\imjp8_1\arrrziiir.rqy
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\ime\imjp8_1\byqyajqia.qjj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\ime\imjp8_1\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\ime\imjp8_1\riazzzari.byq
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\ime\imjp8_1\rrzqyjaaa.riz
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\ime\imjp8_1\zbyjayaya.rab
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\ime\imkr6_1\yzbzbyqqj.byj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\inf\riazzzari.byq
5e28284f9b5f9097640d58a73d38ad4cc:\WINDOWS\notepad.exe
b32a4db8fa8ba07afb1e86f8c9fb852ec:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\pchealth\helpctr\binaries\byqyajqia.qjj
b32a4db8fa8ba07afb1e86f8c9fb852ec:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\pchealth\helpctr\binaries\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\WINDOWS\xwrm.exe
0b9815723342621dfb40c07a4ca66a89c:\totalcmd\abijrazyi.yai
0b9815723342621dfb40c07a4ca66a89c:\totalcmd\rabrrarar.qqj
0b9815723342621dfb40c07a4ca66a89c:\totalcmd\yzbzbyqqj.byj

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:1076
    rabrrarar.qqj:1304
    rabrrarar.qqj:264

  2. Delete the original Virus file.
  3. Delete or disinfect the following files created/modified by the Virus:

    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\arrrziiir.rqy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\arrrziiir.rqy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\rrzqyjaaa.riz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\rabrrarar.qqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\riazzzari.byq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\byqyajqia.qjj (43 bytes)
    %Program Files%\Outlook Express\byqyajqia.qjjjqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\byqyajqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\yzbzbyqqj.byj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\yzbzbyqqj.byj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\rrzqyjaaa.riz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\abijrazyi.yai (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\byqyajqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\arrrziiir.rqy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\arrrziiir.rqy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\abijrazyi.yai (43 bytes)
    %WinDir%\ime\imkr6_1\yzbzbyqqj.byj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\abijrazyi.yai (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\yzbzbyqqj.byj (43 bytes)
    %WinDir%\inf\riazzzari.byq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\rabrrarar.qqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\arrrziiir.rqy (43 bytes)
    %Program Files%\Windows NT\Pinball\riazzzari.byq.byjj (43 bytes)
    %Program Files%\MSN Gaming Zone\Windows\abijrazyi.yaij (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\rabrrarar.qqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\rrzqyjaaa.riz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\rabrrarar.qqj (43 bytes)
    %Program Files%\WinPcap\abijrazyi.yaiazzzari.byq.byjj (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\yzbzbyqqj.byj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\riazzzari.byq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\riazzzari.byq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\riazzzari.byq (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbyjayaya.rab (43 bytes)
    %WinDir%\ime\imjp8_1\byqyajqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\zbyjayaya.rab (43 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\rabrrarar.qqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\arrrziiir.rqy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\arrrziiir.rqy (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrzqyjaaa.riz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\abijrazyi.yai (43 bytes)
    %Program Files%\Outlook Express\abijrazyi.yaijqia.qjj (43 bytes)
    %Program Files%\Common Files\Microsoft Shared\MSInfo\rrzqyjaaa.riz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\rrzqyjaaa.riz (43 bytes)
    C:\totalcmd\rabrrarar.qqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\yzbzbyqqj.byj (43 bytes)
    %Program Files%\Windows Media Player\rabrrarar.qqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\riazzzari.byq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\byqyajqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\yzbzbyqqj.byj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\byqyajqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\zbyjayaya.rab (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\byqyajqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\riazzzari.byq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\abijrazyi.yai (43 bytes)
    %WinDir%\ime\imjp8_1\arrrziiir.rqy (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\riazzzari.byq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\zbyjayaya.rab (43 bytes)
    %Program Files%\MSN Gaming Zone\Windows\byqyajqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\arrrziiir.rqy (43 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\arrrziiir.rqy (43 bytes)
    %Program Files%\NetMeeting\rabrrarar.qqjbyqyajqia.qjj (43 bytes)
    %WinDir%\pchealth\helpctr\binaries\rabrrarar.qqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\rabrrarar.qqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\zbyjayaya.rab (43 bytes)
    %Program Files%\Common Files\Adobe\Updater6\riazzzari.byq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\rabrrarar.qqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\rabrrarar.qqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\rrzqyjaaa.riz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\rrzqyjaaa.riz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\riazzzari.byq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\rabrrarar.qqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\zbyjayaya.rab (43 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\rabrrarar.qqj (43 bytes)
    C:\totalcmd\yzbzbyqqj.byj (43 bytes)
    %Program Files%\Outlook Express\yzbzbyqqj.byjjqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\rabrrarar.qqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\rrzqyjaaa.riz (43 bytes)
    %WinDir%\pchealth\helpctr\binaries\byqyajqia.qjj (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yzbzbyqqj.byj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\byqyajqia.qjj (43 bytes)
    %Program Files%\MSN Gaming Zone\Windows\riazzzari.byqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\yzbzbyqqj.byj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\zbyjayaya.rab (43 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\abijrazyi.yai (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\arrrziiir.rqy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\rabrrarar.qqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\riazzzari.byq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\rrzqyjaaa.riz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\zbyjayaya.rab (43 bytes)
    %WinDir%\$NtUninstallKB898461$\spuninst\arrrziiir.rqy (43 bytes)
    %Program Files%\Windows Media Player\rrzqyjaaa.rizqjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\rabrrarar.qqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\zbyjayaya.rab (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\abijrazyi.yai (43 bytes)
    %WinDir%\$hf_mig$\KB898461\byqyajqia.qjj (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\byqyajqia.qjj (43 bytes)
    C:\totalcmd\abijrazyi.yai (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\byqyajqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\arrrziiir.rqy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\abijrazyi.yai (43 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\riazzzari.byq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\rrzqyjaaa.riz (43 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\abijrazyi.yai (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\riazzzari.byq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\byqyajqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\abijrazyi.yai (43 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\zbyjayaya.rab (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\byqyajqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\byqyajqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\rrzqyjaaa.riz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\rrzqyjaaa.riz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\arrrziiir.rqy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\abijrazyi.yai (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\byqyajqia.qjj (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\zbyjayaya.rab (43 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\rrzqyjaaa.riz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\rrzqyjaaa.riz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\zbyjayaya.rab (43 bytes)
    %WinDir%\ime\imjp8_1\abijrazyi.yai (43 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\riazzzari.byq (43 bytes)
    %WinDir%\xwrm.exe (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\yzbzbyqqj.byj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\arrrziiir.rqy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\yzbzbyqqj.byj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\yzbzbyqqj.byj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\yzbzbyqqj.byj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\riazzzari.byq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\riazzzari.byq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\byqyajqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\yzbzbyqqj.byj (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abijrazyi.yai (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\yzbzbyqqj.byj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\rrzqyjaaa.riz (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\abijrazyi.yai (43 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\rabrrarar.qqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\zbyjayaya.rab (43 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\byqyajqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\rrzqyjaaa.riz (43 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\riazzzari.byq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\arrrziiir.rqy (43 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\yzbzbyqqj.byj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\yzbzbyqqj.byj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\byqyajqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\arrrziiir.rqy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\byqyajqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\zbyjayaya.rab (43 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\zbyjayaya.rab (43 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\abijrazyi.yai (43 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\rrzqyjaaa.riz (43 bytes)
    %WinDir%\Microsoft.NET\Framework\rabrrarar.qqj (43 bytes)
    %WinDir%\ime\imjp8_1\rrzqyjaaa.riz (43 bytes)
    %WinDir%\abijrazyi.yai (43 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\yzbzbyqqj.byj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\riazzzari.byq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\rabrrarar.qqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\yzbzbyqqj.byj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\byqyajqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\byqyajqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\yzbzbyqqj.byj (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\yybaiy.yrjj.aar (43 bytes)
    %Program Files%\NetMeeting\arrrziiir.rqybyqyajqia.qjj (43 bytes)
    %Program Files%\Windows NT\zbyjayaya.rab (43 bytes)
    %Program Files%\NetMeeting\rrzqyjaaa.rizbyqyajqia.qjj (43 bytes)
    %WinDir%\$hf_mig$\KB898461\update\rrzqyjaaa.riz.byjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\rabrrarar.qqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\zbyjayaya.rab (43 bytes)
    %Program Files%\Windows NT\Accessories\yzbzbyqqj.byjj (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\byqyajqia.qjjaa.rizjqia.qjj (43 bytes)
    %WinDir%\Network Diagnostic\riazzzari.byq (43 bytes)
    %WinDir%\ime\imjp8_1\riazzzari.byq (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\rrzqyjaaa.rizjqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\abijrazyi.yai (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\riazzzari.byq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\arrrziiir.rqy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\rrzqyjaaa.riz (43 bytes)
    %WinDir%\ime\imjp8_1\rabrrarar.qqj (43 bytes)
    %WinDir%\ime\imjp8_1\zbyjayaya.rab (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\arrrziiir.rqy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\abijrazyi.yai (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\arrrziiir.rqy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\zbyjayaya.rab (43 bytes)
    %Program Files%\Windows Media Player\arrrziiir.rqy (43 bytes)
    %Program Files%\Outlook Express\zbyjayaya.rabjqia.qjj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\abijrazyi.yai (43 bytes)
    %Program Files%\MSN Gaming Zone\Windows\zbyjayaya.rabj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\abijrazyi.yai (43 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\rabrrarar.qqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\arrrziiir.rqy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\zbyjayaya.rab (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ajyajy.yyyj.aar (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ryaizy.ybrj.aar (43 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "x32x" = "%WinDir%\xwrm.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
qjbyjzby4096409615360.6587784178cda43369033149c9fe16536fb506
jayayara819232768322565.1031622921b139735d1a8cc2c7d9a6f4a23c1
briazzza4096040965120.46801303990ce32513f25d3855296b7bc8aa4d
ribyqabi45056409620483.924736481060bb77e469e5fdb95d8e5c6ab31

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Virus connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1076:

\xwrm.exe

\xwrm.exe

%WinDir%\xwrm.exe

%WinDir%\xwrm.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

USER %s 8 * :%s

USER %s 8 * :%s

NICK %s

NICK %s

PONG %s

PONG %s

JOIN #england

JOIN #england

PRIVMSG #england :.-:[X-Worm]:-.

PRIVMSG #england :.-:[X-Worm]:-.

irc.undernet.org

irc.undernet.org

MAIL FROM:<%s>

MAIL FROM:<%s>

RCPT TO:<%s>

RCPT TO:<%s>

--%s--

--%s--

From:<%s>

From:<%s>

To: %s

To: %s

Subject:%s

Subject:%s

boundary="%s"

boundary="%s"

X-Mailer: Microsoft Outlook Express 6.00.2800.1106

X-Mailer: Microsoft Outlook Express 6.00.2800.1106

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

charset="windows-1255"

charset="windows-1255"

name= "%s%s"

name= "%s%s"

Content-Disposition: attachment; filename="%s%s"

Content-Disposition: attachment; filename="%s%s"

Support

Support

No.reply

No.reply

8.txtt:

8.txtt:

8.htmt2

8.htmt2

8.rtft*

8.rtft*

8.doct"

8.doct"

8.bdxt

8.bdxt

8.phpt

8.phpt

8.jspt

8.jspt

8.cgit

8.cgit

smtp

smtp

ws2_32.dll

ws2_32.dll

ADVAPI32.DLL

ADVAPI32.DLL

RegOpenKeyExA

RegOpenKeyExA

RegCloseKey

RegCloseKey

User32.dll

User32.dll

manifest.txt

manifest.txt

9e6400_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03

9e6400_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03

8.exe

8.exe

8.scrtt

8.scrtt

8.avitJ

8.avitJ

8.doctB

8.doctB

8.mp3t:

8.mp3t:

8.mpgt2

8.mpgt2

8.xlst*

8.xlst*

8.jpgt"

8.jpgt"

8.zipt

8.zipt

8.isot

8.isot

8.pdft

8.pdft

8.pptt

8.pptt

8.rart

8.rart

c:\WINDOWS\_default.pif

c:\WINDOWS\_default.pif

stem.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll

stem.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll

nSolicitedRCUI.htm

nSolicitedRCUI.htm

rs.Soap.dll

rs.Soap.dll

SFC.DLL

SFC.DLL

WinExec

WinExec

byqyajqia.qjj

byqyajqia.qjj

c:\WINDOWS\byqyajqia.qjj

c:\WINDOWS\byqyajqia.qjj

bution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\zbyjayaya.rab

bution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\zbyjayaya.rab

jqia.qjj

jqia.qjj

ReadMe.exe

ReadMe.exe

c:\%original file name%.exe

c:\%original file name%.exe

RsQUN.exe

RsQUN.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\yybaiy.yrjj.aar

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\yybaiy.yrjj.aar

GetWindowsDirectoryA

GetWindowsDirectoryA

FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj

FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj

KERNEL32.dll

KERNEL32.dll


Related articles