Susp_Dropper (Kaspersky), LooksLike.Win32.Malware!B (v) (VIPRE), Email-Worm.Win32.Brontok!IK (Emsisoft), Virus.Win32.Duel.FD, GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)Behaviour: Worm, Email-Worm, Virus, IRCBot
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 3c46dd286fb82371cf331cffd3ee656a
SHA1: 105ddec617f9821ae2f715a4279089c8d7f0a41f
SHA256: e84b595cba4a7f01ab707f1188b09566c5f86a73ae7b834f4575be4268c5be00
SSDeep: 768:0Cr8yKM m811kEVQ9uwkTEr4JR4n2YKDJ0q1wd2:0dyKM nfkuQ9DNr44NEJ0yw
Size: 44032 bytes
File type: PE32
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: SetupManager
Created at: no data
Summary: Email-Worm. Worm that spreads its copies in attachments included in emails.
Dynamic Analysis
Process activity
The Virus creates the following process(es):
rabrrarar.qqj:688
rabrrarar.qqj:532
3c46dd286fb82371cf331cffd3ee656a.exe:1640
The Virus injects its code into the following process(es):
File activity
The process rabrrarar.qqj:688 makes changes in a file system.
The Virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\abbzzr.byiy.zby (44 bytes)
The process rabrrarar.qqj:532 makes changes in a file system.
The Virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\rzaiyj.iqiy.zby (44 bytes)
The process 3c46dd286fb82371cf331cffd3ee656a.exe:1640 makes changes in a file system.
The Virus creates and/or writes to the following file(s):
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\byqyajqia.qjj (44 bytes)
%Program Files%\Outlook Express\byqyajqia.qjjjqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\abijrazyi.yai (44 bytes)
%WinDir%\ime\imkr6_1\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\yzbzbyqqj.byj (44 bytes)
%WinDir%\inf\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\arrrziiir.rqy (44 bytes)
%Program Files%\Windows NT\Pinball\riazzzari.byq.byjj (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\abijrazyi.yaij (44 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\rabrrarar.qqj (44 bytes)
%Program Files%\WinPcap\abijrazyi.yaiazzzari.byq.byjj (44 bytes)
%Program Files%\Wireshark\yzbzbyqqj.byj (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\riazzzari.byq (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbyjayaya.rab (44 bytes)
%WinDir%\ime\imjp8_1\byqyajqia.qjj (44 bytes)
D:\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\arrrziiir.rqy (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\abijrazyi.yai (44 bytes)
%Program Files%\Outlook Express\abijrazyi.yaijqia.qjj (44 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\rrzqyjaaa.riz (44 bytes)
C:\totalcmd\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\yzbzbyqqj.byj (44 bytes)
%Program Files%\Windows Media Player\rabrrarar.qqj (44 bytes)
%Program Files%\Wireshark\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\abijrazyi.yai (44 bytes)
%WinDir%\ime\imjp8_1\arrrziiir.rqy (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\zbyjayaya.rab (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\arrrziiir.rqy (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\arrrziiir.rqy (44 bytes)
%Program Files%\NetMeeting\rabrrarar.qqjbyqyajqia.qjj (44 bytes)
%WinDir%\pchealth\helpctr\binaries\rabrrarar.qqj (44 bytes)
C:\Perl\bin\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\zbyjayaya.rab (44 bytes)
%Program Files%\Common Files\Adobe\Updater6\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\rabrrarar.qqj (44 bytes)
C:\totalcmd\yzbzbyqqj.byj (44 bytes)
%Program Files%\Outlook Express\yzbzbyqqj.byjjqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\rrzqyjaaa.riz (44 bytes)
%WinDir%\pchealth\helpctr\binaries\byqyajqia.qjj (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\byqyajqia.qjj (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\riazzzari.byqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\yzbzbyqqj.byj (44 bytes)
C:\Perl\bin\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\zbyjayaya.rab (44 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\arrrziiir.rqy (44 bytes)
%Program Files%\Windows Media Player\rrzqyjaaa.rizqjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\abijrazyi.yai (44 bytes)
%WinDir%\$hf_mig$\KB898461\byqyajqia.qjj (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\byqyajqia.qjj (44 bytes)
C:\totalcmd\abijrazyi.yai (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\rrzqyjaaa.riz (44 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\rrzqyjaaa.riz (44 bytes)
%Program Files%\Wireshark\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\byqyajqia.qjj (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\zbyjayaya.rab (44 bytes)
%WinDir%\ime\imjp8_1\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\riazzzari.byq (44 bytes)
%WinDir%\xwrm.exe (44 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\riazzzari.byq (44 bytes)
%Program Files%\Wireshark\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\yzbzbyqqj.byj (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\rrzqyjaaa.riz (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\abijrazyi.yai (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\zbyjayaya.rab (44 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\arrrziiir.rqy (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\yzbzbyqqj.byj (44 bytes)
%Program Files%\Wireshark\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\abijrazyi.yai (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rrzqyjaaa.riz (44 bytes)
%WinDir%\Microsoft.NET\Framework\rabrrarar.qqj (44 bytes)
%WinDir%\ime\imjp8_1\rrzqyjaaa.riz (44 bytes)
%WinDir%\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\riazzzari.byq (44 bytes)
%Program Files%\NetMeeting\arrrziiir.rqybyqyajqia.qjj (44 bytes)
%Program Files%\Windows NT\zbyjayaya.rab (44 bytes)
%Program Files%\NetMeeting\rrzqyjaaa.rizbyqyajqia.qjj (44 bytes)
%WinDir%\$hf_mig$\KB898461\update\rrzqyjaaa.riz.byjj (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rbazib.jiay.zby (44 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\zbyjayaya.rab (44 bytes)
%Program Files%\Windows NT\Accessories\yzbzbyqqj.byjj (44 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\byqyajqia.qjjaa.rizjqia.qjj (44 bytes)
%WinDir%\Network Diagnostic\riazzzari.byq (44 bytes)
%WinDir%\ime\imjp8_1\riazzzari.byq (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\rrzqyjaaa.rizjqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\abijrazyi.yai (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\rrzqyjaaa.riz (44 bytes)
%WinDir%\ime\imjp8_1\rabrrarar.qqj (44 bytes)
%WinDir%\ime\imjp8_1\zbyjayaya.rab (44 bytes)
C:\Perl\bin\zbyjayaya.rab (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\abijrazyi.yai (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\zbyjayaya.rab (44 bytes)
%Program Files%\Wireshark\riazzzari.byq (44 bytes)
%Program Files%\Windows Media Player\arrrziiir.rqy (44 bytes)
%Program Files%\Outlook Express\zbyjayaya.rabjqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\abijrazyi.yai (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\zbyjayaya.rabj (44 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\zbyjayaya.rab (44 bytes)
Registry activity
The process 3c46dd286fb82371cf331cffd3ee656a.exe:1640 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"
Network activity (URLs)
A bot communicates with command and control servers via IRC channel.No activity has been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Worm that spreads its copies in attachments included in emails.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
rabrrarar.qqj:688
rabrrarar.qqj:532
3c46dd286fb82371cf331cffd3ee656a.exe:1640 - Delete the original Virus file.
- Delete or disinfect the following files created/modified by the Virus:
%Documents and Settings%\%current user%\Local Settings\Temp\abbzzr.byiy.zby (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rzaiyj.iqiy.zby (44 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\byqyajqia.qjj (44 bytes)
%Program Files%\Outlook Express\byqyajqia.qjjjqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\abijrazyi.yai (44 bytes)
%WinDir%\ime\imkr6_1\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\yzbzbyqqj.byj (44 bytes)
%WinDir%\inf\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\arrrziiir.rqy (44 bytes)
%Program Files%\Windows NT\Pinball\riazzzari.byq.byjj (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\abijrazyi.yaij (44 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\rabrrarar.qqj (44 bytes)
%Program Files%\WinPcap\abijrazyi.yaiazzzari.byq.byjj (44 bytes)
%Program Files%\Wireshark\yzbzbyqqj.byj (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\riazzzari.byq (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbyjayaya.rab (44 bytes)
%WinDir%\ime\imjp8_1\byqyajqia.qjj (44 bytes)
D:\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\arrrziiir.rqy (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\abijrazyi.yai (44 bytes)
%Program Files%\Outlook Express\abijrazyi.yaijqia.qjj (44 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\rrzqyjaaa.riz (44 bytes)
C:\totalcmd\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\yzbzbyqqj.byj (44 bytes)
%Program Files%\Windows Media Player\rabrrarar.qqj (44 bytes)
%Program Files%\Wireshark\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\abijrazyi.yai (44 bytes)
%WinDir%\ime\imjp8_1\arrrziiir.rqy (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\zbyjayaya.rab (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\arrrziiir.rqy (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\arrrziiir.rqy (44 bytes)
%Program Files%\NetMeeting\rabrrarar.qqjbyqyajqia.qjj (44 bytes)
%WinDir%\pchealth\helpctr\binaries\rabrrarar.qqj (44 bytes)
C:\Perl\bin\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\zbyjayaya.rab (44 bytes)
%Program Files%\Common Files\Adobe\Updater6\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\rabrrarar.qqj (44 bytes)
C:\totalcmd\yzbzbyqqj.byj (44 bytes)
%Program Files%\Outlook Express\yzbzbyqqj.byjjqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\rrzqyjaaa.riz (44 bytes)
%WinDir%\pchealth\helpctr\binaries\byqyajqia.qjj (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\byqyajqia.qjj (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\riazzzari.byqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\yzbzbyqqj.byj (44 bytes)
C:\Perl\bin\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\zbyjayaya.rab (44 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\arrrziiir.rqy (44 bytes)
%Program Files%\Windows Media Player\rrzqyjaaa.rizqjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\abijrazyi.yai (44 bytes)
%WinDir%\$hf_mig$\KB898461\byqyajqia.qjj (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\byqyajqia.qjj (44 bytes)
C:\totalcmd\abijrazyi.yai (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\rrzqyjaaa.riz (44 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\rrzqyjaaa.riz (44 bytes)
%Program Files%\Wireshark\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\byqyajqia.qjj (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\zbyjayaya.rab (44 bytes)
%WinDir%\ime\imjp8_1\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\riazzzari.byq (44 bytes)
%WinDir%\xwrm.exe (44 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\riazzzari.byq (44 bytes)
%Program Files%\Wireshark\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\yzbzbyqqj.byj (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\rrzqyjaaa.riz (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\abijrazyi.yai (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\zbyjayaya.rab (44 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\rrzqyjaaa.riz (44 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\arrrziiir.rqy (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\yzbzbyqqj.byj (44 bytes)
%Program Files%\Wireshark\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\zbyjayaya.rab (44 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\abijrazyi.yai (44 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rrzqyjaaa.riz (44 bytes)
%WinDir%\Microsoft.NET\Framework\rabrrarar.qqj (44 bytes)
%WinDir%\ime\imjp8_1\rrzqyjaaa.riz (44 bytes)
%WinDir%\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\byqyajqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\yzbzbyqqj.byj (44 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\riazzzari.byq (44 bytes)
%Program Files%\NetMeeting\arrrziiir.rqybyqyajqia.qjj (44 bytes)
%Program Files%\Windows NT\zbyjayaya.rab (44 bytes)
%Program Files%\NetMeeting\rrzqyjaaa.rizbyqyajqia.qjj (44 bytes)
%WinDir%\$hf_mig$\KB898461\update\rrzqyjaaa.riz.byjj (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rbazib.jiay.zby (44 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\zbyjayaya.rab (44 bytes)
%Program Files%\Windows NT\Accessories\yzbzbyqqj.byjj (44 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\byqyajqia.qjjaa.rizjqia.qjj (44 bytes)
%WinDir%\Network Diagnostic\riazzzari.byq (44 bytes)
%WinDir%\ime\imjp8_1\riazzzari.byq (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\rrzqyjaaa.rizjqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\abijrazyi.yai (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\riazzzari.byq (44 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\rrzqyjaaa.riz (44 bytes)
%WinDir%\ime\imjp8_1\rabrrarar.qqj (44 bytes)
%WinDir%\ime\imjp8_1\zbyjayaya.rab (44 bytes)
C:\Perl\bin\zbyjayaya.rab (44 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\abijrazyi.yai (44 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\zbyjayaya.rab (44 bytes)
%Program Files%\Wireshark\riazzzari.byq (44 bytes)
%Program Files%\Windows Media Player\arrrziiir.rqy (44 bytes)
%Program Files%\Outlook Express\zbyjayaya.rabjqia.qjj (44 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\abijrazyi.yai (44 bytes)
%Program Files%\MSN Gaming Zone\Windows\zbyjayaya.rabj (44 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\abijrazyi.yai (44 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\rabrrarar.qqj (44 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\arrrziiir.rqy (44 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\zbyjayaya.rab (44 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"