Virus.Win32.Duel_029bdda365

by malwarelabrobot on July 2nd, 2013 in Malware Descriptions.

Susp_Dropper (Kaspersky), LooksLike.Win32.Malware!B (v) (VIPRE), Virus.Win32.Heur!IK (Emsisoft), Virus.Win32.Duel.FD, GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)
Behaviour: Worm, Email-Worm, Virus, IRCBot


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary
Technical Details
Removal Recommendations

MD5: 029bdda3657b29581defe4e74f32043e
SHA1: cb047695fcee2f00df52fa6ca3df9cb802c9feb8
SHA256: f1cd9ad4bc1de15520443c1b48e38409faa917df23c450cb1795d6d31dba19d6
SSDeep: 768:t/hLhB3fCKVB GAF171SPC0GxPczSIp2:lhfBw3sjyczS
Size: 48640 bytes
File type: PE32
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: no data


Summary:

Email-Worm. Worm that spreads its copies in attachments included in emails.
Virus. A program that recursively replicates a possibly evolved copy of itself.
IRCBot. A bot communicates with command and control servers via IRC channel.

Process activity

The Virus creates the following process(es):

abrrararq.qjy:1492
abrrararq.qjy:1828
029bdda3657b29581defe4e74f32043e.exe:880

The Virus injects its code into the following process(es):

File activity

The process abrrararq.qjy:1492 makes changes in a file system.
The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\izzzir.iqjj.qrz (48 bytes)

The process abrrararq.qjy:1828 makes changes in a file system.
The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zijjzz.aiyj.qrz (48 bytes)

The process 029bdda3657b29581defe4e74f32043e.exe:880 makes changes in a file system.
The Virus creates and/or writes to the following file(s):

%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\rzqyjaaar.iza (48 bytes)
%Program Files%\MSN Gaming Zone\Windows\bijrazyiy.aibz (48 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\byjayayar.abr (48 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\byjayayar.abr (48 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rrrziiirr.qyr (48 bytes)
%Program Files%\Outlook Express\yqyajqiaq.jjrqiaq.jjr (48 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\zbzbyqqjb.yjz (48 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\rrrziiirr.qyr (48 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\zbzbyqqjb.yjz (48 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\yqyajqiaq.jjr (48 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\byjayayar.abr (48 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\abrrararq.qjy (48 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\abrrararq.qjy (48 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\zbzbyqqjb.yjz (48 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\iazzzarib.yqa (48 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\iazzzarib.yqa (48 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\iazzzarib.yqa (48 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\bijrazyiy.aib (48 bytes)
%Program Files%\Wireshark\rzqyjaaar.iza (48 bytes)
%WinDir%\pchealth\helpctr\binaries\abrrararq.qjy (48 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\yqyajqiaq.jjr (48 bytes)
%WinDir%\Network Diagnostic\iazzzarib.yqa (48 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\rrrziiirr.qyr (48 bytes)
%Program Files%\NetMeeting\rzqyjaaar.izayqyajqiaq.jjr (48 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\iazzzarib.yqa (48 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\iazzzarib.yqa (48 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\abrrararq.qjy (48 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\yqyajqiaq.jjrar.izaqiaq.jjr (48 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\zbzbyqqjb.yjz (48 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\bijrazyiy.aib (48 bytes)
C:\Perl\bin\zbzbyqqjb.yjz (48 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\abrrararq.qjy (48 bytes)
C:\totalcmd\abrrararq.qjy (48 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\bijrazyiy.aib (48 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\yqyajqiaq.jjr (48 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\yqyajqiaq.jjr (48 bytes)
%Program Files%\Windows NT\Pinball\iazzzarib.yqa.yjzr (48 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\yqyajqiaq.jjr (48 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\bijrazyiy.aib (48 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\bijrazyiy.aib (48 bytes)
%WinDir%\Microsoft.NET\Framework\abrrararq.qjy (48 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\rrrziiirr.qyr (48 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\byjayayar.abr (48 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\rzqyjaaar.iza (48 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\zbzbyqqjb.yjz (48 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\iazzzarib.yqa (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\yqyajqiaq.jjr (48 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\abrrararq.qjy (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\rzqyjaaar.izaqiaq.jjr (48 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\rrrziiirr.qyr (48 bytes)
%WinDir%\ime\imjp8_1\abrrararq.qjy (48 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\zbzbyqqjb.yjz (48 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\zbzbyqqjb.yjz (48 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\rrrziiirr.qyr (48 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\abrrararq.qjy (48 bytes)
C:\Perl\bin\byjayayar.abr (48 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\zbzbyqqjb.yjz (48 bytes)
%Program Files%\Wireshark\rrrziiirr.qyr (48 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\iazzzarib.yqa (48 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\rzqyjaaar.iza (48 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\rzqyjaaar.iza (48 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\byjayayar.abr (48 bytes)
C:\totalcmd\zbzbyqqjb.yjz (48 bytes)
%WinDir%\ime\imjp8_1\iazzzarib.yqa (48 bytes)
%Program Files%\Windows Media Player\rzqyjaaar.izajjr (48 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\rzqyjaaar.iza (48 bytes)
%WinDir%\$hf_mig$\KB898461\update\rzqyjaaar.iza.yjzr (48 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\yqyajqiaq.jjr (48 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\iazzzarib.yqa (48 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\bijrazyiy.aib (48 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\iazzzarib.yqa (48 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\zbzbyqqjb.yjz (48 bytes)
%Program Files%\MSN Gaming Zone\Windows\byjayayar.abrz (48 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byjayayar.abr (48 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\yqyajqiaq.jjr (48 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\rzqyjaaar.iza (48 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\rrrziiirr.qyr (48 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\zbzbyqqjb.yjz (48 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\rzqyjaaar.iza (48 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\rrrziiirr.qyr (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ybryzi.zqqj.qrz (48 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\iazzzarib.yqa (48 bytes)
%Program Files%\Windows Media Player\abrrararq.qjy (48 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\zbzbyqqjb.yjz (48 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\iazzzarib.yqa (48 bytes)
%Program Files%\Windows Media Player\rrrziiirr.qyr (48 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\rrrziiirr.qyr (48 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\yqyajqiaq.jjr (48 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\byjayayar.abr (48 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\byjayayar.abr (48 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\byjayayar.abr (48 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\rrrziiirr.qyr (48 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\bijrazyiy.aib (48 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\abrrararq.qjy (48 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\iazzzarib.yqa (48 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\yqyajqiaq.jjr (48 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rrrziiirr.qyr (48 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\rrrziiirr.qyr (48 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\rzqyjaaar.iza (48 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\rrrziiirr.qyr (48 bytes)
%WinDir%\$hf_mig$\KB898461\yqyajqiaq.jjr (48 bytes)
%Program Files%\Wireshark\byjayayar.abr (48 bytes)
%Program Files%\Wireshark\zbzbyqqjb.yjz (48 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\iazzzarib.yqa (48 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\rzqyjaaar.iza (48 bytes)
C:\Perl\bin\iazzzarib.yqa (48 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza (48 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\abrrararq.qjy (48 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\yqyajqiaq.jjr (48 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\rrrziiirr.qyr (48 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\bijrazyiy.aib (48 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\abrrararq.qjy (48 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\byjayayar.abr (48 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\bijrazyiy.aib (48 bytes)
%Program Files%\MSN Gaming Zone\Windows\yqyajqiaq.jjr (48 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\rzqyjaaar.iza (48 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\yqyajqiaq.jjr (48 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\zbzbyqqjb.yjz (48 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\zbzbyqqjb.yjz (48 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\yqyajqiaq.jjr (48 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\byjayayar.abr (48 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\byjayayar.abr (48 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjayayar.abr (48 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\abrrararq.qjy (48 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\byjayayar.abr (48 bytes)
%Program Files%\NetMeeting\abrrararq.qjyyqyajqiaq.jjr (48 bytes)
%WinDir%\xwrm.exe (48 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\zbzbyqqjb.yjz (48 bytes)
%WinDir%\ime\imjp8_1\bijrazyiy.aib (48 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\byjayayar.abr (48 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\abrrararq.qjy (48 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\rzqyjaaar.iza (48 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\iazzzarib.yqa (48 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\iazzzarib.yqa (48 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\bijrazyiy.aib (48 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\yqyajqiaq.jjr (48 bytes)
%WinDir%\ime\imjp8_1\rzqyjaaar.iza (48 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\yqyajqiaq.jjr (48 bytes)
%Program Files%\Common Files\Adobe\Updater6\iazzzarib.yqa (48 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\rzqyjaaar.iza (48 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\rrrziiirr.qyr (48 bytes)
%WinDir%\ime\imjp8_1\yqyajqiaq.jjr (48 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\rzqyjaaar.iza (48 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\rrrziiirr.qyr (48 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\zbzbyqqjb.yjz (48 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\byjayayar.abr (48 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\iazzzarib.yqa (48 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\iazzzarib.yqa (48 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\bijrazyiy.aib (48 bytes)
%Program Files%\Outlook Express\zbzbyqqjb.yjzqiaq.jjr (48 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\bijrazyiy.aib (48 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\bijrazyiy.aib (48 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\yqyajqiaq.jjr (48 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\bijrazyiy.aib (48 bytes)
%Program Files%\Windows NT\byjayayar.abr (48 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\yqyajqiaq.jjr (48 bytes)
%Program Files%\WinPcap\bijrazyiy.aibzzzarib.yqa.yjzr (48 bytes)
%Program Files%\MSN Gaming Zone\Windows\iazzzarib.yqaz (48 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\abrrararq.qjy (48 bytes)
%Program Files%\NetMeeting\rrrziiirr.qyryqyajqiaq.jjr (48 bytes)
%Program Files%\Windows NT\Accessories\zbzbyqqjb.yjzr (48 bytes)
%Program Files%\Wireshark\abrrararq.qjy (48 bytes)
%WinDir%\ime\imjp8_1\rrrziiirr.qyr (48 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib (48 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr (48 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\rrrziiirr.qyr (48 bytes)
%WinDir%\ime\imkr6_1\zbzbyqqjb.yjz (48 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\byjayayar.abr (48 bytes)
%WinDir%\bijrazyiy.aib (48 bytes)
%Program Files%\Wireshark\iazzzarib.yqa (48 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\abrrararq.qjy (48 bytes)
%Program Files%\Outlook Express\byjayayar.abrqiaq.jjr (48 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rzqyjaaar.iza (48 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\zbzbyqqjb.yjz (48 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\rzqyjaaar.iza (48 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\abrrararq.qjy (48 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\zbzbyqqjb.yjz (48 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\rzqyjaaar.iza (48 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz (48 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\bijrazyiy.aib (48 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\zbzbyqqjb.yjz (48 bytes)
D:\iazzzarib.yqa (48 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr (48 bytes)
%WinDir%\ime\imjp8_1\byjayayar.abr (48 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\abrrararq.qjy (48 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\byjayayar.abr (48 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\bijrazyiy.aib (48 bytes)
C:\totalcmd\bijrazyiy.aib (48 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\abrrararq.qjy (48 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\rrrziiirr.qyr (48 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\rrrziiirr.qyr (48 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\abrrararq.qjy (48 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\yqyajqiaq.jjr (48 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\bijrazyiy.aib (48 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\rzqyjaaar.iza (48 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\rzqyjaaar.iza (48 bytes)
%Program Files%\Outlook Express\bijrazyiy.aibqiaq.jjr (48 bytes)
%WinDir%\inf\iazzzarib.yqa (48 bytes)
%WinDir%\pchealth\helpctr\binaries\yqyajqiaq.jjr (48 bytes)

Registry activity

The process abrrararq.qjy:1492 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F 74 F1 6C 59 5B 6F 34 46 B7 5E 3A B8 53 26 D3"

The process abrrararq.qjy:1828 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "68 BD 12 7A 6A 55 D9 D8 AD 19 50 9E 4D 74 B3 BD"

The process 029bdda3657b29581defe4e74f32043e.exe:880 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"

Network activity (URLs)

A bot communicates with command and control servers via IRC channel.

No activity has been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Worm that spreads its copies in attachments included in emails.


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    abrrararq.qjy:1492
    abrrararq.qjy:1828
    029bdda3657b29581defe4e74f32043e.exe:880

  2. Delete the original Virus file.
  3. Delete or disinfect the following files created/modified by the Virus:

    %Documents and Settings%\%current user%\Local Settings\Temp\izzzir.iqjj.qrz (48 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\zijjzz.aiyj.qrz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\rzqyjaaar.iza (48 bytes)
    %Program Files%\MSN Gaming Zone\Windows\bijrazyiy.aibz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\byjayayar.abr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\byjayayar.abr (48 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\rrrziiirr.qyr (48 bytes)
    %Program Files%\Outlook Express\yqyajqiaq.jjrqiaq.jjr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\rrrziiirr.qyr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\yqyajqiaq.jjr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\byjayayar.abr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\abrrararq.qjy (48 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\abrrararq.qjy (48 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\iazzzarib.yqa (48 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\iazzzarib.yqa (48 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\iazzzarib.yqa (48 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\bijrazyiy.aib (48 bytes)
    %Program Files%\Wireshark\rzqyjaaar.iza (48 bytes)
    %WinDir%\pchealth\helpctr\binaries\abrrararq.qjy (48 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\yqyajqiaq.jjr (48 bytes)
    %WinDir%\Network Diagnostic\iazzzarib.yqa (48 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\rrrziiirr.qyr (48 bytes)
    %Program Files%\NetMeeting\rzqyjaaar.izayqyajqiaq.jjr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\iazzzarib.yqa (48 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\iazzzarib.yqa (48 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\abrrararq.qjy (48 bytes)
    %Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\yqyajqiaq.jjrar.izaqiaq.jjr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\bijrazyiy.aib (48 bytes)
    C:\Perl\bin\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\abrrararq.qjy (48 bytes)
    C:\totalcmd\abrrararq.qjy (48 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\bijrazyiy.aib (48 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\yqyajqiaq.jjr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\yqyajqiaq.jjr (48 bytes)
    %Program Files%\Windows NT\Pinball\iazzzarib.yqa.yjzr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\yqyajqiaq.jjr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\bijrazyiy.aib (48 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\bijrazyiy.aib (48 bytes)
    %WinDir%\Microsoft.NET\Framework\abrrararq.qjy (48 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\rrrziiirr.qyr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\byjayayar.abr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\rzqyjaaar.iza (48 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\iazzzarib.yqa (48 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\yqyajqiaq.jjr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\abrrararq.qjy (48 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\rzqyjaaar.izaqiaq.jjr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\rrrziiirr.qyr (48 bytes)
    %WinDir%\ime\imjp8_1\abrrararq.qjy (48 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\rrrziiirr.qyr (48 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\abrrararq.qjy (48 bytes)
    C:\Perl\bin\byjayayar.abr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\zbzbyqqjb.yjz (48 bytes)
    %Program Files%\Wireshark\rrrziiirr.qyr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\iazzzarib.yqa (48 bytes)
    %Program Files%\Common Files\Microsoft Shared\MSInfo\rzqyjaaar.iza (48 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\rzqyjaaar.iza (48 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\byjayayar.abr (48 bytes)
    C:\totalcmd\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\ime\imjp8_1\iazzzarib.yqa (48 bytes)
    %Program Files%\Windows Media Player\rzqyjaaar.izajjr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\rzqyjaaar.iza (48 bytes)
    %WinDir%\$hf_mig$\KB898461\update\rzqyjaaar.iza.yjzr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\yqyajqiaq.jjr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\iazzzarib.yqa (48 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\bijrazyiy.aib (48 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\iazzzarib.yqa (48 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\zbzbyqqjb.yjz (48 bytes)
    %Program Files%\MSN Gaming Zone\Windows\byjayayar.abrz (48 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\byjayayar.abr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\yqyajqiaq.jjr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\rzqyjaaar.iza (48 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\rrrziiirr.qyr (48 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\rzqyjaaar.iza (48 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\rrrziiirr.qyr (48 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ybryzi.zqqj.qrz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\iazzzarib.yqa (48 bytes)
    %Program Files%\Windows Media Player\abrrararq.qjy (48 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\iazzzarib.yqa (48 bytes)
    %Program Files%\Windows Media Player\rrrziiirr.qyr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\rrrziiirr.qyr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\yqyajqiaq.jjr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\byjayayar.abr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\byjayayar.abr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\byjayayar.abr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\rrrziiirr.qyr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\bijrazyiy.aib (48 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\abrrararq.qjy (48 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\iazzzarib.yqa (48 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\yqyajqiaq.jjr (48 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\rrrziiirr.qyr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\rrrziiirr.qyr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\rzqyjaaar.iza (48 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\rrrziiirr.qyr (48 bytes)
    %WinDir%\$hf_mig$\KB898461\yqyajqiaq.jjr (48 bytes)
    %Program Files%\Wireshark\byjayayar.abr (48 bytes)
    %Program Files%\Wireshark\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\iazzzarib.yqa (48 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\rzqyjaaar.iza (48 bytes)
    C:\Perl\bin\iazzzarib.yqa (48 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\rzqyjaaar.iza (48 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\abrrararq.qjy (48 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\yqyajqiaq.jjr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\rrrziiirr.qyr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\bijrazyiy.aib (48 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\abrrararq.qjy (48 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\byjayayar.abr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\bijrazyiy.aib (48 bytes)
    %Program Files%\MSN Gaming Zone\Windows\yqyajqiaq.jjr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\rzqyjaaar.iza (48 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\yqyajqiaq.jjr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\yqyajqiaq.jjr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\byjayayar.abr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\byjayayar.abr (48 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byjayayar.abr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\abrrararq.qjy (48 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\byjayayar.abr (48 bytes)
    %Program Files%\NetMeeting\abrrararq.qjyyqyajqiaq.jjr (48 bytes)
    %WinDir%\xwrm.exe (48 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\ime\imjp8_1\bijrazyiy.aib (48 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\byjayayar.abr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\abrrararq.qjy (48 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\rzqyjaaar.iza (48 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\iazzzarib.yqa (48 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\iazzzarib.yqa (48 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\bijrazyiy.aib (48 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\yqyajqiaq.jjr (48 bytes)
    %WinDir%\ime\imjp8_1\rzqyjaaar.iza (48 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\yqyajqiaq.jjr (48 bytes)
    %Program Files%\Common Files\Adobe\Updater6\iazzzarib.yqa (48 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\rzqyjaaar.iza (48 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\rrrziiirr.qyr (48 bytes)
    %WinDir%\ime\imjp8_1\yqyajqiaq.jjr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\rzqyjaaar.iza (48 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\rrrziiirr.qyr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\byjayayar.abr (48 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\iazzzarib.yqa (48 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\iazzzarib.yqa (48 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\bijrazyiy.aib (48 bytes)
    %Program Files%\Outlook Express\zbzbyqqjb.yjzqiaq.jjr (48 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\bijrazyiy.aib (48 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\bijrazyiy.aib (48 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\yqyajqiaq.jjr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\bijrazyiy.aib (48 bytes)
    %Program Files%\Windows NT\byjayayar.abr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\yqyajqiaq.jjr (48 bytes)
    %Program Files%\WinPcap\bijrazyiy.aibzzzarib.yqa.yjzr (48 bytes)
    %Program Files%\MSN Gaming Zone\Windows\iazzzarib.yqaz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\abrrararq.qjy (48 bytes)
    %Program Files%\NetMeeting\rrrziiirr.qyryqyajqiaq.jjr (48 bytes)
    %Program Files%\Windows NT\Accessories\zbzbyqqjb.yjzr (48 bytes)
    %Program Files%\Wireshark\abrrararq.qjy (48 bytes)
    %WinDir%\ime\imjp8_1\rrrziiirr.qyr (48 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bijrazyiy.aib (48 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\yqyajqiaq.jjr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\rrrziiirr.qyr (48 bytes)
    %WinDir%\ime\imkr6_1\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\byjayayar.abr (48 bytes)
    %WinDir%\bijrazyiy.aib (48 bytes)
    %Program Files%\Wireshark\iazzzarib.yqa (48 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\abrrararq.qjy (48 bytes)
    %Program Files%\Outlook Express\byjayayar.abrqiaq.jjr (48 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rzqyjaaar.iza (48 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\rzqyjaaar.iza (48 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\abrrararq.qjy (48 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\rzqyjaaar.iza (48 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbzbyqqjb.yjz (48 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\bijrazyiy.aib (48 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\zbzbyqqjb.yjz (48 bytes)
    D:\iazzzarib.yqa (48 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrrziiirr.qyr (48 bytes)
    %WinDir%\ime\imjp8_1\byjayayar.abr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\abrrararq.qjy (48 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\byjayayar.abr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\bijrazyiy.aib (48 bytes)
    C:\totalcmd\bijrazyiy.aib (48 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\abrrararq.qjy (48 bytes)
    %WinDir%\$NtUninstallKB898461$\spuninst\rrrziiirr.qyr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\rrrziiirr.qyr (48 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\abrrararq.qjy (48 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\yqyajqiaq.jjr (48 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\bijrazyiy.aib (48 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\rzqyjaaar.iza (48 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\rzqyjaaar.iza (48 bytes)
    %Program Files%\Outlook Express\bijrazyiy.aibqiaq.jjr (48 bytes)
    %WinDir%\inf\iazzzarib.yqa (48 bytes)
    %WinDir%\pchealth\helpctr\binaries\yqyajqiaq.jjr (48 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "x32x" = "%WinDir%\xwrm.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now