Virus.Win32.Duel_033d7f34df
Susp_Dropper (Kaspersky), LooksLike.Win32.Malware!B (v) (VIPRE), Virus.Win32.Heur!IK (Emsisoft), Virus.Win32.Duel.FD, GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)
Behaviour: Worm, Email-Worm, Virus, IRCBot
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
MD5: 033d7f34df155c787f8d6268fa0fc64d
SHA1: c38fcfcbc64eb6353e51fabd59300044af1571d3
SHA256: bf212d41a3c0359789e74ab93dbdbb114c14d1fde5963e74d07c1e658313a58e
SSDeep: 384:VQPbQIj8AiLtwaPZ/V1bTG/bEYIcOckVa56hK7RLgKc/8FsYsxIo46k9loiQ3dk:S8AcyIzTGTPOrVhm5gKyx 9ZY2
Size: 41472 bytes
File type: PE32
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 1985-05-25 15:37:06
Summary:
Email-Worm. Worm that spreads its copies in attachments included in emails.
Virus. A program that recursively replicates a possibly evolved copy of itself.
IRCBot. A bot communicates with command and control servers via IRC channel.
Process activity
The Virus creates the following process(es):
033d7f34df155c787f8d6268fa0fc64d.exe:1032
rqyrabrra.rar:584
rqyrabrra.rar:1564
The Virus injects its code into the following process(es):
File activity
The process 033d7f34df155c787f8d6268fa0fc64d.exe:1032 makes changes in a file system.
The Virus creates and/or writes to the following file(s):
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\yrabrrara.rqq (41 bytes)
D:\rabriazzz.ari (41 bytes)
%WinDir%\ime\imjp8_1\jyzbzbyqq.jby (41 bytes)
%Program Files%\Windows Media Player\rizarrrzi.iir (41 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\jrrzqyjaa.ari (41 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rizarrrzi.iir (41 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\briazzzar.iby (41 bytes)
%Program Files%\MSN Gaming Zone\Windows\yaibyqyaj.qia (41 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rizarrrzi.iir (41 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rabriazzz.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\zarrrziii.rrq (41 bytes)
%Program Files%\Windows Media Player\rqyrabrra.rar (41 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\jyzbzbyqq.jby (41 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\qabijrazy.iya (41 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\jyzbzbyqq.jby (41 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jyzbzbyqq.jby (41 bytes)
C:\Perl\bin\byjzbyjay.aya (41 bytes)
%Program Files%\Wireshark\rizarrrzi.iir (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\qjjrrzqyj.aaaqyaj.qia (41 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\jzbyjayay.ara (41 bytes)
%WinDir%\$hf_mig$\KB898461\zarrrziii.rrq (41 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\yaibyqyaj.qia (41 bytes)
%Program Files%\Windows NT\Accessories\qqjyzbzby.qqja (41 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\jyzbzbyqq.jby (41 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\qabijrazy.iya (41 bytes)
%Program Files%\Windows NT\byjzbyjay.aya (41 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\qabijrazy.iya (41 bytes)
%WinDir%\$hf_mig$\KB898461\update\yrabrrara.rqq.qqja (41 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\jyzbzbyqq.jby (41 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\yrabrrara.rqq (41 bytes)
%Program Files%\NetMeeting\rizarrrzi.iiryaibyqyaj.qia (41 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\jyzbzbyqq.jby (41 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\qabijrazy.iya (41 bytes)
C:\Perl\bin\rabriazzz.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\jyzbzbyqq.jby (41 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\jyzbzbyqq.jby (41 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yaibyqyaj.qia (41 bytes)
%Program Files%\Wireshark\qqjyzbzby.qqj (41 bytes)
%WinDir%\Microsoft.NET\Framework\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\qabijrazy.iya (41 bytes)
%WinDir%\ime\imjp8_1\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\zarrrziii.rrq (41 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\briazzzar.iby (41 bytes)
%WinDir%\inf\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\ibyqyajqi.aqj (41 bytes)
%Program Files%\Wireshark\qjjrrzqyj.aaa (41 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\jzbyjayay.ara (41 bytes)
%WinDir%\ime\imjp8_1\qabijrazy.iya (41 bytes)
%Program Files%\Wireshark\ayzjiajiz.bqa (41 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\jyzbzbyqq.jby (41 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\qjjrrzqyj.aaa (41 bytes)
%Program Files%\Wireshark\jjjzzyjaz.ayb (41 bytes)
%Program Files%\Wireshark\rqyrabrra.rar (41 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\ibyqyajqi.aqj (41 bytes)
%Program Files%\MSN Gaming Zone\Windows\byqabijra.zyij (41 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\yrabrrara.rqq (41 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\jyzbzbyqq.jby (41 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\qjjrrzqyj.aaa (41 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\yrabrrara.rqq (41 bytes)
%WinDir%\pchealth\helpctr\binaries\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\zarrrziii.rrq (41 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\briazzzar.iby (41 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qabijrazy.iya (41 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byqabijra.zyi (41 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\jrrzqyjaa.ari (41 bytes)
C:\totalcmd\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\jyzbzbyqq.jby (41 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\jzbyjayay.ara (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\yaibyqyaj.qia (41 bytes)
%Program Files%\NetMeeting\rqyrabrra.raryaibyqyaj.qia (41 bytes)
%WinDir%\jrrzqyjaa.ari (41 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rqyrabrra.rar (41 bytes)
%WinDir%\ime\imjp8_1\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\jzbyjayay.ara (41 bytes)
C:\Perl\bin\qqjyzbzby.qqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\jyzbzbyqq.jby (41 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\jyzbzbyqq.jby (41 bytes)
%Program Files%\WinPcap\byqabijra.zyibriazzz.ari.qqja (41 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\jzbyjayay.ara (41 bytes)
%WinDir%\xwrm.exe (41 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\zarrrziii.rrq (41 bytes)
%WinDir%\ime\imjp8_1\ibyqyajqi.aqj (41 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\qqjyzbzby.qqj (41 bytes)
%WinDir%\ime\imjp8_1\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\yrabrrara.rqq (41 bytes)
C:\totalcmd\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\jyzbzbyqq.jby (41 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byjzbyjay.aya (41 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\jzbyjayay.ara (41 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\yaibyqyaj.qiayj.aaaqyaj.qia (41 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\yrabrrara.rqq (41 bytes)
%Program Files%\Windows Media Player\qjjrrzqyj.aaaqia (41 bytes)
%Program Files%\Common Files\Adobe\Updater6\rabriazzz.ari (41 bytes)
%WinDir%\ime\imjp8_1\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\jrrzqyjaa.ari (41 bytes)
%Program Files%\Outlook Express\byjzbyjay.ayaqyaj.qia (41 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\jrrzqyjaa.ari (41 bytes)
%Program Files%\MSN Gaming Zone\Windows\rabriazzz.arij (41 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\jyzbzbyqq.jby (41 bytes)
%Program Files%\NetMeeting\qjjrrzqyj.aaayaibyqyaj.qia (41 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\zarrrziii.rrq (41 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\byqabijra.zyi (41 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\zarrrziii.rrq (41 bytes)
%WinDir%\Network Diagnostic\ibyqyajqi.aqj (41 bytes)
%Program Files%\MSN Gaming Zone\Windows\byjzbyjay.ayaj (41 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\ibyqyajqi.aqj (41 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\jyzbzbyqq.jby (41 bytes)
%WinDir%\ime\imkr6_1\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\jyzbzbyqq.jby (41 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\yrabrrara.rqq (41 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\qqjyzbzby.qqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\jyzbzbyqq.jby (41 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\ibyqyajqi.aqj (41 bytes)
%Program Files%\Outlook Express\yaibyqyaj.qiaqyaj.qia (41 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\jzbyjayay.ara (41 bytes)
%Program Files%\Outlook Express\qqjyzbzby.qqjqyaj.qia (41 bytes)
%Program Files%\Outlook Express\byqabijra.zyiqyaj.qia (41 bytes)
%Program Files%\Windows NT\Pinball\rabriazzz.ari.qqja (41 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\briazzzar.iby (41 bytes)
C:\totalcmd\jrrzqyjaa.ari (41 bytes)
%WinDir%\pchealth\helpctr\binaries\jzbyjayay.ara (41 bytes)
The process rqyrabrra.rar:584 makes changes in a file system.
The Virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\aaraaq.jyyz.ryz (41 bytes)
The process rqyrabrra.rar:1564 makes changes in a file system.
The Virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\zzqaja.rbjz.ryz (41 bytes)
Registry activity
The process 033d7f34df155c787f8d6268fa0fc64d.exe:1032 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"
The process rqyrabrra.rar:584 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8A 4E 20 AB 14 BF A6 16 0A C2 12 9C 48 01 EA D6"
The process rqyrabrra.rar:1564 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 95 01 A0 C8 F9 7A 7D D0 E9 0F D6 1A 4C 20 E1"
Network activity (URLs)
A bot communicates with command and control servers via IRC channel.
No activity has been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Worm that spreads its copies in attachments included in emails.
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
033d7f34df155c787f8d6268fa0fc64d.exe:1032
rqyrabrra.rar:584
rqyrabrra.rar:1564 - Delete the original Virus file.
- Delete or disinfect the following files created/modified by the Virus:
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\yrabrrara.rqq (41 bytes)
D:\rabriazzz.ari (41 bytes)
%WinDir%\ime\imjp8_1\jyzbzbyqq.jby (41 bytes)
%Program Files%\Windows Media Player\rizarrrzi.iir (41 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\jrrzqyjaa.ari (41 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rizarrrzi.iir (41 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\briazzzar.iby (41 bytes)
%Program Files%\MSN Gaming Zone\Windows\yaibyqyaj.qia (41 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rizarrrzi.iir (41 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rabriazzz.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\zarrrziii.rrq (41 bytes)
%Program Files%\Windows Media Player\rqyrabrra.rar (41 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\jyzbzbyqq.jby (41 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\qabijrazy.iya (41 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\jyzbzbyqq.jby (41 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jyzbzbyqq.jby (41 bytes)
C:\Perl\bin\byjzbyjay.aya (41 bytes)
%Program Files%\Wireshark\rizarrrzi.iir (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\qjjrrzqyj.aaaqyaj.qia (41 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\jzbyjayay.ara (41 bytes)
%WinDir%\$hf_mig$\KB898461\zarrrziii.rrq (41 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\yaibyqyaj.qia (41 bytes)
%Program Files%\Windows NT\Accessories\qqjyzbzby.qqja (41 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\jyzbzbyqq.jby (41 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\qabijrazy.iya (41 bytes)
%Program Files%\Windows NT\byjzbyjay.aya (41 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\qabijrazy.iya (41 bytes)
%WinDir%\$hf_mig$\KB898461\update\yrabrrara.rqq.qqja (41 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\jyzbzbyqq.jby (41 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\yrabrrara.rqq (41 bytes)
%Program Files%\NetMeeting\rizarrrzi.iiryaibyqyaj.qia (41 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\jyzbzbyqq.jby (41 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\qabijrazy.iya (41 bytes)
C:\Perl\bin\rabriazzz.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\jyzbzbyqq.jby (41 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\jyzbzbyqq.jby (41 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yaibyqyaj.qia (41 bytes)
%Program Files%\Wireshark\qqjyzbzby.qqj (41 bytes)
%WinDir%\Microsoft.NET\Framework\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\qabijrazy.iya (41 bytes)
%WinDir%\ime\imjp8_1\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\zarrrziii.rrq (41 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\briazzzar.iby (41 bytes)
%WinDir%\inf\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\ibyqyajqi.aqj (41 bytes)
%Program Files%\Wireshark\qjjrrzqyj.aaa (41 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\jzbyjayay.ara (41 bytes)
%WinDir%\ime\imjp8_1\qabijrazy.iya (41 bytes)
%Program Files%\Wireshark\ayzjiajiz.bqa (41 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\jyzbzbyqq.jby (41 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\qjjrrzqyj.aaa (41 bytes)
%Program Files%\Wireshark\jjjzzyjaz.ayb (41 bytes)
%Program Files%\Wireshark\rqyrabrra.rar (41 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\ibyqyajqi.aqj (41 bytes)
%Program Files%\MSN Gaming Zone\Windows\byqabijra.zyij (41 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\yrabrrara.rqq (41 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\jyzbzbyqq.jby (41 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\qjjrrzqyj.aaa (41 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\yrabrrara.rqq (41 bytes)
%WinDir%\pchealth\helpctr\binaries\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\zarrrziii.rrq (41 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\briazzzar.iby (41 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qabijrazy.iya (41 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byqabijra.zyi (41 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\jrrzqyjaa.ari (41 bytes)
C:\totalcmd\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\jyzbzbyqq.jby (41 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\jzbyjayay.ara (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\yaibyqyaj.qia (41 bytes)
%Program Files%\NetMeeting\rqyrabrra.raryaibyqyaj.qia (41 bytes)
%WinDir%\jrrzqyjaa.ari (41 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rqyrabrra.rar (41 bytes)
%WinDir%\ime\imjp8_1\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\jzbyjayay.ara (41 bytes)
C:\Perl\bin\qqjyzbzby.qqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\jyzbzbyqq.jby (41 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\jyzbzbyqq.jby (41 bytes)
%Program Files%\WinPcap\byqabijra.zyibriazzz.ari.qqja (41 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\jrrzqyjaa.ari (41 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\jzbyjayay.ara (41 bytes)
%WinDir%\xwrm.exe (41 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\zarrrziii.rrq (41 bytes)
%WinDir%\ime\imjp8_1\ibyqyajqi.aqj (41 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\qqjyzbzby.qqj (41 bytes)
%WinDir%\ime\imjp8_1\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\yrabrrara.rqq (41 bytes)
C:\totalcmd\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\jyzbzbyqq.jby (41 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byjzbyjay.aya (41 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\jzbyjayay.ara (41 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\yaibyqyaj.qiayj.aaaqyaj.qia (41 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\yrabrrara.rqq (41 bytes)
%Program Files%\Windows Media Player\qjjrrzqyj.aaaqia (41 bytes)
%Program Files%\Common Files\Adobe\Updater6\rabriazzz.ari (41 bytes)
%WinDir%\ime\imjp8_1\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\jrrzqyjaa.ari (41 bytes)
%Program Files%\Outlook Express\byjzbyjay.ayaqyaj.qia (41 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\jrrzqyjaa.ari (41 bytes)
%Program Files%\MSN Gaming Zone\Windows\rabriazzz.arij (41 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\jyzbzbyqq.jby (41 bytes)
%Program Files%\NetMeeting\qjjrrzqyj.aaayaibyqyaj.qia (41 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\zarrrziii.rrq (41 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\byqabijra.zyi (41 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\zarrrziii.rrq (41 bytes)
%WinDir%\Network Diagnostic\ibyqyajqi.aqj (41 bytes)
%Program Files%\MSN Gaming Zone\Windows\byjzbyjay.ayaj (41 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\ibyqyajqi.aqj (41 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\jyzbzbyqq.jby (41 bytes)
%WinDir%\ime\imkr6_1\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\jyzbzbyqq.jby (41 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\zarrrziii.rrq (41 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\yrabrrara.rqq (41 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\qqjyzbzby.qqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\jyzbzbyqq.jby (41 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\briazzzar.iby (41 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\qabijrazy.iya (41 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\yrabrrara.rqq (41 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\ibyqyajqi.aqj (41 bytes)
%Program Files%\Outlook Express\yaibyqyaj.qiaqyaj.qia (41 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\ibyqyajqi.aqj (41 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\jzbyjayay.ara (41 bytes)
%Program Files%\Outlook Express\qqjyzbzby.qqjqyaj.qia (41 bytes)
%Program Files%\Outlook Express\byqabijra.zyiqyaj.qia (41 bytes)
%Program Files%\Windows NT\Pinball\rabriazzz.ari.qqja (41 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\jzbyjayay.ara (41 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\briazzzar.iby (41 bytes)
C:\totalcmd\jrrzqyjaa.ari (41 bytes)
%WinDir%\pchealth\helpctr\binaries\jzbyjayay.ara (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aaraaq.jyyz.ryz (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zzqaja.rbjz.ryz (41 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
