MD5: 06e74b2988e94e1ae1db882e632211b6
SHA1: 4c4eacf548fc6ed289299eae419d4927fd38e416
SHA256: ea9c3c22c267d56fb28a62b146aa676ccafc6be37d5c36ef8ccc027fdc3dceec
SSDeep: 384:bLCyvl87PQj2dEmoFLTm340U3JXaG0 9c6ULSe30c7ewkSW6FKEhK/V:qAwYydErFL13JXvzPq0c7tkepc/
Size: 42496 bytes
File type: PE32
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: no data

Summary:

Email-Worm. Worm that spreads its copies in attachments included in emails.
Virus. A program that recursively replicates a possibly evolved copy of itself.
IRCBot. A bot communicates with command and control servers via IRC channel.

Process activity

The Virus creates the following process(es):

rabrrarar.qqj:1068
rabrrarar.qqj:2028
06e74b2988e94e1ae1db882e632211b6.exe:596

File activity

The process rabrrarar.qqj:1068 makes changes in a file system.
The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jiajiz.bqay.bar (42 bytes)

The process rabrrarar.qqj:2028 makes changes in a file system.
The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\byaray.yiry.bar (42 bytes)

The process 06e74b2988e94e1ae1db882e632211b6.exe:596 makes changes in a file system.
The Virus creates and/or writes to the following file(s):

%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\byqyajqia.qjj (42 bytes)
%Program Files%\Outlook Express\byqyajqia.qjjjqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\abijrazyi.yai (42 bytes)
%WinDir%\ime\imkr6_1\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\yzbzbyqqj.byj (42 bytes)
%WinDir%\inf\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\arrrziiir.rqy (42 bytes)
%Program Files%\Windows NT\Pinball\riazzzari.byq.byjj (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\abijrazyi.yaij (42 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\rabrrarar.qqj (42 bytes)
%Program Files%\WinPcap\abijrazyi.yaiazzzari.byq.byjj (42 bytes)
%Program Files%\Wireshark\yzbzbyqqj.byj (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\riazzzari.byq (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbyjayaya.rab (42 bytes)
%WinDir%\ime\imjp8_1\byqyajqia.qjj (42 bytes)
D:\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\arrrziiir.rqy (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\abijrazyi.yai (42 bytes)
%Program Files%\Outlook Express\abijrazyi.yaijqia.qjj (42 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\rrzqyjaaa.riz (42 bytes)
C:\totalcmd\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\yzbzbyqqj.byj (42 bytes)
%Program Files%\Windows Media Player\rabrrarar.qqj (42 bytes)
%Program Files%\Wireshark\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\abijrazyi.yai (42 bytes)
%WinDir%\ime\imjp8_1\arrrziiir.rqy (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\zbyjayaya.rab (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\arrrziiir.rqy (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\arrrziiir.rqy (42 bytes)
%Program Files%\NetMeeting\rabrrarar.qqjbyqyajqia.qjj (42 bytes)
%WinDir%\pchealth\helpctr\binaries\rabrrarar.qqj (42 bytes)
C:\Perl\bin\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\zbyjayaya.rab (42 bytes)
%Program Files%\Common Files\Adobe\Updater6\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\rabrrarar.qqj (42 bytes)
C:\totalcmd\yzbzbyqqj.byj (42 bytes)
%Program Files%\Outlook Express\yzbzbyqqj.byjjqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\rrzqyjaaa.riz (42 bytes)
%WinDir%\pchealth\helpctr\binaries\byqyajqia.qjj (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\byqyajqia.qjj (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\riazzzari.byqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\yzbzbyqqj.byj (42 bytes)
C:\Perl\bin\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\zbyjayaya.rab (42 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\arrrziiir.rqy (42 bytes)
%Program Files%\Windows Media Player\rrzqyjaaa.rizqjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\rabrrarar.qqj (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jrrzii.irry.bar (42 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\abijrazyi.yai (42 bytes)
%WinDir%\$hf_mig$\KB898461\byqyajqia.qjj (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\byqyajqia.qjj (42 bytes)
C:\totalcmd\abijrazyi.yai (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\rrzqyjaaa.riz (42 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\rrzqyjaaa.riz (42 bytes)
%Program Files%\Wireshark\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\byqyajqia.qjj (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\zbyjayaya.rab (42 bytes)
%WinDir%\ime\imjp8_1\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\riazzzari.byq (42 bytes)
%WinDir%\xwrm.exe (42 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\riazzzari.byq (42 bytes)
%Program Files%\Wireshark\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\yzbzbyqqj.byj (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\rrzqyjaaa.riz (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\abijrazyi.yai (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\zbyjayaya.rab (42 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\arrrziiir.rqy (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\yzbzbyqqj.byj (42 bytes)
%Program Files%\Wireshark\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\abijrazyi.yai (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rrzqyjaaa.riz (42 bytes)
%WinDir%\Microsoft.NET\Framework\rabrrarar.qqj (42 bytes)
%WinDir%\ime\imjp8_1\rrzqyjaaa.riz (42 bytes)
%WinDir%\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\riazzzari.byq (42 bytes)
%Program Files%\NetMeeting\arrrziiir.rqybyqyajqia.qjj (42 bytes)
%Program Files%\Windows NT\zbyjayaya.rab (42 bytes)
%Program Files%\NetMeeting\rrzqyjaaa.rizbyqyajqia.qjj (42 bytes)
%WinDir%\$hf_mig$\KB898461\update\rrzqyjaaa.riz.byjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\zbyjayaya.rab (42 bytes)
%Program Files%\Windows NT\Accessories\yzbzbyqqj.byjj (42 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\byqyajqia.qjjaa.rizjqia.qjj (42 bytes)
%WinDir%\Network Diagnostic\riazzzari.byq (42 bytes)
%WinDir%\ime\imjp8_1\riazzzari.byq (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\rrzqyjaaa.rizjqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\abijrazyi.yai (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\rrzqyjaaa.riz (42 bytes)
%WinDir%\ime\imjp8_1\rabrrarar.qqj (42 bytes)
%WinDir%\ime\imjp8_1\zbyjayaya.rab (42 bytes)
C:\Perl\bin\zbyjayaya.rab (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\abijrazyi.yai (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\zbyjayaya.rab (42 bytes)
%Program Files%\Wireshark\riazzzari.byq (42 bytes)
%Program Files%\Windows Media Player\arrrziiir.rqy (42 bytes)
%Program Files%\Outlook Express\zbyjayaya.rabjqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\abijrazyi.yai (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\zbyjayaya.rabj (42 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\zbyjayaya.rab (42 bytes)

Registry activity

The process 06e74b2988e94e1ae1db882e632211b6.exe:596 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"

Network activity (URLs)

A bot communicates with command and control servers via IRC channel.

No activity has been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Worm that spreads its copies in attachments included in emails.

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   rabrrarar.qqj:1068
   rabrrarar.qqj:2028
   06e74b2988e94e1ae1db882e632211b6.exe:596

2. Delete the original Virus file.
   
3. Delete or disinfect the following files created/modified by the Virus:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\jiajiz.bqay.bar (42 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\byaray.yiry.bar (42 bytes)
   %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\arrrziiir.rqy (42 bytes)
   %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\arrrziiir.rqy (42 bytes)
   %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\rrzqyjaaa.riz (42 bytes)
   %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\rabrrarar.qqj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\riazzzari.byq (42 bytes)
   %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\byqyajqia.qjj (42 bytes)
   %Program Files%\Outlook Express\byqyajqia.qjjjqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\byqyajqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\yzbzbyqqj.byj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\yzbzbyqqj.byj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\rrzqyjaaa.riz (42 bytes)
   %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\abijrazyi.yai (42 bytes)
   %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\byqyajqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\arrrziiir.rqy (42 bytes)
   %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\arrrziiir.rqy (42 bytes)
   %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\abijrazyi.yai (42 bytes)
   %WinDir%\ime\imkr6_1\yzbzbyqqj.byj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\abijrazyi.yai (42 bytes)
   %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\yzbzbyqqj.byj (42 bytes)
   %WinDir%\inf\riazzzari.byq (42 bytes)
   %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\rabrrarar.qqj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\arrrziiir.rqy (42 bytes)
   %Program Files%\Windows NT\Pinball\riazzzari.byq.byjj (42 bytes)
   %Program Files%\MSN Gaming Zone\Windows\abijrazyi.yaij (42 bytes)
   %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\rabrrarar.qqj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\rrzqyjaaa.riz (42 bytes)
   %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\rabrrarar.qqj (42 bytes)
   %Program Files%\WinPcap\abijrazyi.yaiazzzari.byq.byjj (42 bytes)
   %Program Files%\Wireshark\yzbzbyqqj.byj (42 bytes)
   %Program Files%\Adobe\Reader 9.0\Reader\yzbzbyqqj.byj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\riazzzari.byq (42 bytes)
   %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\riazzzari.byq (42 bytes)
   %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\riazzzari.byq (42 bytes)
   %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbyjayaya.rab (42 bytes)
   %WinDir%\ime\imjp8_1\byqyajqia.qjj (42 bytes)
   D:\riazzzari.byq (42 bytes)
   %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\zbyjayaya.rab (42 bytes)
   %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\rabrrarar.qqj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\arrrziiir.rqy (42 bytes)
   %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\arrrziiir.rqy (42 bytes)
   %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrzqyjaaa.riz (42 bytes)
   %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\abijrazyi.yai (42 bytes)
   %Program Files%\Outlook Express\abijrazyi.yaijqia.qjj (42 bytes)
   %Program Files%\Common Files\Microsoft Shared\MSInfo\rrzqyjaaa.riz (42 bytes)
   %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\rrzqyjaaa.riz (42 bytes)
   C:\totalcmd\rabrrarar.qqj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\yzbzbyqqj.byj (42 bytes)
   %Program Files%\Windows Media Player\rabrrarar.qqj (42 bytes)
   %Program Files%\Wireshark\arrrziiir.rqy (42 bytes)
   %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\riazzzari.byq (42 bytes)
   %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\byqyajqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\yzbzbyqqj.byj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\byqyajqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\zbyjayaya.rab (42 bytes)
   %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\byqyajqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\riazzzari.byq (42 bytes)
   %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\abijrazyi.yai (42 bytes)
   %WinDir%\ime\imjp8_1\arrrziiir.rqy (42 bytes)
   %Program Files%\Adobe\Reader 9.0\Reader\riazzzari.byq (42 bytes)
   %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\zbyjayaya.rab (42 bytes)
   %Program Files%\MSN Gaming Zone\Windows\byqyajqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\arrrziiir.rqy (42 bytes)
   %Program Files%\Common Files\Adobe\ARM\1.0\arrrziiir.rqy (42 bytes)
   %Program Files%\NetMeeting\rabrrarar.qqjbyqyajqia.qjj (42 bytes)
   %WinDir%\pchealth\helpctr\binaries\rabrrarar.qqj (42 bytes)
   C:\Perl\bin\riazzzari.byq (42 bytes)
   %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\rabrrarar.qqj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\zbyjayaya.rab (42 bytes)
   %Program Files%\Common Files\Adobe\Updater6\riazzzari.byq (42 bytes)
   %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\rabrrarar.qqj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\rabrrarar.qqj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\rrzqyjaaa.riz (42 bytes)
   %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\rrzqyjaaa.riz (42 bytes)
   %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\rabrrarar.qqj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\zbyjayaya.rab (42 bytes)
   %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\rabrrarar.qqj (42 bytes)
   C:\totalcmd\yzbzbyqqj.byj (42 bytes)
   %Program Files%\Outlook Express\yzbzbyqqj.byjjqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\rabrrarar.qqj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\rrzqyjaaa.riz (42 bytes)
   %WinDir%\pchealth\helpctr\binaries\byqyajqia.qjj (42 bytes)
   %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yzbzbyqqj.byj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\byqyajqia.qjj (42 bytes)
   %Program Files%\MSN Gaming Zone\Windows\riazzzari.byqj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\yzbzbyqqj.byj (42 bytes)
   C:\Perl\bin\yzbzbyqqj.byj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\zbyjayaya.rab (42 bytes)
   %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\abijrazyi.yai (42 bytes)
   %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\arrrziiir.rqy (42 bytes)
   %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\rabrrarar.qqj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\riazzzari.byq (42 bytes)
   %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\rrzqyjaaa.riz (42 bytes)
   %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\zbyjayaya.rab (42 bytes)
   %WinDir%\$NtUninstallKB898461$\spuninst\arrrziiir.rqy (42 bytes)
   %Program Files%\Windows Media Player\rrzqyjaaa.rizqjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\rabrrarar.qqj (42 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\jrrzii.irry.bar (42 bytes)
   %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\abijrazyi.yai (42 bytes)
   %WinDir%\$hf_mig$\KB898461\byqyajqia.qjj (42 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\byqyajqia.qjj (42 bytes)
   C:\totalcmd\abijrazyi.yai (42 bytes)
   %Program Files%\Adobe\Reader 9.0\Reader\byqyajqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\arrrziiir.rqy (42 bytes)
   %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\abijrazyi.yai (42 bytes)
   %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\riazzzari.byq (42 bytes)
   %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\rrzqyjaaa.riz (42 bytes)
   %Program Files%\Common Files\Microsoft Shared\DW\abijrazyi.yai (42 bytes)
   %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\riazzzari.byq (42 bytes)
   %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\byqyajqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\abijrazyi.yai (42 bytes)
   %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\zbyjayaya.rab (42 bytes)
   %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\byqyajqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\byqyajqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\rrzqyjaaa.riz (42 bytes)
   %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\rrzqyjaaa.riz (42 bytes)
   %Program Files%\Wireshark\rabrrarar.qqj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\arrrziiir.rqy (42 bytes)
   %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\abijrazyi.yai (42 bytes)
   %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\byqyajqia.qjj (42 bytes)
   %Program Files%\Adobe\Reader 9.0\Reader\zbyjayaya.rab (42 bytes)
   %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\rrzqyjaaa.riz (42 bytes)
   %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\rrzqyjaaa.riz (42 bytes)
   %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\zbyjayaya.rab (42 bytes)
   %WinDir%\ime\imjp8_1\abijrazyi.yai (42 bytes)
   %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\riazzzari.byq (42 bytes)
   %WinDir%\xwrm.exe (42 bytes)
   %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\yzbzbyqqj.byj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\arrrziiir.rqy (42 bytes)
   %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\yzbzbyqqj.byj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\yzbzbyqqj.byj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\yzbzbyqqj.byj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\riazzzari.byq (42 bytes)
   %Program Files%\Wireshark\rrzqyjaaa.riz (42 bytes)
   %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\riazzzari.byq (42 bytes)
   %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\byqyajqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\yzbzbyqqj.byj (42 bytes)
   %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abijrazyi.yai (42 bytes)
   %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\yzbzbyqqj.byj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\rrzqyjaaa.riz (42 bytes)
   %Program Files%\Adobe\Reader 9.0\Reader\abijrazyi.yai (42 bytes)
   %Program Files%\Common Files\Adobe\ARM\1.0\rabrrarar.qqj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\zbyjayaya.rab (42 bytes)
   %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\zbyjayaya.rab (42 bytes)
   %Program Files%\Common Files\Microsoft Shared\DW\byqyajqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\rrzqyjaaa.riz (42 bytes)
   %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\riazzzari.byq (42 bytes)
   %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\arrrziiir.rqy (42 bytes)
   %Program Files%\Common Files\Adobe\ARM\1.0\yzbzbyqqj.byj (42 bytes)
   %Program Files%\Wireshark\zbyjayaya.rab (42 bytes)
   %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\yzbzbyqqj.byj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\byqyajqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\arrrziiir.rqy (42 bytes)
   %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\byqyajqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\zbyjayaya.rab (42 bytes)
   %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\zbyjayaya.rab (42 bytes)
   %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\abijrazyi.yai (42 bytes)
   %Program Files%\Common Files\Adobe\ARM\1.0\rrzqyjaaa.riz (42 bytes)
   %WinDir%\Microsoft.NET\Framework\rabrrarar.qqj (42 bytes)
   %WinDir%\ime\imjp8_1\rrzqyjaaa.riz (42 bytes)
   %WinDir%\abijrazyi.yai (42 bytes)
   %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\yzbzbyqqj.byj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\riazzzari.byq (42 bytes)
   %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\rabrrarar.qqj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\yzbzbyqqj.byj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\byqyajqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\byqyajqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\yzbzbyqqj.byj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\riazzzari.byq (42 bytes)
   %Program Files%\NetMeeting\arrrziiir.rqybyqyajqia.qjj (42 bytes)
   %Program Files%\Windows NT\zbyjayaya.rab (42 bytes)
   %Program Files%\NetMeeting\rrzqyjaaa.rizbyqyajqia.qjj (42 bytes)
   %WinDir%\$hf_mig$\KB898461\update\rrzqyjaaa.riz.byjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\rabrrarar.qqj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\zbyjayaya.rab (42 bytes)
   %Program Files%\Windows NT\Accessories\yzbzbyqqj.byjj (42 bytes)
   %Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\byqyajqia.qjjaa.rizjqia.qjj (42 bytes)
   %WinDir%\Network Diagnostic\riazzzari.byq (42 bytes)
   %WinDir%\ime\imjp8_1\riazzzari.byq (42 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\rrzqyjaaa.rizjqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\abijrazyi.yai (42 bytes)
   %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\riazzzari.byq (42 bytes)
   %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\arrrziiir.rqy (42 bytes)
   %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\rrzqyjaaa.riz (42 bytes)
   %WinDir%\ime\imjp8_1\rabrrarar.qqj (42 bytes)
   %WinDir%\ime\imjp8_1\zbyjayaya.rab (42 bytes)
   C:\Perl\bin\zbyjayaya.rab (42 bytes)
   %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\arrrziiir.rqy (42 bytes)
   %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\abijrazyi.yai (42 bytes)
   %Program Files%\Adobe\Reader 9.0\Reader\arrrziiir.rqy (42 bytes)
   %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\zbyjayaya.rab (42 bytes)
   %Program Files%\Wireshark\riazzzari.byq (42 bytes)
   %Program Files%\Windows Media Player\arrrziiir.rqy (42 bytes)
   %Program Files%\Outlook Express\zbyjayaya.rabjqia.qjj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\abijrazyi.yai (42 bytes)
   %Program Files%\MSN Gaming Zone\Windows\zbyjayaya.rabj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\abijrazyi.yai (42 bytes)
   %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\rabrrarar.qqj (42 bytes)
   %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\arrrziiir.rqy (42 bytes)
   %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\zbyjayaya.rab (42 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "x32x" = "%WinDir%\xwrm.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.