Virus.Win32.Duel_46f1e2f068
HEUR:Trojan.Win32.Generic (Kaspersky), LooksLike.Win32.Malware!B (v) (VIPRE), Email-Worm.Win32.LoveLetter!IK (Emsisoft), Virus.Win32.Duel.FD, GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, Email-Worm, Virus, IRCBot
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
MD5: 46f1e2f06810fbe68fc3235d51dde412
SHA1: e7c7d0e2f855e1b094d04207621ec43e3d46d6f6
SHA256: 2addc1f0f96f356dba45abb3a8c03592e6b33765e9998dd5ffcc14afd27341e1
SSDeep: 768:sLMmc0nbJj7/zWfWWLjDqT6QMXjLKo87gjo2:sLMQ7/zKfj3/n67g
Size: 42496 bytes
File type: PE32
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2028-01-23 18:07:33
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Email-Worm. Worm that spreads its copies in attachments included in emails.
Virus. A program that recursively replicates a possibly evolved copy of itself.
IRCBot. A bot communicates with command and control servers via IRC channel.
Process activity
The Virus creates the following process(es):
46f1e2f06810fbe68fc3235d51dde412.exe:1648
rrziiirrq.yra:1804
rrziiirrq.yra:1668
The Virus injects its code into the following process(es):
File activity
The process 46f1e2f06810fbe68fc3235d51dde412.exe:1648 makes changes in a file system.
The Virus creates and/or writes to the following file(s):
%WinDir%\ime\imjp8_1\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\yjayayara.bri (42 bytes)
%WinDir%\pchealth\helpctr\binaries\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\azzzariby.qab (42 bytes)
%Program Files%\Windows Media Player\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\ijrazyiya.iby (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\brrararqq.jyz (42 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\ijrazyiya.iby (42 bytes)
%Program Files%\Outlook Express\azzzariby.qabyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\azzzariby.qab (42 bytes)
%WinDir%\pchealth\helpctr\binaries\ijrazyiya.iby (42 bytes)
%Program Files%\Windows NT\Accessories\brrararqq.jyzy (42 bytes)
C:\totalcmd\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\brrararqq.jyz (42 bytes)
%WinDir%\ime\imjp8_1\bzbyqqjby.jzb (42 bytes)
%Program Files%\Windows NT\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\zqyjaaari.zar (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\zqyjaaari.zar (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\ijrazyiya.iby (42 bytes)
%Program Files%\Wireshark\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\qyajqiaqj.jrr (42 bytes)
%Program Files%\Wireshark\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\yjayayara.bri (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\brrararqq.jyz (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\azzzariby.qabz (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\yjayayara.briz (42 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\rrziiirrq.yra (42 bytes)
C:\Perl\bin\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\azzzariby.qab (42 bytes)
%WinDir%\ime\imjp8_1\qyajqiaqj.jrr (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zqyjaaari.zar (42 bytes)
%WinDir%\$hf_mig$\KB898461\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\yjayayara.bri (42 bytes)
D:\yjayayara.bri (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\zqyjaaari.zar (42 bytes)
%Program Files%\Wireshark\bzbyqqjby.jzb (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\zqyjaaari.zar (42 bytes)
%Program Files%\Outlook Express\bzbyqqjby.jzbyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\brrararqq.jyz (42 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\ijrazyiya.iby (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\zqyjaaari.zar (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\bzbyqqjby.jzbz (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\qyajqiaqj.jrr (42 bytes)
%Program Files%\Wireshark\brrararqq.jyz (42 bytes)
C:\Perl\bin\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\zqyjaaari.zar (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\brrararqq.jyz (42 bytes)
C:\Perl\bin\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\rrziiirrq.yra (42 bytes)
%WinDir%\$hf_mig$\KB898461\update\qyajqiaqj.jrr.jyzy (42 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\zqyjaaari.zar (42 bytes)
%Program Files%\NetMeeting\rrziiirrq.yraijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\azzzariby.qab (42 bytes)
%WinDir%\ime\imjp8_1\ijrazyiya.iby (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\rrziiirrq.yra (42 bytes)
%Program Files%\Windows Media Player\qyajqiaqj.jrriby (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\bzbyqqjby.jzb (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\azzzariby.qab (42 bytes)
%WinDir%\ime\imjp8_1\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\brrararqq.jyz (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\zqyjaaari.zar (42 bytes)
%Program Files%\NetMeeting\zqyjaaari.zarijrazyiya.iby (42 bytes)
%WinDir%\ime\imkr6_1\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\azzzariby.qab (42 bytes)
%Program Files%\Outlook Express\ijrazyiya.ibyyiya.iby (42 bytes)
%Program Files%\Outlook Express\brrararqq.jyzyiya.iby (42 bytes)
%Program Files%\Windows Media Player\rrziiirrq.yra (42 bytes)
%Program Files%\Wireshark\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\rrziiirrq.yra (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\azzzariby.qab (42 bytes)
%WinDir%\xwrm.exe (42 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\zqyjaaari.zar (42 bytes)
C:\totalcmd\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\qyajqiaqj.jrr (42 bytes)
%Program Files%\WinPcap\azzzariby.qabayayara.bri.jyzy (42 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\qyajqiaqj.jrr (42 bytes)
%WinDir%\inf\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\yjayayara.bri (42 bytes)
%WinDir%\Microsoft.NET\Framework\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\azzzariby.qab (42 bytes)
%WinDir%\ime\imjp8_1\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\qyajqiaqj.jrr (42 bytes)
%Program Files%\NetMeeting\qyajqiaqj.jrrijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\yjayayara.bri (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\azzzariby.qab (42 bytes)
%Program Files%\Windows NT\Pinball\yjayayara.bri.jyzy (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\brrararqq.jyz (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\qyajqiaqj.jrryiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\zqyjaaari.zar (42 bytes)
C:\totalcmd\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\ijrazyiya.iby (42 bytes)
%Program Files%\Common Files\Adobe\Updater6\yjayayara.bri (42 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\ijrazyiya.ibyqj.jrryiya.iby (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\bzbyqqjby.jzb (42 bytes)
%WinDir%\Network Diagnostic\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\rrziiirrq.yra (42 bytes)
%WinDir%\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\azzzariby.qab (42 bytes)
%WinDir%\ime\imjp8_1\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\rrziiirrq.yra (42 bytes)
%Program Files%\Wireshark\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\bzbyqqjby.jzb (42 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\azzzariby.qab (42 bytes)
The process rrziiirrq.yra:1804 makes changes in a file system.
The Virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\zazyry.raja.qqj (42 bytes)
The process rrziiirrq.yra:1668 makes changes in a file system.
The Virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\irzyqj.ayba.qqj (42 bytes)
Registry activity
The process 46f1e2f06810fbe68fc3235d51dde412.exe:1648 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"
Network activity (URLs)
A bot communicates with command and control servers via IRC channel.
No activity has been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Worm that spreads its copies in attachments included in emails.
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
46f1e2f06810fbe68fc3235d51dde412.exe:1648
rrziiirrq.yra:1804
rrziiirrq.yra:1668 - Delete the original Virus file.
- Delete or disinfect the following files created/modified by the Virus:
%WinDir%\ime\imjp8_1\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\yjayayara.bri (42 bytes)
%WinDir%\pchealth\helpctr\binaries\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\azzzariby.qab (42 bytes)
%Program Files%\Windows Media Player\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\ijrazyiya.iby (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\brrararqq.jyz (42 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\ijrazyiya.iby (42 bytes)
%Program Files%\Outlook Express\azzzariby.qabyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\azzzariby.qab (42 bytes)
%WinDir%\pchealth\helpctr\binaries\ijrazyiya.iby (42 bytes)
%Program Files%\Windows NT\Accessories\brrararqq.jyzy (42 bytes)
C:\totalcmd\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\brrararqq.jyz (42 bytes)
%WinDir%\ime\imjp8_1\bzbyqqjby.jzb (42 bytes)
%Program Files%\Windows NT\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\zqyjaaari.zar (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\zqyjaaari.zar (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\ijrazyiya.iby (42 bytes)
%Program Files%\Wireshark\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\qyajqiaqj.jrr (42 bytes)
%Program Files%\Wireshark\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\yjayayara.bri (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\brrararqq.jyz (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\azzzariby.qabz (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\yjayayara.briz (42 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\rrziiirrq.yra (42 bytes)
C:\Perl\bin\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\azzzariby.qab (42 bytes)
%WinDir%\ime\imjp8_1\qyajqiaqj.jrr (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zqyjaaari.zar (42 bytes)
%WinDir%\$hf_mig$\KB898461\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\yjayayara.bri (42 bytes)
D:\yjayayara.bri (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\zqyjaaari.zar (42 bytes)
%Program Files%\Wireshark\bzbyqqjby.jzb (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\zqyjaaari.zar (42 bytes)
%Program Files%\Outlook Express\bzbyqqjby.jzbyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\brrararqq.jyz (42 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\ijrazyiya.iby (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\zqyjaaari.zar (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\bzbyqqjby.jzbz (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\qyajqiaqj.jrr (42 bytes)
%Program Files%\Wireshark\brrararqq.jyz (42 bytes)
C:\Perl\bin\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\zqyjaaari.zar (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\brrararqq.jyz (42 bytes)
C:\Perl\bin\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\rrziiirrq.yra (42 bytes)
%WinDir%\$hf_mig$\KB898461\update\qyajqiaqj.jrr.jyzy (42 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\zqyjaaari.zar (42 bytes)
%Program Files%\NetMeeting\rrziiirrq.yraijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\azzzariby.qab (42 bytes)
%WinDir%\ime\imjp8_1\ijrazyiya.iby (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\rrziiirrq.yra (42 bytes)
%Program Files%\Windows Media Player\qyajqiaqj.jrriby (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\bzbyqqjby.jzb (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\azzzariby.qab (42 bytes)
%WinDir%\ime\imjp8_1\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\brrararqq.jyz (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\zqyjaaari.zar (42 bytes)
%Program Files%\NetMeeting\zqyjaaari.zarijrazyiya.iby (42 bytes)
%WinDir%\ime\imkr6_1\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\azzzariby.qab (42 bytes)
%Program Files%\Outlook Express\ijrazyiya.ibyyiya.iby (42 bytes)
%Program Files%\Outlook Express\brrararqq.jyzyiya.iby (42 bytes)
%Program Files%\Windows Media Player\rrziiirrq.yra (42 bytes)
%Program Files%\Wireshark\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\rrziiirrq.yra (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\azzzariby.qab (42 bytes)
%WinDir%\xwrm.exe (42 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\zqyjaaari.zar (42 bytes)
C:\totalcmd\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\qyajqiaqj.jrr (42 bytes)
%Program Files%\WinPcap\azzzariby.qabayayara.bri.jyzy (42 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\qyajqiaqj.jrr (42 bytes)
%WinDir%\inf\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\yjayayara.bri (42 bytes)
%WinDir%\Microsoft.NET\Framework\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\azzzariby.qab (42 bytes)
%WinDir%\ime\imjp8_1\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\qyajqiaqj.jrr (42 bytes)
%Program Files%\NetMeeting\qyajqiaqj.jrrijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\yjayayara.bri (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\azzzariby.qab (42 bytes)
%Program Files%\Windows NT\Pinball\yjayayara.bri.jyzy (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\brrararqq.jyz (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\qyajqiaqj.jrryiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\zqyjaaari.zar (42 bytes)
C:\totalcmd\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\ijrazyiya.iby (42 bytes)
%Program Files%\Common Files\Adobe\Updater6\yjayayara.bri (42 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\ijrazyiya.ibyqj.jrryiya.iby (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\rrziiirrq.yra (42 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\zqyjaaari.zar (42 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\bzbyqqjby.jzb (42 bytes)
%WinDir%\Network Diagnostic\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\rrziiirrq.yra (42 bytes)
%WinDir%\azzzariby.qab (42 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\azzzariby.qab (42 bytes)
%WinDir%\ime\imjp8_1\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\qyajqiaqj.jrr (42 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\rrziiirrq.yra (42 bytes)
%Program Files%\Wireshark\yjayayara.bri (42 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\ijrazyiya.iby (42 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\bzbyqqjby.jzb (42 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\brrararqq.jyz (42 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\bzbyqqjby.jzb (42 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\azzzariby.qab (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zazyry.raja.qqj (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\irzyqj.ayba.qqj (42 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
