Virus.Win32.Duel_8e7cb391e5
Susp_Dropper (Kaspersky), LooksLike.Win32.Malware!B (v) (VIPRE), Email-Worm.Win32.Brontok!IK (Emsisoft), Virus.Win32.Duel.FD, GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)
Behaviour: Worm, Email-Worm, EmailWorm, Virus, IRCBot
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
MD5: 8e7cb391e56c4ec0b5fd295f61377d43
SHA1: 908faf4ddc39e9d89c14b3b46c48da5f39bc12df
SHA256: 0ac071cdfe1f4fa05bf697ed3b38e4ecdeba50638bff82509ea40b43779bfeaa
SSDeep: 768:u3wiXjSqovmjUyB8dxoHUAQ0AowPHiMCsx2:owiXjSv1xyQtowPHiM
Size: 42496 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: no data
Summary:
Virus. A program that recursively replicates a possibly evolved copy of itself.
Payload
| Behaviour | Description |
|---|---|
| EmailWorm | Worm can send e-mails. |
| IRCBot | A bot can communicate with command and control servers via IRC channel. |
Process activity
The Virus creates the following process(es):
8e7cb391e56c4ec0b5fd295f61377d43.exe:1784
aibyqyajq.iaq:1904
aibyqyajq.iaq:1672
File activity
The process 8e7cb391e56c4ec0b5fd295f61377d43.exe:1784 makes changes in a file system.
The Virus creates and/or writes to the following file(s):
C:\Perl\bin\jjrrzqyja.aar (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yjzbyjaya.yar (42 bytes)
C:\totalcmd\qyrabrrar.arq (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\izarrrzii.irrr (42 bytes)
%Program Files%\Common Files\Adobe\Updater6\qyrabrrar.arq (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abriazzza.rib (42 bytes)
%Program Files%\WinPcap\abriazzza.ribzbyjaya.yar.arq (42 bytes)
%Program Files%\Wireshark\jjrrzqyja.aar (42 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\abriazzza.rib (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\aibyqyajq.iaq (42 bytes)
%Program Files%\Opera\jjrrzqyja.aarq.iaqyjzbyjaya.yar (42 bytes)
%WinDir%\ime\imjp8_1\yjzbyjaya.yar (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\aibyqyajq.iaq (42 bytes)
%Program Files%\Outlook Express\qjyzbzbyq.qjb.irr (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\qyrabrrar.arq (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\jjrrzqyja.aar (42 bytes)
C:\totalcmd\izarrrzii.irr (42 bytes)
%Program Files%\Opera\updatechecker\izarrrzii.irr (42 bytes)
%WinDir%\qjyzbzbyq.qjb (42 bytes)
%Program Files%\Windows NT\Accessories\qyrabrrar.arq (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\abriazzza.ribjaya.yar (42 bytes)
%WinDir%\Microsoft.NET\Framework\yqabijraz.yiy (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\jjrrzqyja.aar (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yqabijraz.yiy (42 bytes)
%Program Files%\NetMeeting\yqabijraz.yiyyjzbyjaya.yar (42 bytes)
%Program Files%\Windows NT\Pinball\yjzbyjaya.yar.arq (42 bytes)
%Program Files%\Wireshark\izarrrzii.irr (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\qyrabrrar.arqr (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\qjyzbzbyq.qjb (42 bytes)
%WinDir%\Network Diagnostic\izarrrzii.irr (42 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\yjzbyjaya.yarza.ribjaya.yar (42 bytes)
%Program Files%\Windows Media Player\aibyqyajq.iaq (42 bytes)
%Program Files%\Outlook Express\qyrabrrar.arq.irr (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\yjzbyjaya.yar (42 bytes)
%WinDir%\pchealth\helpctr\binaries\yqabijraz.yiy (42 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\qjyzbzbyq.qjb (42 bytes)
C:\totalcmd\abriazzza.rib (42 bytes)
%WinDir%\ime\imjp8_1\qyrabrrar.arq (42 bytes)
%Program Files%\Wireshark\aibyqyajq.iaq (42 bytes)
%Program Files%\Outlook Express\abriazzza.rib.irr (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qyrabrrar.arq (42 bytes)
%WinDir%\ime\imjp8_1\abriazzza.rib (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\izarrrzii.irr (42 bytes)
%WinDir%\ime\imjp8_1\yqabijraz.yiy (42 bytes)
%WinDir%\xwrm.exe (42 bytes)
%WinDir%\pchealth\helpctr\binaries\qjyzbzbyq.qjb (42 bytes)
%Program Files%\NetMeeting\aibyqyajq.iaqyjzbyjaya.yar (42 bytes)
C:\Perl\bin\qyrabrrar.arq (42 bytes)
%WinDir%\ime\imjp8_1\jjrrzqyja.aar (42 bytes)
D:\qyrabrrar.arq (42 bytes)
%WinDir%\ime\imjp8_1\izarrrzii.irr (42 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\yjzbyjaya.yar (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\qjyzbzbyq.qjbr (42 bytes)
C:\Perl\bin\izarrrzii.irr (42 bytes)
%Program Files%\Wireshark\qyrabrrar.arq (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jjrrzqyja.aar (42 bytes)
%Program Files%\Wireshark\qjyzbzbyq.qjb (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yjzbyjaya.yar (42 bytes)
%Program Files%\Windows Media Player\izarrrzii.irr (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\yjzbyjaya.yar (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\abriazzza.rib (42 bytes)
%WinDir%\ime\imjp8_1\qjyzbzbyq.qjb (42 bytes)
%Program Files%\Wireshark\yjzbyjaya.yar (42 bytes)
%WinDir%\inf\izarrrzii.irr (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\izarrrzii.irr (42 bytes)
%WinDir%\ime\imkr6_1\aibyqyajq.iaq (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\yqabijraz.yiy (42 bytes)
%Program Files%\Windows Media Player\jjrrzqyja.aar (42 bytes)
%Program Files%\Windows NT\qjyzbzbyq.qjb (42 bytes)
%Program Files%\Outlook Express\yqabijraz.yiy.irr (42 bytes)
%Program Files%\NetMeeting\abriazzza.ribyjzbyjaya.yar (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zaajjz.iazz.yyr (42 bytes)
The process aibyqyajq.iaq:1904 makes changes in a file system.
The Virus creates and/or writes to the following file(s):
%Program Files%\Windows Media Player\rrzqyjaaa.rizqjj (42 bytes)
%Program Files%\Windows Media Player\rabrrarar.qqj (42 bytes)
%Program Files%\Outlook Express\byqyajqia.qjjjqia.qjj (42 bytes)
%WinDir%\ime\imjp8_1\zbyjayaya.rab (42 bytes)
%WinDir%\riazzzari.byq.rab (42 bytes)
%WinDir%\ime\imjp8_1\arrrziiir.rqy (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\byqyajqia.qjj (42 bytes)
%WinDir%\ime\imjp8_1\rrzqyjaaa.riz (42 bytes)
%Program Files%\NetMeeting\rabrrarar.qqjbyqyajqia.qjj (42 bytes)
%WinDir%\ime\imjp8_1\yzbzbyqqj.byj (42 bytes)
%Program Files%\NetMeeting\arrrziiir.rqybyqyajqia.qjj (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\abijrazyi.yaij (42 bytes)
%Program Files%\NetMeeting\rrzqyjaaa.rizbyqyajqia.qjj (42 bytes)
%WinDir%\ime\imkr6_1\riazzzari.byq (42 bytes)
%Program Files%\Windows NT\Accessories\yzbzbyqqj.byjj (42 bytes)
%WinDir%\ime\imjp8_1\abijrazyi.yai (42 bytes)
%WinDir%\pchealth\helpctr\binaries\arrrziiir.rqy (42 bytes)
%WinDir%\abijrazyi.yai (42 bytes)
%WinDir%\ime\imjp8_1\rabrrarar.qqj (42 bytes)
%Program Files%\Outlook Express\yzbzbyqqj.byjjqia.qjj (42 bytes)
%WinDir%\ime\imjp8_1\byqyajqia.qjj (42 bytes)
%Program Files%\Outlook Express\zbyjayaya.rabjqia.qjj (42 bytes)
%WinDir%\inf\byqyajqia.qjj (42 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\arrrziiir.rqy (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\riazzzari.byqj (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ijajia.azqz.yyr (42 bytes)
%Program Files%\Windows Media Player\arrrziiir.rqy (42 bytes)
%Program Files%\Outlook Express\abijrazyi.yaijqia.qjj (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\zbyjayaya.rabj (42 bytes)
%Program Files%\Wireshark\abijrazyi.yaiayaya.rab.byjj (42 bytes)
%Program Files%\Windows NT\Pinball\zbyjayaya.rab.byjj (42 bytes)
The process aibyqyajq.iaq:1672 makes changes in a file system.
The Virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\bryzyj.rrqz.yyr (42 bytes)
Registry activity
The process 8e7cb391e56c4ec0b5fd295f61377d43.exe:1784 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"
The process aibyqyajq.iaq:1904 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"
Network activity (URLs)
No activity has been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
8e7cb391e56c4ec0b5fd295f61377d43.exe:1784
aibyqyajq.iaq:1904
aibyqyajq.iaq:1672 - Delete the original Virus file.
- Delete or disinfect the following files created/modified by the Virus:
C:\Perl\bin\jjrrzqyja.aar (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yjzbyjaya.yar (42 bytes)
C:\totalcmd\qyrabrrar.arq (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\izarrrzii.irrr (42 bytes)
%Program Files%\Common Files\Adobe\Updater6\qyrabrrar.arq (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abriazzza.rib (42 bytes)
%Program Files%\WinPcap\abriazzza.ribzbyjaya.yar.arq (42 bytes)
%Program Files%\Wireshark\jjrrzqyja.aar (42 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\abriazzza.rib (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\aibyqyajq.iaq (42 bytes)
%Program Files%\Opera\jjrrzqyja.aarq.iaqyjzbyjaya.yar (42 bytes)
%WinDir%\ime\imjp8_1\yjzbyjaya.yar (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\aibyqyajq.iaq (42 bytes)
%Program Files%\Outlook Express\qjyzbzbyq.qjb.irr (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\qyrabrrar.arq (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\jjrrzqyja.aar (42 bytes)
C:\totalcmd\izarrrzii.irr (42 bytes)
%Program Files%\Opera\updatechecker\izarrrzii.irr (42 bytes)
%WinDir%\qjyzbzbyq.qjb (42 bytes)
%Program Files%\Windows NT\Accessories\qyrabrrar.arq (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\abriazzza.ribjaya.yar (42 bytes)
%WinDir%\Microsoft.NET\Framework\yqabijraz.yiy (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\jjrrzqyja.aar (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yqabijraz.yiy (42 bytes)
%Program Files%\NetMeeting\yqabijraz.yiyyjzbyjaya.yar (42 bytes)
%Program Files%\Windows NT\Pinball\yjzbyjaya.yar.arq (42 bytes)
%Program Files%\Wireshark\izarrrzii.irr (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\qyrabrrar.arqr (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\qjyzbzbyq.qjb (42 bytes)
%WinDir%\Network Diagnostic\izarrrzii.irr (42 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\yjzbyjaya.yarza.ribjaya.yar (42 bytes)
%Program Files%\Windows Media Player\aibyqyajq.iaq (42 bytes)
%Program Files%\Outlook Express\qyrabrrar.arq.irr (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\yjzbyjaya.yar (42 bytes)
%WinDir%\pchealth\helpctr\binaries\yqabijraz.yiy (42 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\qjyzbzbyq.qjb (42 bytes)
C:\totalcmd\abriazzza.rib (42 bytes)
%WinDir%\ime\imjp8_1\qyrabrrar.arq (42 bytes)
%Program Files%\Wireshark\aibyqyajq.iaq (42 bytes)
%Program Files%\Outlook Express\abriazzza.rib.irr (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qyrabrrar.arq (42 bytes)
%WinDir%\ime\imjp8_1\abriazzza.rib (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\izarrrzii.irr (42 bytes)
%WinDir%\ime\imjp8_1\yqabijraz.yiy (42 bytes)
%WinDir%\xwrm.exe (42 bytes)
%WinDir%\pchealth\helpctr\binaries\qjyzbzbyq.qjb (42 bytes)
%Program Files%\NetMeeting\aibyqyajq.iaqyjzbyjaya.yar (42 bytes)
C:\Perl\bin\qyrabrrar.arq (42 bytes)
%WinDir%\ime\imjp8_1\jjrrzqyja.aar (42 bytes)
D:\qyrabrrar.arq (42 bytes)
%WinDir%\ime\imjp8_1\izarrrzii.irr (42 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\yjzbyjaya.yar (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\qjyzbzbyq.qjbr (42 bytes)
C:\Perl\bin\izarrrzii.irr (42 bytes)
%Program Files%\Wireshark\qyrabrrar.arq (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jjrrzqyja.aar (42 bytes)
%Program Files%\Wireshark\qjyzbzbyq.qjb (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yjzbyjaya.yar (42 bytes)
%Program Files%\Windows Media Player\izarrrzii.irr (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\yjzbyjaya.yar (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\abriazzza.rib (42 bytes)
%WinDir%\ime\imjp8_1\qjyzbzbyq.qjb (42 bytes)
%Program Files%\Wireshark\yjzbyjaya.yar (42 bytes)
%WinDir%\inf\izarrrzii.irr (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\izarrrzii.irr (42 bytes)
%WinDir%\ime\imkr6_1\aibyqyajq.iaq (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\yqabijraz.yiy (42 bytes)
%Program Files%\Windows Media Player\jjrrzqyja.aar (42 bytes)
%Program Files%\Windows NT\qjyzbzbyq.qjb (42 bytes)
%Program Files%\Outlook Express\yqabijraz.yiy.irr (42 bytes)
%Program Files%\NetMeeting\abriazzza.ribyjzbyjaya.yar (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zaajjz.iazz.yyr (42 bytes)
%Program Files%\Windows Media Player\rrzqyjaaa.rizqjj (42 bytes)
%Program Files%\Windows Media Player\rabrrarar.qqj (42 bytes)
%Program Files%\Outlook Express\byqyajqia.qjjjqia.qjj (42 bytes)
%WinDir%\ime\imjp8_1\zbyjayaya.rab (42 bytes)
%WinDir%\riazzzari.byq.rab (42 bytes)
%WinDir%\ime\imjp8_1\arrrziiir.rqy (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\byqyajqia.qjj (42 bytes)
%WinDir%\ime\imjp8_1\rrzqyjaaa.riz (42 bytes)
%Program Files%\NetMeeting\rabrrarar.qqjbyqyajqia.qjj (42 bytes)
%WinDir%\ime\imjp8_1\yzbzbyqqj.byj (42 bytes)
%Program Files%\NetMeeting\arrrziiir.rqybyqyajqia.qjj (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\abijrazyi.yaij (42 bytes)
%Program Files%\NetMeeting\rrzqyjaaa.rizbyqyajqia.qjj (42 bytes)
%WinDir%\ime\imkr6_1\riazzzari.byq (42 bytes)
%Program Files%\Windows NT\Accessories\yzbzbyqqj.byjj (42 bytes)
%WinDir%\ime\imjp8_1\abijrazyi.yai (42 bytes)
%WinDir%\pchealth\helpctr\binaries\arrrziiir.rqy (42 bytes)
%WinDir%\abijrazyi.yai (42 bytes)
%WinDir%\ime\imjp8_1\rabrrarar.qqj (42 bytes)
%Program Files%\Outlook Express\yzbzbyqqj.byjjqia.qjj (42 bytes)
%WinDir%\ime\imjp8_1\byqyajqia.qjj (42 bytes)
%Program Files%\Outlook Express\zbyjayaya.rabjqia.qjj (42 bytes)
%WinDir%\inf\byqyajqia.qjj (42 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\arrrziiir.rqy (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\riazzzari.byqj (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ijajia.azqz.yyr (42 bytes)
%Program Files%\Windows Media Player\arrrziiir.rqy (42 bytes)
%Program Files%\Outlook Express\abijrazyi.yaijqia.qjj (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\zbyjayaya.rabj (42 bytes)
%Program Files%\Wireshark\abijrazyi.yaiayaya.rab.byjj (42 bytes)
%Program Files%\Windows NT\Pinball\zbyjayaya.rab.byjj (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bryzyj.rrqz.yyr (42 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
