Virus.Win32.Duel_ebdfb4e25b

by malwarelabrobot on July 4th, 2013 in Malware Descriptions.

Trojan.Win32.Agent.xpyg (Kaspersky), LooksLike.Win32.Malware!B (v) (VIPRE), Virus.Win32.Heur!IK (Emsisoft), Virus.Win32.Duel.FD, GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, Email-Worm, Virus, IRCBot


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary
Technical Details
Removal Recommendations

MD5: ebdfb4e25bcf611674f5df26dcab4e10
SHA1: 2594a7f7bd581f40f0a3cd5524d458205bc7b305
SHA256: 7507bd188f6f41676aed0c90fca70ac2ccfba0f083cb17575b1e7e8c331ed5f6
SSDeep: 384:lXm5m6l8J1gBkd1pbpNwSzox2X5wvq4WTy3Fo7mIYQVDD0os7pWU92 Ldk:cmiaWBA1Vqu5oTWTYFoaJQ10bF9X2
Size: 43520 bytes
File type: PE32
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: Ydtnkgx
Created at: 2037-01-18 04:57:12


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Email-Worm. Worm that spreads its copies in attachments included in emails.
Virus. A program that recursively replicates a possibly evolved copy of itself.
IRCBot. A bot communicates with command and control servers via IRC channel.

Process activity

The Virus creates the following process(es):

ebdfb4e25bcf611674f5df26dcab4e10.exe:1316
jrrzqyjaa.ari:1652
jrrzqyjaa.ari:188

The Virus injects its code into the following process(es):

File activity

The process ebdfb4e25bcf611674f5df26dcab4e10.exe:1316 makes changes in a file system.
The Virus creates and/or writes to the following file(s):

%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\jrrzqyjaa.ari (43 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\briazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\qabijrazy.iya (43 bytes)
%WinDir%\ime\imjp8_1\jyzbzbyqq.jby (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\jyzbzbyqq.jby (43 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\yrabrrara.rqq (43 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\qabijrazy.iya (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\ibyqyajqi.aqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\jyzbzbyqq.jby (43 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\jzbyjayay.ara (43 bytes)
%Program Files%\NetMeeting\ibyqyajqi.aqjbriazzzar.iby (43 bytes)
%WinDir%\inf\jyzbzbyqq.jby (43 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\jrrzqyjaa.ari (43 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\yrabrrara.rqq (43 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\ibyqyajqi.aqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\zarrrziii.rrq (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\ibyqyajqi.aqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\jrrzqyjaa.ari (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jyzbzbyqq.jby (43 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\briazzzar.iby (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\briazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\ibyqyajqi.aqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\jrrzqyjaa.ari (43 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\ibyqyajqi.aqj (43 bytes)
%Program Files%\Wireshark\yrabrrara.rqq (43 bytes)
%Program Files%\WinPcap\jzbyjayay.arazbzbyqq.jby.rrqy (43 bytes)
%Program Files%\Outlook Express\yrabrrara.rqqzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\jrrzqyjaa.ari (43 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\briazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\ibyqyajqi.aqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\zarrrziii.rrq (43 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\yrabrrara.rqq (43 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\jzbyjayay.ara (43 bytes)
%WinDir%\ime\imjp8_1\briazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\yrabrrara.rqq (43 bytes)
%Program Files%\Outlook Express\jzbyjayay.arazzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\zarrrziii.rrq (43 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\qabijrazy.iya (43 bytes)
%Program Files%\Wireshark\jrrzqyjaa.ari (43 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\zarrrziii.rrq (43 bytes)
%WinDir%\ime\imkr6_1\zarrrziii.rrq (43 bytes)
%WinDir%\$hf_mig$\KB898461\briazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\zarrrziii.rrq (43 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\briazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\zarrrziii.rrq (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\qabijrazy.iya (43 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\jzbyjayay.ara (43 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\zarrrziii.rrq (43 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\jzbyjayay.ara (43 bytes)
%Program Files%\Windows Media Player\ibyqyajqi.aqj (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jzbyjayay.ara (43 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\briazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\briazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\jyzbzbyqq.jby (43 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\briazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\qabijrazy.iya (43 bytes)
%Program Files%\Windows NT\Pinball\jyzbzbyqq.jby.rrqy (43 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\jyzbzbyqq.jby (43 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\jyzbzbyqq.jby (43 bytes)
%WinDir%\ime\imjp8_1\jzbyjayay.ara (43 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\jzbyjayay.ara (43 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\qabijrazy.iya (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\zarrrziii.rrq (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yrabrrara.rqq (43 bytes)
D:\jyzbzbyqq.jby (43 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\yrabrrara.rqq (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\jzbyjayay.ara (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yrabrrara.rqq (43 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\jyzbzbyqq.jby (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\jyzbzbyqq.jby (43 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\zarrrziii.rrq (43 bytes)
C:\totalcmd\zarrrziii.rrq (43 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\jzbyjayay.ara (43 bytes)
%Program Files%\Wireshark\ibyqyajqi.aqj (43 bytes)
%WinDir%\ime\imjp8_1\qabijrazy.iya (43 bytes)
%Program Files%\MSN Gaming Zone\Windows\jzbyjayay.araq (43 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\qabijrazy.iya (43 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\qabijrazy.iya (43 bytes)
%Program Files%\Outlook Express\zarrrziii.rrqzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\jyzbzbyqq.jby (43 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\jrrzqyjaa.ari (43 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\jzbyjayay.ara (43 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\ibyqyajqi.aqj (43 bytes)
C:\Perl\bin\yrabrrara.rqq (43 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\ibyqyajqi.aqj (43 bytes)
%Program Files%\Wireshark\qabijrazy.iya (43 bytes)
%Program Files%\Windows Media Player\jrrzqyjaa.ari (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zarrrziii.rrq (43 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\jrrzqyjaa.ari (43 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\zarrrziii.rrq (43 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\briazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\qabijrazy.iya (43 bytes)
%Program Files%\Common Files\Adobe\Updater6\jyzbzbyqq.jby (43 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\ibyqyajqi.aqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\yrabrrara.rqq (43 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\jrrzqyjaa.ari (43 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\yrabrrara.rqq (43 bytes)
%WinDir%\jzbyjayay.ara (43 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\yrabrrara.rqq (43 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\jzbyjayay.ara (43 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\briazzzar.iby (43 bytes)
%WinDir%\Microsoft.NET\Framework\jrrzqyjaa.ari (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\zarrrziii.rrq (43 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\yrabrrara.rqq (43 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\jrrzqyjaa.ari (43 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\ibyqyajqi.aqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\jrrzqyjaa.ari (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aaayja.araj.bzi (43 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qabijrazy.iya (43 bytes)
%Program Files%\NetMeeting\jrrzqyjaa.aribriazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\jyzbzbyqq.jby (43 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\qabijrazy.iya (43 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\ibyqyajqi.aqj (43 bytes)
%Program Files%\MSN Gaming Zone\Windows\briazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\briazzzar.iby (43 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\qabijrazy.iya (43 bytes)
C:\Perl\bin\jyzbzbyqq.jby (43 bytes)
%Program Files%\MSN Gaming Zone\Windows\yrabrrara.rqqq (43 bytes)
%WinDir%\ime\imjp8_1\jrrzqyjaa.ari (43 bytes)
%WinDir%\pchealth\helpctr\binaries\briazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\briazzzar.iby (43 bytes)
%Program Files%\Outlook Express\briazzzar.ibyzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\jzbyjayay.ara (43 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\jyzbzbyqq.jby (43 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\zarrrziii.rrq (43 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\briazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\jyzbzbyqq.jby (43 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\jzbyjayay.ara (43 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\ibyqyajqi.aqj (43 bytes)
%Program Files%\MSN Gaming Zone\Windows\jyzbzbyqq.jbyq (43 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\jzbyjayay.ara (43 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\qabijrazy.iya (43 bytes)
%WinDir%\xwrm.exe (43 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\zarrrziii.rrq (43 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\zarrrziii.rrq (43 bytes)
%Program Files%\Wireshark\jyzbzbyqq.jby (43 bytes)
%WinDir%\pchealth\helpctr\binaries\jrrzqyjaa.ari (43 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\briazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\zarrrziii.rrq (43 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\jrrzqyjaa.ari (43 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\jrrzqyjaa.ari (43 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\jrrzqyjaa.ari (43 bytes)
C:\totalcmd\jzbyjayay.ara (43 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\ibyqyajqi.aqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\jrrzqyjaa.ari (43 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\briazzzar.iby (43 bytes)
%Program Files%\Windows Media Player\qabijrazy.iyaiby (43 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\ibyqyajqi.aqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\qabijrazy.iya (43 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\yrabrrara.rqq (43 bytes)
%Program Files%\Windows NT\Accessories\zarrrziii.rrqy (43 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\briazzzar.ibyzy.iyazzar.iby (43 bytes)
%Program Files%\Wireshark\zarrrziii.rrq (43 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\yrabrrara.rqq (43 bytes)
%WinDir%\ime\imjp8_1\yrabrrara.rqq (43 bytes)
%WinDir%\ime\imjp8_1\ibyqyajqi.aqj (43 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\ibyqyajqi.aqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\jrrzqyjaa.ari (43 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\qabijrazy.iya (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\qabijrazy.iyazzar.iby (43 bytes)
%Program Files%\Windows NT\yrabrrara.rqq (43 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\ibyqyajqi.aqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\jzbyjayay.ara (43 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\qabijrazy.iya (43 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\yrabrrara.rqq (43 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\jyzbzbyqq.jby (43 bytes)
C:\Perl\bin\zarrrziii.rrq (43 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\briazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\jzbyjayay.ara (43 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\jzbyjayay.ara (43 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\zarrrziii.rrq (43 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\yrabrrara.rqq (43 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\jyzbzbyqq.jby (43 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\jrrzqyjaa.ari (43 bytes)
%Program Files%\NetMeeting\qabijrazy.iyabriazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\yrabrrara.rqq (43 bytes)
%WinDir%\$hf_mig$\KB898461\update\qabijrazy.iya.rrqy (43 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\ibyqyajqi.aqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\zarrrziii.rrq (43 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\briazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\briazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\qabijrazy.iya (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\yrabrrara.rqq (43 bytes)
%WinDir%\Network Diagnostic\jyzbzbyqq.jby (43 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\briazzzar.iby (43 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\yrabrrara.rqq (43 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\jyzbzbyqq.jby (43 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\jzbyjayay.ara (43 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\qabijrazy.iya (43 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\qabijrazy.iya (43 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\ibyqyajqi.aqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\jzbyjayay.ara (43 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\jyzbzbyqq.jby (43 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\zarrrziii.rrq (43 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\jrrzqyjaa.ari (43 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\jyzbzbyqq.jby (43 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\ibyqyajqi.aqj (43 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\ibyqyajqi.aqj (43 bytes)
C:\totalcmd\jrrzqyjaa.ari (43 bytes)

The process jrrzqyjaa.ari:1652 makes changes in a file system.
The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ajyjzy.aqrj.bzi (43 bytes)

The process jrrzqyjaa.ari:188 makes changes in a file system.
The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\yjrjqj.razj.bzi (43 bytes)

Registry activity

The process ebdfb4e25bcf611674f5df26dcab4e10.exe:1316 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"

The process jrrzqyjaa.ari:1652 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 B2 C7 34 E9 9F 32 11 17 02 D0 74 AF 0B EC 80"

The process jrrzqyjaa.ari:188 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "70 29 C8 B0 7F DB 3D C4 81 1E FF E6 28 2E C7 BD"

Network activity (URLs)

A bot communicates with command and control servers via IRC channel.

No activity has been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Worm that spreads its copies in attachments included in emails.


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    ebdfb4e25bcf611674f5df26dcab4e10.exe:1316
    jrrzqyjaa.ari:1652
    jrrzqyjaa.ari:188

  2. Delete the original Virus file.
  3. Delete or disinfect the following files created/modified by the Virus:

    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\jrrzqyjaa.ari (43 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\briazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\qabijrazy.iya (43 bytes)
    %WinDir%\ime\imjp8_1\jyzbzbyqq.jby (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\jyzbzbyqq.jby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\yrabrrara.rqq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\qabijrazy.iya (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\ibyqyajqi.aqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\jyzbzbyqq.jby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\jzbyjayay.ara (43 bytes)
    %Program Files%\NetMeeting\ibyqyajqi.aqjbriazzzar.iby (43 bytes)
    %WinDir%\inf\jyzbzbyqq.jby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\jrrzqyjaa.ari (43 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\yrabrrara.rqq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\ibyqyajqi.aqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\zarrrziii.rrq (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\ibyqyajqi.aqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\jrrzqyjaa.ari (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jyzbzbyqq.jby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\briazzzar.iby (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\briazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\ibyqyajqi.aqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\jrrzqyjaa.ari (43 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\ibyqyajqi.aqj (43 bytes)
    %Program Files%\Wireshark\yrabrrara.rqq (43 bytes)
    %Program Files%\WinPcap\jzbyjayay.arazbzbyqq.jby.rrqy (43 bytes)
    %Program Files%\Outlook Express\yrabrrara.rqqzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\jrrzqyjaa.ari (43 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\briazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\ibyqyajqi.aqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\zarrrziii.rrq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\yrabrrara.rqq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\jzbyjayay.ara (43 bytes)
    %WinDir%\ime\imjp8_1\briazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\yrabrrara.rqq (43 bytes)
    %Program Files%\Outlook Express\jzbyjayay.arazzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\zarrrziii.rrq (43 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\qabijrazy.iya (43 bytes)
    %Program Files%\Wireshark\jrrzqyjaa.ari (43 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\zarrrziii.rrq (43 bytes)
    %WinDir%\ime\imkr6_1\zarrrziii.rrq (43 bytes)
    %WinDir%\$hf_mig$\KB898461\briazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\zarrrziii.rrq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\briazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\zarrrziii.rrq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\qabijrazy.iya (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\jzbyjayay.ara (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\zarrrziii.rrq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\jzbyjayay.ara (43 bytes)
    %Program Files%\Windows Media Player\ibyqyajqi.aqj (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jzbyjayay.ara (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\briazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\briazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\jyzbzbyqq.jby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\briazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\qabijrazy.iya (43 bytes)
    %Program Files%\Windows NT\Pinball\jyzbzbyqq.jby.rrqy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\jyzbzbyqq.jby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\jyzbzbyqq.jby (43 bytes)
    %WinDir%\ime\imjp8_1\jzbyjayay.ara (43 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\jzbyjayay.ara (43 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\qabijrazy.iya (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\zarrrziii.rrq (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yrabrrara.rqq (43 bytes)
    D:\jyzbzbyqq.jby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\yrabrrara.rqq (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\jzbyjayay.ara (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\yrabrrara.rqq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\jyzbzbyqq.jby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\jyzbzbyqq.jby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\zarrrziii.rrq (43 bytes)
    C:\totalcmd\zarrrziii.rrq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\jzbyjayay.ara (43 bytes)
    %Program Files%\Wireshark\ibyqyajqi.aqj (43 bytes)
    %WinDir%\ime\imjp8_1\qabijrazy.iya (43 bytes)
    %Program Files%\MSN Gaming Zone\Windows\jzbyjayay.araq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\qabijrazy.iya (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\qabijrazy.iya (43 bytes)
    %Program Files%\Outlook Express\zarrrziii.rrqzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\jyzbzbyqq.jby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\jrrzqyjaa.ari (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\jzbyjayay.ara (43 bytes)
    %WinDir%\$NtUninstallKB898461$\spuninst\ibyqyajqi.aqj (43 bytes)
    C:\Perl\bin\yrabrrara.rqq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\ibyqyajqi.aqj (43 bytes)
    %Program Files%\Wireshark\qabijrazy.iya (43 bytes)
    %Program Files%\Windows Media Player\jrrzqyjaa.ari (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zarrrziii.rrq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\jrrzqyjaa.ari (43 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\zarrrziii.rrq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\briazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\qabijrazy.iya (43 bytes)
    %Program Files%\Common Files\Adobe\Updater6\jyzbzbyqq.jby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\ibyqyajqi.aqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\yrabrrara.rqq (43 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\jrrzqyjaa.ari (43 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\yrabrrara.rqq (43 bytes)
    %WinDir%\jzbyjayay.ara (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\yrabrrara.rqq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\jzbyjayay.ara (43 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\briazzzar.iby (43 bytes)
    %WinDir%\Microsoft.NET\Framework\jrrzqyjaa.ari (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\zarrrziii.rrq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\yrabrrara.rqq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\jrrzqyjaa.ari (43 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\ibyqyajqi.aqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\jrrzqyjaa.ari (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\aaayja.araj.bzi (43 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\qabijrazy.iya (43 bytes)
    %Program Files%\NetMeeting\jrrzqyjaa.aribriazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\jyzbzbyqq.jby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\qabijrazy.iya (43 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\ibyqyajqi.aqj (43 bytes)
    %Program Files%\MSN Gaming Zone\Windows\briazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\briazzzar.iby (43 bytes)
    %Program Files%\Common Files\Microsoft Shared\MSInfo\qabijrazy.iya (43 bytes)
    C:\Perl\bin\jyzbzbyqq.jby (43 bytes)
    %Program Files%\MSN Gaming Zone\Windows\yrabrrara.rqqq (43 bytes)
    %WinDir%\ime\imjp8_1\jrrzqyjaa.ari (43 bytes)
    %WinDir%\pchealth\helpctr\binaries\briazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\briazzzar.iby (43 bytes)
    %Program Files%\Outlook Express\briazzzar.ibyzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\jzbyjayay.ara (43 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\jyzbzbyqq.jby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\zarrrziii.rrq (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\briazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\jyzbzbyqq.jby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\jzbyjayay.ara (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\ibyqyajqi.aqj (43 bytes)
    %Program Files%\MSN Gaming Zone\Windows\jyzbzbyqq.jbyq (43 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\jzbyjayay.ara (43 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\qabijrazy.iya (43 bytes)
    %WinDir%\xwrm.exe (43 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\zarrrziii.rrq (43 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\zarrrziii.rrq (43 bytes)
    %Program Files%\Wireshark\jyzbzbyqq.jby (43 bytes)
    %WinDir%\pchealth\helpctr\binaries\jrrzqyjaa.ari (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\briazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\zarrrziii.rrq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\jrrzqyjaa.ari (43 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\jrrzqyjaa.ari (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\jrrzqyjaa.ari (43 bytes)
    C:\totalcmd\jzbyjayay.ara (43 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\ibyqyajqi.aqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\jrrzqyjaa.ari (43 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\briazzzar.iby (43 bytes)
    %Program Files%\Windows Media Player\qabijrazy.iyaiby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\ibyqyajqi.aqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\qabijrazy.iya (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\yrabrrara.rqq (43 bytes)
    %Program Files%\Windows NT\Accessories\zarrrziii.rrqy (43 bytes)
    %Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\briazzzar.ibyzy.iyazzar.iby (43 bytes)
    %Program Files%\Wireshark\zarrrziii.rrq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\yrabrrara.rqq (43 bytes)
    %WinDir%\ime\imjp8_1\yrabrrara.rqq (43 bytes)
    %WinDir%\ime\imjp8_1\ibyqyajqi.aqj (43 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\ibyqyajqi.aqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\jrrzqyjaa.ari (43 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\qabijrazy.iya (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\qabijrazy.iyazzar.iby (43 bytes)
    %Program Files%\Windows NT\yrabrrara.rqq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\ibyqyajqi.aqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\jzbyjayay.ara (43 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\qabijrazy.iya (43 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\yrabrrara.rqq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\jyzbzbyqq.jby (43 bytes)
    C:\Perl\bin\zarrrziii.rrq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\briazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\jzbyjayay.ara (43 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\jzbyjayay.ara (43 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\zarrrziii.rrq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\yrabrrara.rqq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\jyzbzbyqq.jby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\jrrzqyjaa.ari (43 bytes)
    %Program Files%\NetMeeting\qabijrazy.iyabriazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\yrabrrara.rqq (43 bytes)
    %WinDir%\$hf_mig$\KB898461\update\qabijrazy.iya.rrqy (43 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\ibyqyajqi.aqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\zarrrziii.rrq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\briazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\briazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\qabijrazy.iya (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\yrabrrara.rqq (43 bytes)
    %WinDir%\Network Diagnostic\jyzbzbyqq.jby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\briazzzar.iby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\yrabrrara.rqq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\jyzbzbyqq.jby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\jzbyjayay.ara (43 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\qabijrazy.iya (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\qabijrazy.iya (43 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\ibyqyajqi.aqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\jzbyjayay.ara (43 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\jyzbzbyqq.jby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\zarrrziii.rrq (43 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\jrrzqyjaa.ari (43 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\jyzbzbyqq.jby (43 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\ibyqyajqi.aqj (43 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\ibyqyajqi.aqj (43 bytes)
    C:\totalcmd\jrrzqyjaa.ari (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ajyjzy.aqrj.bzi (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\yjrjqj.razj.bzi (43 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "x32x" = "%WinDir%\xwrm.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.