Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WER0d1c.dir00\svchost.exe.mdmp 16325836412031976
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER0d1c.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '21#.#1.174.4':139
- '21#.#1.224.173':139
- '21#.41.5.29':139
- '21#.#1.32.114':139
- '21#.#1.80.36':139
- '21#.#1.214.10':139
- '21#.#1.78.240':139
- '21#.#1.225.36':139
- '21#.#1.42.183':139
- '21#.#1.36.180':139
- '21#.#1.109.104':139
- '21#.#1.8.243':139
- '21#.#1.134.8':139
- '21#.#1.242.216':139
- '21#.#1.12.158':139
- '21#.#1.128.40':139
- '21#.#1.73.244':139
- '21#.#1.156.149':139
- '21#.#1.52.176':139
- '21#.41.62.0':139
- '21#.#1.163.189':139
- '21#.#1.3.153':139
- '21#.#1.52.176':445
- '21#.#1.73.244':445
- '21#.#1.163.189':445
- '21#.#1.134.8':445
- '21#.41.62.0':445
- '21#.#1.80.36':445
- '21#.41.5.29':445
- '21#.#1.32.114':445
- '21#.#1.156.149':445
- '21#.#1.109.104':445
- '21#.#1.8.243':445
- '21#.#1.255.38':139
- '21#.#1.242.106':139
- '21#.#1.193.235':139
- '21#.#1.208.17':139
- '21#.#1.202.207':139
- '21#.#1.128.40':445
- '21#.#1.242.216':445
- '21#.#1.12.158':445
- '21#.#1.239.163':445
- '21#.#1.244.239':445
- '21#.#1.87.192':139
- '21#.41.95.5':139
- '21#.#1.170.5':139
- '21#.#1.113.17':139
- '21#.#1.49.33':139
- '21#.#1.81.124':445
- '21#.41.3.45':445
- '21#.#1.164.87':139
- '21#.#1.141.178':139
- '21#.#1.234.49':139
- '21#.#1.35.216':139
- '21#.#1.44.230':139
- '21#.#1.52.40':139
- '21#.#1.59.220':139
- '21#.#1.61.244':139
- '21#.#1.62.169':139
- '21#.#1.177.53':139
- '21#.#1.215.176':139
- '21#.#1.135.243':139
- '21#.#1.13.61':139
- '21#.#1.89.237':139
- '21#.#1.40.154':445
- '21#.#1.87.192':445
- '21#.41.95.5':445
- '21#.#1.170.5':445
- '21#.#1.113.17':445
- '21#.#1.49.33':445
- '21#.#1.239.163':139
- '21#.#1.244.239':139
- '21#.#1.164.87':445
- '21#.#1.141.178':445
- '21#.#1.234.49':445
- '21#.#1.35.216':445
- '21#.#1.44.230':445
- '21#.#1.52.40':445
- '21#.#1.59.220':445
- '21#.#1.61.244':445
- '21#.#1.62.169':445
- '21#.#1.177.53':445
- '21#.#1.215.176':445
- '21#.#1.135.243':445
- '21#.#1.13.61':445
- '21#.#1.89.237':445
- '21#.#1.174.4':445
- '21#.#1.145.219':139
- '21#.#1.139.163':139
- '21#.#1.61.206':139
- '21#.#1.195.49':445
- '21#.#1.164.39':445
- '21#.#1.154.92':139
- '21#.#1.216.133':139
- '21#.#1.0.214':139
- '21#.#1.247.191':139
- '21#.#1.2.117':139
- '21#.#1.49.231':445
- '21#.#1.159.132':445
- '21#.#1.223.252':445
- '21#.41.0.60':445
- '21#.#1.178.198':445
- '21#.#1.135.65':445
- '21#.#1.110.170':445
- '21#.#1.109.9':445
- '21#.#1.237.163':445
- '21#.#1.6.156':445
- '21#.#1.135.38':445
- '21#.#1.35.23':139
- '21#.#1.149.126':139
- '21#.#1.85.228':139
- '21#.#1.15.150':139
- '21#.#1.226.215':139
- '21#.#1.69.213':139
- '21#.#1.25.142':139
- '21#.#1.61.206':445
- '21#.#1.42.139':139
- '21#.#1.139.227':139
- '21#.#1.252.99':139
- '21#.#1.94.72':139
- '21#.#1.14.195':139
- '21#.#1.26.72':139
- '21#.#1.166.148':139
- '21#.#1.83.35':139
- '21#.#1.189.234':139
- '21#.#1.8.150':139
- '21#.#1.69.200':139
- '21#.#1.87.100':139
- '21#.#1.157.201':139
- '21#.#1.32.158':139
- '21#.#1.88.156':139
- '21#.#1.215.57':139
- '21#.41.0.90':139
- '21#.#1.242.106':445
- '21#.#1.20.150':139
- '21#.#1.22.206':139
- '21#.#1.202.99':139
- '21#.#1.152.79':139
- '21#.#1.161.215':139
- '21#.#1.153.162':139
- '21#.#1.255.38':445
- '21#.#1.225.36':445
- '21#.#1.214.10':445
- '21#.#1.36.180':445
- '21#.#1.224.173':445
- '21#.#1.42.183':445
- '21#.#1.202.207':445
- '21#.#1.193.235':445
- '21#.#1.208.17':445
- '21#.#1.78.240':445
- '21#.#1.3.153':445
- '21#.#1.178.198':139
- '21#.#1.88.156':445
- '21#.#1.215.57':445
- '21#.41.0.90':445
- '21#.#1.164.39':139
- '21#.#1.20.150':445
- '21#.#1.22.206':445
- '21#.#1.202.99':445
- '21#.#1.152.79':445
- '21#.#1.161.215':445
- '21#.#1.153.162':445
- '21#.#1.195.49':139
- '21#.#1.223.252':139
- '21#.#1.6.156':139
- '21#.#1.159.132':139
- '21#.#1.135.65':139
- '21#.41.0.60':139
- '21#.#1.109.9':139
- '21#.#1.49.231':139
- '21#.#1.110.170':139
- '21#.#1.135.38':139
- '21#.#1.237.163':139
- '21#.#1.40.154':139
- '21#.#1.204.133':445
- '21#.#1.254.201':445
- '21#.#1.240.239':445
- '21#.#1.16.33':445
- '21#.#1.123.242':445
- '21#.#1.172.247':445
- '21#.#1.24.174':445
- '21#.#1.246.142':445
- '21#.#1.33.217':445
- '21#.#1.36.22':445
- '21#.#1.204.169':445
- '21#.#1.12.51':139
- '21#.#1.7.146':139
- '21#.#1.101.177':139
- '21#.#1.161.32':139
- '21#.#1.209.251':139
- '21#.#1.226.216':445
- '21#.41.23.4':445
- '21#.#1.123.90':139
- '21#.#1.62.159':139
- '21#.#1.49.142':139
- '21#.41.6.9':445
- '21#.41.9.40':445
- '21#.#1.144.112':445
- '21#.#1.228.190':445
- '21#.#1.119.36':445
- '21#.#1.28.119':445
- '21#.#1.220.204':445
- '21#.#1.63.221':445
- '21#.#1.205.50':445
- '21#.#1.153.68':445
- '21#.#1.129.44':445
- '21#.#1.178.223':445
- '21#.#1.27.18':445
- '21#.#1.160.29':445
- '21#.#1.2.155':445
- '21#.#1.169.224':445
- '21#.#1.172.45':445
- '21#.#1.79.104':445
- '21#.#1.123.124':445
- '21#.#1.137.146':445
- '21#.#1.122.81':445
- '21#.41.50.3':445
- '21#.#1.169.224':139
- '21#.#1.172.45':139
- '21#.41.6.9':139
- '21#.#1.172.247':139
- '21#.#1.24.174':139
- '21#.#1.122.81':139
- '21#.41.50.3':139
- '21#.#1.160.29':139
- '21#.#1.2.155':139
- '21#.#1.27.18':139
- '21#.#1.246.142':139
- '21#.#1.16.33':139
- '21#.#1.254.201':139
- '21#.41.23.4':139
- '21#.#1.226.216':139
- '21#.#1.204.169':139
- '21#.#1.33.217':139
- '21#.#1.36.22':139
- '21#.#1.204.133':139
- '21#.#1.240.239':139
- '21#.#1.123.242':139
- '21#.#1.137.146':139
- '21#.#1.92.222':139
- '21#.#1.232.175':139
- '21#.#1.184.63':139
- '21#.#1.220.204':139
- '21#.#1.63.221':139
- '21#.#1.116.218':139
- '21#.#1.227.140':139
- '21#.#1.218.61':139
- '21#.#1.33.232':139
- '21#.#1.62.34':139
- '21#.#1.205.50':139
- '21#.#1.119.36':139
- '21#.#1.28.119':139
- '21#.#1.178.223':139
- '21#.#1.79.104':139
- '21#.#1.123.124':139
- '21#.#1.153.68':139
- '21#.#1.129.44':139
- '21#.#1.144.112':139
- '21#.#1.228.190':139
- '21#.41.9.40':139
- '21#.#1.184.63':445
- '21#.#1.85.206':445
- '21#.#1.118.214':445
- '21#.#1.83.165':445
- '21#.#1.26.164':139
- '21#.#1.199.186':445
- '21#.#1.0.254':445
- '21#.#1.219.0':445
- '21#.#1.107.175':445
- '21#.#1.43.186':445
- '21#.#1.26.84':445
- '21#.#1.5.104':139
- '21#.#1.26.132':139
- '21#.#1.190.151':139
- '21#.#1.17.138':139
- '21#.#1.27.41':139
- '21#.#1.158.186':139
- '21#.41.4.87':139
- '21#.#1.123.251':139
- '21#.#1.198.216':139
- '21#.#1.111.56':139
- '21#.#1.124.111':139
- '21#.#1.204.218':445
- '21#.#1.198.216':445
- '21#.41.4.87':445
- '21#.#1.124.111':445
- '21#.#1.190.151':445
- '21#.#1.111.56':445
- '21#.#1.81.124':139
- '21#.41.3.45':139
- '21#.#1.26.164':445
- '21#.#1.123.251':445
- '21#.#1.5.104':445
- '21#.#1.26.132':445
- '21#.#1.32.175':445
- '21#.#1.228.224':445
- '21#.#1.237.123':445
- '21#.#1.228.204':445
- '21#.#1.124.205':445
- '21#.#1.158.186':445
- '21#.#1.17.138':445
- '21#.#1.27.41':445
- '21#.#1.10.229':445
- '21#.#1.26.163':445
- '21#.#1.123.90':445
- '21#.41.23.4':9988
- '21#.#1.49.142':445
- '21#.#1.7.146':445
- '21#.#1.62.159':445
- '21#.#1.240.239':9988
- '21#.#1.36.22':9988
- '21#.#1.33.217':9988
- '21#.#1.16.33':9988
- '21#.#1.254.201':9988
- '21#.#1.12.51':445
- '21#.#1.62.34':445
- '21#.#1.218.61':445
- '21#.#1.33.232':445
- '21#.#1.92.222':445
- '21#.#1.232.175':445
- '21#.#1.209.251':445
- '21#.#1.101.177':445
- '21#.#1.161.32':445
- '21#.#1.116.218':445
- '21#.#1.227.140':445
- '21#.#1.172.247':9988
- '21#.#1.228.204':139
- '21#.#1.124.205':139
- '21#.#1.204.218':139
- '21#.#1.0.254':139
- '21#.#1.219.0':139
- '21#.#1.10.229':139
- '21#.#1.26.163':139
- '21#.#1.228.224':139
- '21#.#1.237.123':139
- '21#.#1.32.175':139
- '21#.#1.107.175':139
- '21#.#1.123.124':9988
- '21#.#1.199.186':139
- '21#.#1.79.104':9988
- '21#.#1.122.81':9988
- '21#.#1.160.29':9988
- '21#.#1.43.186':139
- '21#.#1.26.84':139
- '21#.#1.118.214':139
- '21#.#1.83.165':139
- '21#.#1.85.206':139