Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERa3d8.dir00\svchost.exe.mdmp 16325836412032480
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WERa3d8.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '20#.#41.188.176':445
- '20#.#41.204.196':445
- '20#.#41.13.79':445
- '20#.#41.48.169':445
- '20#.#41.139.39':445
- '20#.#41.229.41':139
- '20#.#41.105.23':139
- '20#.#41.11.141':445
- '20#.#41.165.138':445
- '20#.241.4.0':445
- '20#.#41.47.109':445
- '20#.#41.63.131':445
- '20#.#41.174.60':445
- '20#.#41.212.11':445
- '20#.#41.90.134':445
- '20#.#41.0.203':445
- '20#.#41.18.223':445
- '20#.#41.112.183':445
- '20#.#41.118.197':445
- '20#.#41.143.109':139
- '20#.#41.139.234':139
- '20#.#41.13.180':139
- '20#.#41.80.88':139
- '20#.#41.54.66':139
- '20#.#41.156.17':139
- '20#.#41.17.47':139
- '20#.#41.138.242':139
- '20#.#41.24.96':139
- '20#.#41.235.33':139
- '20#.#41.201.170':139
- '20#.#41.8.202':139
- '20#.#41.5.189':139
- '20#.#41.137.149':139
- '20#.#41.3.144':139
- '20#.#41.81.211':139
- '20#.#41.199.129':139
- '20#.#41.86.166':139
- '20#.#41.122.35':139
- '20#.#41.81.24':139
- '20#.#41.28.33':445
- '20#.#41.233.244':445
- '20#.#41.182.186':445
- '20#.#41.237.208':445
- '20#.#41.232.38':445
- '20#.#41.84.189':445
- '20#.#41.27.7':445
- '20#.#41.110.26':445
- '20#.#41.159.241':445
- '20#.#41.6.188':445
- '20#.#41.165.254':445
- '20#.#41.204.196':139
- '20#.#41.139.39':139
- '20#.#41.188.176':139
- '20#.#41.48.169':139
- '20#.#41.165.138':139
- '20#.#41.193.135':445
- '20#.#41.129.206':445
- '20#.#41.11.141':139
- '20#.#41.105.241':445
- '20#.#41.99.110':445
- '20#.#41.196.159':445
- '20#.#41.222.82':445
- '20#.#41.138.81':445
- '20#.#41.0.219':445
- '20#.#41.144.238':445
- '20#.#41.31.205':445
- '20#.#41.32.125':445
- '20#.#41.37.125':445
- '20#.#41.250.99':445
- '20#.#41.84.240':445
- '20#.#41.36.129':445
- '20#.#41.60.36':445
- '20#.#41.2.247':445
- '20#.#41.223.180':445
- '20#.#41.119.135':445
- '20#.#41.132.145':445
- '20#.#41.38.72':445
- '20#.#41.220.83':445
- '20#.#41.194.103':445
- '20#.#41.169.182':139
- '20#.#41.233.202':445
- '20#.#41.202.172':445
- '20#.#41.169.182':445
- '20#.#41.30.245':445
- '20#.#41.95.131':445
- '20#.#41.227.148':445
- '20#.#41.167.96':445
- '20#.#41.19.107':445
- '20#.#41.161.159':445
- '20#.#41.138.242':445
- '20#.#41.80.88':445
- '20#.#41.139.234':445
- '20#.#41.54.66':445
- '20#.#41.201.170':445
- '20#.#41.156.17':445
- '20#.#41.235.33':445
- '20#.#41.17.47':445
- '20#.#41.13.180':445
- '20#.#41.24.96':445
- '20#.#41.67.141':445
- '20#.#41.190.106':445
- '20#.#41.116.141':445
- '20#.#41.184.234':445
- '20#.#41.106.119':445
- '20#.#41.27.67':445
- '20#.#41.250.51':445
- '20#.#41.13.168':445
- '20#.#41.108.61':445
- '20#.#41.52.141':445
- '20#.#41.37.25':445
- '20#.#41.0.253':445
- '20#.#41.96.14':445
- '20#.#41.192.52':445
- '20#.#41.39.195':445
- '20#.#41.10.234':445
- '20#.#41.15.130':445
- '20#.#41.9.131':445
- '20#.#41.237.154':445
- '20#.#41.73.238':445
- '20#.#41.86.166':445
- '20#.#41.96.14':139
- '20#.#41.10.234':139
- '20#.#41.39.195':139
- '20#.#41.0.253':139
- '20#.#41.237.154':139
- '20#.#41.15.130':139
- '20#.#41.37.25':139
- '20#.#41.73.238':139
- '20#.#41.9.131':139
- '20#.#41.192.52':139
- '20#.#41.233.202':139
- '20#.#41.95.131':139
- '20#.#41.30.245':139
- '20#.#41.202.172':139
- '20#.#41.19.107':139
- '20#.#41.167.96':139
- '20#.#41.67.141':139
- '20#.#41.161.159':139
- '20#.#41.227.148':139
- '20#.#41.184.234':139
- '20#.#41.137.149':445
- '20#.#41.5.189':445
- '20#.#41.143.109':445
- '20#.#41.3.144':445
- '20#.#41.8.202':445
- '20#.#41.199.129':445
- '20#.#41.81.24':445
- '20#.#41.81.211':445
- '20#.#41.122.35':445
- '20#.#41.105.23':445
- '20#.#41.116.141':139
- '20#.#41.27.67':139
- '20#.#41.106.119':139
- '20#.#41.190.106':139
- '20#.#41.108.61':139
- '20#.#41.13.168':139
- '20#.#41.229.41':445
- '20#.#41.52.141':139
- '20#.#41.250.51':139
- '20#.#41.13.79':139
- '20#.#41.162.113':445
- '20#.#41.120.243':445
- '20#.#41.84.221':139
- '20#.#41.111.208':445
- '20#.#41.251.39':445
- '20#.#41.175.230':445
- '20#.#41.100.52':445
- '20#.#41.97.154':445
- '20#.#41.68.250':445
- '20#.#41.193.213':139
- '20#.#41.171.159':139
- '20#.#41.186.81':139
- '20#.#41.30.59':139
- '20#.#41.174.72':139
- '20#.#41.19.98':139
- '20#.#41.149.32':139
- '20#.#41.112.149':139
- '20#.#41.119.78':139
- '20#.#41.34.29':139
- '20#.#41.164.245':445
- '20#.#41.97.208':445
- '20#.#41.144.186':445
- '20#.#41.121.102':445
- '20#.#41.72.70':445
- '20#.#41.86.24':445
- '20#.#41.109.169':445
- '20#.#41.156.171':445
- '20#.#41.248.180':445
- '20#.#41.148.118':445
- '20#.#41.56.126':445
- '20#.#41.115.228':445
- '20#.#41.126.183':445
- '20#.#41.130.151':445
- '20#.#41.113.38':445
- '20#.#41.193.244':445
- '20#.#41.235.99':445
- '20#.#41.230.138':445
- '20#.#41.215.190':445
- '20#.#41.30.21':445
- '20#.#41.110.81':139
- '20#.#41.126.183':139
- '20#.#41.193.244':139
- '20#.#41.113.38':139
- '20#.#41.115.228':139
- '20#.#41.215.190':139
- '20#.#41.230.138':139
- '20#.#41.56.126':139
- '20#.#41.30.21':139
- '20#.#41.235.99':139
- '20#.#41.130.151':139
- '20#.#41.162.113':139
- '20#.#41.111.208':139
- '20#.#41.251.39':139
- '20#.#41.120.243':139
- '20#.#41.97.154':139
- '20#.#41.100.52':139
- '20#.#41.164.245':139
- '20#.#41.68.250':139
- '20#.#41.175.230':139
- '20#.#41.121.102':139
- '20#.#41.193.128':139
- '20#.#41.86.7':139
- '20#.#41.47.20':139
- '20#.#41.90.140':139
- '20#.#41.223.244':139
- '20#.#41.36.69':139
- '20#.#41.97.198':139
- '20#.#41.101.195':139
- '20#.#41.68.198':139
- '20#.#41.29.197':139
- '20#.#41.144.186':139
- '20#.#41.86.24':139
- '20#.#41.72.70':139
- '20#.#41.97.208':139
- '20#.#41.248.180':139
- '20#.#41.156.171':139
- '20#.#41.28.254':139
- '20#.#41.148.118':139
- '20#.#41.109.169':139
- '20#.#41.28.254':445
- '20#.#41.60.36':139
- '20#.#41.119.135':139
- '20#.#41.223.180':139
- '20#.#41.36.129':139
- '20#.#41.220.83':139
- '20#.#41.38.72':139
- '20#.#41.84.240':139
- '20#.#41.194.103':139
- '20#.#41.132.145':139
- '20#.#41.2.247':139
- '20#.#41.182.186':139
- '20#.#41.84.189':139
- '20#.#41.232.38':139
- '20#.#41.233.244':139
- '20#.#41.159.241':139
- '20#.#41.110.26':139
- '20#.#41.99.110':139
- '20#.#41.6.188':139
- '20#.#41.27.7':139
- '20#.#41.138.81':139
- '20#.#41.47.109':139
- '20#.#41.90.134':139
- '20#.#41.212.11':139
- '20#.#41.63.131':139
- '20#.#41.112.183':139
- '20#.#41.18.223':139
- '20#.241.4.0':139
- '20#.#41.118.197':139
- '20#.#41.0.203':139
- '20#.#41.174.60':139
- '20#.#41.222.82':139
- '20#.#41.144.238':139
- '20#.#41.0.219':139
- '20#.#41.196.159':139
- '20#.#41.37.125':139
- '20#.#41.32.125':139
- '20#.#41.28.33':139
- '20#.#41.250.99':139
- '20#.#41.31.205':139
- '20#.#41.237.208':139
- '20#.#41.174.72':445
- '20#.#41.171.159':445
- '20#.#41.110.81':445
- '20#.#41.30.59':445
- '20#.#41.186.81':445
- '20#.#41.34.29':445
- '20#.#41.149.32':445
- '20#.#41.19.98':445
- '20#.#41.119.78':445
- '20#.#41.223.244':445
- '20#.#41.90.140':445
- '20#.#41.193.128':445
- '20#.#41.29.197':445
- '20#.#41.47.20':445
- '20#.#41.86.7':445
- '20#.#41.68.198':445
- '20#.#41.97.198':445
- '20#.#41.101.195':445
- '20#.#41.36.69':445
- '20#.#41.112.149':445
- '20#.#41.171.159':9988
- '20#.#41.36.69':9988
- '20#.#41.72.70':9988
- '20#.#41.86.24':9988
- '20#.#41.101.195':9988
- '20#.#41.129.206':139
- '20#.#41.165.254':139
- '20#.#41.105.241':139
- '20#.#41.193.135':139
- '20#.#41.121.102':9988
- '20#.#41.175.230':9988
- '20#.#41.115.228':9988
- '20#.#41.193.213':445
- '20#.#41.84.221':445
- '20#.#41.120.243':9988
- '20#.#41.193.244':9988
- '20#.#41.56.126':9988
- '20#.#41.126.183':9988
- '20#.#41.97.154':9988