Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WERf939.dir00\svchost.exe.mdmp 16325836412032416
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WERf939.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '19#.#26.77.192':445
- '19#.#26.2.122':445
- '19#.#26.147.207':445
- '19#.#26.204.43':445
- '19#.#26.101.38':445
- '19#.#26.60.204':139
- '19#.#26.100.204':139
- '19#.#26.229.111':445
- '19#.#26.71.32':445
- '19#.#26.22.71':445
- '19#.#26.153.219':445
- '19#.#26.255.216':445
- '19#.#26.10.194':445
- '19#.#26.9.118':445
- '19#.#26.115.32':445
- '19#.#26.208.203':445
- '19#.#26.27.83':445
- '19#.#26.169.23':445
- '19#.#26.223.92':445
- '19#.#26.7.173':445
- '19#.#26.58.198':139
- '19#.#26.56.207':139
- '19#.#26.52.163':139
- '19#.#26.64.139':139
- '19#.#26.250.174':139
- '19#.#26.63.240':139
- '19#.#26.223.63':139
- '19#.#26.74.136':139
- '19#.#26.22.14':139
- '19#.#26.76.76':139
- '19#.#26.144.82':139
- '19#.#26.50.168':139
- '19#.#26.20.0':139
- '19#.#26.163.7':139
- '19#.#26.146.112':139
- '19#.#26.0.252':139
- '19#.#26.134.210':139
- '19#.#26.54.218':139
- '19#.#26.10.228':139
- '19#.#26.37.219':139
- '19#.#26.253.201':445
- '19#.#26.77.136':445
- '19#.#26.76.175':445
- '19#.#26.48.137':445
- '19#.#26.175.171':445
- '19#.#26.223.171':445
- '19#.#26.141.92':445
- '19#.#26.73.138':445
- '19#.226.5.9':445
- '19#.#26.177.101':445
- '19#.#26.2.122':139
- '19#.#26.71.32':139
- '19#.#26.77.192':139
- '19#.#26.101.38':139
- '19#.#26.147.207':139
- '19#.#26.138.187':445
- '19#.#26.23.130':445
- '19#.#26.118.221':445
- '19#.#26.22.71':139
- '19#.#26.229.111':139
- '19#.#26.102.57':445
- '19#.#26.154.18':445
- '19#.#26.99.126':445
- '19#.#26.28.99':445
- '19#.#26.23.244':445
- '19#.#26.160.62':445
- '19#.#26.56.48':445
- '19#.#26.252.13':445
- '19#.#26.26.154':445
- '19#.#26.231.26':445
- '19#.#26.12.62':445
- '19#.#26.177.90':445
- '19#.#26.129.237':445
- '19#.#26.191.167':445
- '19#.#26.176.46':445
- '19#.#26.122.158':445
- '19#.#26.90.18':445
- '19#.#26.151.101':445
- '19#.#26.44.177':445
- '19#.#26.78.143':445
- '19#.#26.126.36':445
- '19#.#26.8.191':445
- '19#.#26.77.58':445
- '19#.#26.223.63':445
- '19#.#26.230.136':445
- '19#.#26.139.254':445
- '19#.#26.54.179':445
- '19#.#26.10.4':445
- '19#.#26.69.147':445
- '19#.#26.137.28':445
- '19#.#26.52.163':445
- '19#.#26.58.198':445
- '19#.#26.250.174':445
- '19#.#26.134.210':445
- '19#.#26.64.139':445
- '19#.#26.74.136':445
- '19#.#26.63.240':445
- '19#.#26.76.76':445
- '19#.#26.56.207':445
- '19#.#26.22.14':445
- '19#.#26.117.40':445
- '19#.#26.92.66':445
- '19#.#26.144.77':445
- '19#.#26.170.105':445
- '19#.#26.219.55':445
- '19#.#26.46.153':445
- '19#.#26.58.111':445
- '19#.#26.114.169':445
- '19#.#26.55.107':445
- '19#.#26.247.7':445
- '19#.#26.96.45':445
- '19#.#26.8.225':445
- '19#.#26.16.37':445
- '19#.#26.212.75':445
- '19#.#26.108.87':445
- '19#.#26.184.146':445
- '19#.#26.50.55':445
- '19#.#26.7.247':445
- '19#.#26.55.140':445
- '19#.#26.217.10':445
- '19#.#26.8.225':139
- '19#.#26.55.140':139
- '19#.#26.96.45':139
- '19#.#26.108.87':139
- '19#.#26.16.37':139
- '19#.#26.50.55':139
- '19#.#26.170.105':139
- '19#.#26.184.146':139
- '19#.#26.217.10':139
- '19#.#26.7.247':139
- '19#.#26.8.191':139
- '19#.#26.69.147':139
- '19#.#26.126.36':139
- '19#.#26.230.136':139
- '19#.#26.77.58':139
- '19#.#26.54.179':139
- '19#.#26.212.75':139
- '19#.#26.139.254':139
- '19#.#26.137.28':139
- '19#.#26.10.4':139
- '19#.#26.20.0':445
- '19#.#26.144.82':445
- '19#.#26.146.112':445
- '19#.#26.100.204':445
- '19#.#26.163.7':445
- '19#.#26.54.218':445
- '19#.#26.0.252':445
- '19#.#26.37.219':445
- '19#.#26.50.168':445
- '19#.#26.10.228':445
- '19#.#26.92.66':139
- '19#.#26.55.107':139
- '19#.#26.117.40':139
- '19#.#26.219.55':139
- '19#.#26.144.77':139
- '19#.#26.58.111':139
- '19#.#26.60.204':445
- '19#.#26.46.153':139
- '19#.#26.247.7':139
- '19#.#26.114.169':139
- '19#.#26.204.43':139
- '19#.#26.177.113':445
- '19#.#26.20.2':445
- '19#.#26.60.234':445
- '19#.#26.93.242':139
- '19#.#26.203.198':445
- '19#.#26.52.108':445
- '19#.#26.54.198':445
- '19#.#26.9.197':445
- '19#.#26.206.203':445
- '19#.#26.212.206':445
- '19#.#26.2.132':139
- '19#.#26.253.73':139
- '19#.#26.53.53':139
- '19#.#26.66.154':139
- '19#.#26.49.222':139
- '19#.#26.54.70':139
- '19#.#26.174.115':139
- '19#.#26.81.193':139
- '19#.#26.77.21':139
- '19#.#26.101.114':139
- '19#.#26.40.239':445
- '19#.#26.195.104':445
- '19#.#26.53.113':445
- '19#.#26.14.2':445
- '19#.#26.233.222':445
- '19#.#26.53.22':445
- '19#.#26.37.173':445
- '19#.#26.159.137':445
- '19#.#26.8.138':445
- '19#.#26.68.190':445
- '19#.#26.181.231':445
- '19#.#26.246.174':445
- '19#.#26.57.26':445
- '19#.#26.86.237':445
- '19#.#26.86.252':445
- '19#.#26.54.12':445
- '19#.#26.110.41':445
- '19#.#26.106.222':445
- '19#.#26.168.246':445
- '19#.#26.158.224':445
- '19#.#26.246.174':139
- '19#.#26.168.246':139
- '19#.#26.181.231':139
- '19#.#26.86.252':139
- '19#.#26.57.26':139
- '19#.#26.110.41':139
- '19#.#26.14.2':139
- '19#.#26.54.12':139
- '19#.#26.158.224':139
- '19#.#26.106.222':139
- '19#.#26.203.198':139
- '19#.#26.206.203':139
- '19#.#26.177.113':139
- '19#.#26.60.234':139
- '19#.#26.20.2':139
- '19#.#26.54.198':139
- '19#.#26.86.237':139
- '19#.#26.52.108':139
- '19#.#26.212.206':139
- '19#.#26.9.197':139
- '19#.#26.26.246':139
- '19#.#26.207.27':139
- '19#.#26.245.137':139
- '19#.#26.62.194':139
- '19#.#26.47.112':139
- '19#.#26.6.254':139
- '19#.#26.154.6':139
- '19#.#26.95.231':139
- '19#.#26.54.207':139
- '19#.#26.116.8':139
- '19#.#26.195.104':139
- '19#.#26.8.138':139
- '19#.#26.40.239':139
- '19#.#26.233.222':139
- '19#.#26.53.113':139
- '19#.#26.37.173':139
- '19#.#26.39.202':139
- '19#.#26.53.22':139
- '19#.#26.68.190':139
- '19#.#26.159.137':139
- '19#.#26.12.62':139
- '19#.#26.177.90':139
- '19#.#26.129.237':139
- '19#.#26.191.167':139
- '19#.#26.176.46':139
- '19#.#26.122.158':139
- '19#.#26.90.18':139
- '19#.#26.151.101':139
- '19#.#26.44.177':139
- '19#.#26.78.143':139
- '19#.#26.253.201':139
- '19#.#26.77.136':139
- '19#.#26.76.175':139
- '19#.#26.48.137':139
- '19#.#26.175.171':139
- '19#.#26.223.171':139
- '19#.#26.141.92':139
- '19#.#26.73.138':139
- '19#.226.5.9':139
- '19#.#26.177.101':139
- '19#.#26.153.219':139
- '19#.#26.255.216':139
- '19#.#26.10.194':139
- '19#.#26.9.118':139
- '19#.#26.115.32':139
- '19#.#26.208.203':139
- '19#.#26.27.83':139
- '19#.#26.169.23':139
- '19#.#26.223.92':139
- '19#.#26.7.173':139
- '19#.#26.102.57':139
- '19#.#26.154.18':139
- '19#.#26.99.126':139
- '19#.#26.28.99':139
- '19#.#26.23.244':139
- '19#.#26.160.62':139
- '19#.#26.56.48':139
- '19#.#26.252.13':139
- '19#.#26.26.154':139
- '19#.#26.231.26':139
- '19#.#26.53.53':445
- '19#.#26.2.132':445
- '19#.#26.49.222':445
- '19#.#26.154.6':445
- '19#.#26.66.154':445
- '19#.#26.81.193':445
- '19#.#26.54.70':445
- '19#.#26.77.21':445
- '19#.#26.253.73':445
- '19#.#26.101.114':445
- '19#.#26.245.137':445
- '19#.#26.26.246':445
- '19#.#26.47.112':445
- '19#.#26.39.202':445
- '19#.#26.62.194':445
- '19#.#26.95.231':445
- '19#.#26.6.254':445
- '19#.#26.116.8':445
- '19#.#26.207.27':445
- '19#.#26.54.207':445
- '19#.#26.60.234':9988
- '19#.#26.233.222':9988
- '19#.#26.110.41':9988
- '19#.#26.101.114':9988
- '19#.#26.154.6':9988
- '19#.#26.138.187':139
- '19#.#26.23.130':139
- '19#.#26.118.221':139
- '19#.#26.195.104':9988
- '19#.#26.174.115':9988
- '19#.#26.14.2':9988
- '19#.#26.9.197':9988
- '19#.#26.203.198':9988
- '19#.#26.174.115':445
- '19#.#26.93.242':445
- '19#.#26.106.222':9988
- '19#.#26.177.113':9988
- '19#.#26.49.222':9988
- '19#.#26.86.237':9988
- '19#.#26.66.154':9988