Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER9b5c.dir00\svchost.exe.mdmp 16325836412032324
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER9b5c.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '21#.#1.170.71':139
- '21#.#1.242.205':139
- '21#.#1.135.250':139
- '21#.#1.230.122':139
- '21#.#1.141.230':139
- '21#.#1.158.79':139
- '21#.#1.230.187':139
- '21#.#1.50.223':139
- '21#.#1.124.182':139
- '21#.21.9.17':139
- '21#.#1.106.253':139
- '21#.#1.40.36':139
- '21#.#1.15.235':139
- '21#.#1.236.2':139
- '21#.#1.136.13':139
- '21#.#1.157.165':139
- '21#.#1.123.57':139
- '21#.#1.90.182':139
- '21#.#1.153.41':139
- '21#.#1.182.24':139
- '21#.#1.207.58':139
- '21#.#1.15.94':139
- '21#.#1.199.31':139
- '21#.#1.30.111':139
- '21#.#1.77.133':139
- '21#.#1.185.134':139
- '21#.#1.42.216':445
- '21#.#1.68.222':445
- '21#.#1.13.117':445
- '21#.#1.78.226':139
- '21#.#1.76.75':445
- '21#.#1.103.98':139
- '21#.#1.198.102':139
- '21#.#1.175.56':139
- '21#.#1.140.56':139
- '21#.#1.14.187':139
- '21#.#1.75.71':139
- '21#.21.79.5':139
- '21#.#1.5.169':139
- '21#.#1.44.134':139
- '21#.#1.199.125':139
- '21#.21.7.83':445
- '21#.#1.20.53':445
- '21#.#1.112.69':445
- '21#.#1.73.41':445
- '21#.21.0.96':445
- '21#.#1.170.49':445
- '21#.#1.38.132':445
- '21#.#1.50.101':445
- '21#.#1.216.35':445
- '21#.#1.69.128':445
- '21#.#1.134.134':445
- '21#.#1.198.244':445
- '21#.21.96.5':445
- '21#.#1.142.6':445
- '21#.#1.63.171':445
- '21#.#1.35.25':445
- '21#.#1.161.3':445
- '21#.#1.47.224':445
- '21#.#1.121.223':445
- '21#.#1.69.183':445
- '21#.#1.72.167':445
- '21#.#1.97.60':139
- '21#.#1.41.15':139
- '21#.#1.233.230':139
- '21#.#1.42.216':139
- '21#.#1.68.222':139
- '21#.#1.215.44':139
- '21#.#1.29.188':139
- '21#.#1.57.191':139
- '21#.#1.22.41':139
- '21#.#1.61.39':139
- '21#.#1.203.225':445
- '21#.#1.34.27':139
- '21#.21.4.41':445
- '21#.#1.68.247':445
- '21#.#1.148.243':445
- '21#.#1.76.75':139
- '21#.#1.13.117':139
- '21#.#1.235.155':445
- '21#.#1.235.155':139
- '21#.#1.34.27':445
- '21#.#1.91.156':139
- '21#.#1.33.60':139
- '21#.#1.54.82':139
- '21#.#1.218.114':139
- '21#.#1.27.39':139
- '21#.#1.140.69':139
- '21#.#1.112.165':139
- '21#.#1.150.63':139
- '21#.#1.207.254':139
- '21#.#1.134.203':139
- '21#.#1.78.226':445
- '21#.#1.192.62':139
- '21#.#1.199.31':445
- '21#.#1.30.111':445
- '21#.#1.15.94':445
- '21#.#1.39.198':139
- '21#.#1.114.212':139
- '21#.#1.14.244':445
- '21#.#1.14.244':139
- '21#.#1.192.62':445
- '21#.#1.68.37':139
- '21#.#1.11.135':139
- '21#.#1.247.177':139
- '21#.#1.188.140':139
- '21#.#1.92.248':139
- '21#.#1.140.92':139
- '21#.21.4.65':139
- '21#.#1.160.233':139
- '21#.#1.76.79':139
- '21#.#1.155.247':139
- '21#.#1.194.228':139
- '21#.#1.0.122':139
- '21#.#1.227.78':139
- '21#.#1.232.78':139
- '21#.#1.3.172':139
- '21#.#1.105.8':139
- '21#.#1.189.44':139
- '21#.#1.248.188':139
- '21#.#1.55.20':139
- '21#.#1.253.134':139
- '21#.#1.10.153':139
- '21#.#1.153.41':445
- '21#.#1.182.24':445
- '21#.#1.40.36':445
- '21#.#1.15.235':445
- '21#.#1.106.253':445
- '21#.#1.230.122':445
- '21#.#1.141.230':445
- '21#.#1.123.57':445
- '21#.#1.90.182':445
- '21#.#1.157.165':445
- '21#.#1.22.41':445
- '21#.#1.61.39':445
- '21#.#1.41.15':445
- '21#.#1.233.230':445
- '21#.#1.97.60':445
- '21#.#1.236.2':445
- '21#.#1.136.13':445
- '21#.#1.29.188':445
- '21#.#1.57.191':445
- '21#.#1.215.44':445
- '21#.#1.135.250':445
- '21#.#1.44.134':445
- '21#.#1.199.125':445
- '21#.#1.198.102':445
- '21#.#1.175.56':445
- '21#.#1.103.98':445
- '21#.#1.77.133':445
- '21#.#1.185.134':445
- '21#.21.79.5':445
- '21#.#1.5.169':445
- '21#.#1.75.71':445
- '21#.21.9.17':445
- '21#.#1.50.223':445
- '21#.#1.124.182':445
- '21#.#1.170.71':445
- '21#.#1.242.205':445
- '21#.#1.140.56':445
- '21#.#1.14.187':445
- '21#.#1.207.58':445
- '21#.#1.158.79':445
- '21#.#1.230.187':445
- '21#.21.3.53':445
- '21#.#1.211.113':445
- '21#.#1.36.145':445
- '21#.#1.107.121':445
- '21#.#1.77.209':445
- '21#.#1.92.218':445
- '21#.#1.110.51':445
- '21#.#1.80.158':445
- '21#.#1.101.225':445
- '21#.#1.30.105':445
- '21#.#1.46.48':445
- '21#.#1.11.52':139
- '21#.21.40.6':139
- '21#.#1.241.179':139
- '21#.#1.231.249':139
- '21#.#1.190.21':139
- '21#.#1.105.165':139
- '21#.#1.58.195':139
- '21#.#1.87.190':139
- '21#.#1.113.40':139
- '21#.#1.104.113':139
- '21#.#1.66.138':445
- '21#.#1.59.111':445
- '21#.#1.16.89':445
- '21#.21.1.48':445
- '21#.#1.19.19':445
- '21#.#1.75.111':445
- '21#.#1.64.19':445
- '21#.#1.222.45':445
- '21#.#1.193.120':445
- '21#.#1.143.23':445
- '21#.#1.69.64':445
- '21#.#1.33.13':445
- '21#.#1.14.33':445
- '21#.#1.238.188':445
- '21#.#1.163.167':445
- '21#.#1.117.163':445
- '21#.#1.56.198':445
- '21#.#1.26.57':445
- '21#.#1.40.35':445
- '21#.#1.225.13':445
- '21#.#1.115.225':445
- '21#.#1.238.188':139
- '21#.#1.33.13':139
- '21#.#1.117.163':139
- '21#.#1.66.138':139
- '21#.#1.163.167':139
- '21#.#1.40.35':139
- '21#.#1.56.198':139
- '21#.#1.115.225':139
- '21#.#1.14.33':139
- '21#.#1.225.13':139
- '21#.#1.211.113':139
- '21#.#1.36.145':139
- '21#.#1.107.121':139
- '21#.#1.92.218':139
- '21#.#1.77.209':139
- '21#.#1.110.51':139
- '21#.#1.80.158':139
- '21#.#1.101.225':139
- '21#.#1.30.105':139
- '21#.#1.46.48':139
- '21#.#1.26.57':139
- '21#.21.90.7':139
- '21#.#1.0.225':139
- '21#.#1.176.61':139
- '21#.#1.27.17':139
- '21#.#1.145.177':139
- '21#.#1.232.138':139
- '21#.#1.118.232':139
- '21#.#1.18.251':139
- '21#.#1.2.143':139
- '21#.#1.155.162':139
- '21#.#1.59.111':139
- '21#.#1.16.89':139
- '21#.21.1.48':139
- '21#.#1.19.19':139
- '21#.#1.75.111':139
- '21#.#1.64.19':139
- '21#.#1.222.45':139
- '21#.#1.193.120':139
- '21#.#1.143.23':139
- '21#.#1.69.64':139
- '21#.#1.59.180':139
- '21#.21.3.53':139
- '21#.#1.104.113':9988
- '21#.#1.0.225':9988
- '21#.#1.27.17':9988
- '21#.#1.134.134':139
- '21#.#1.198.244':139
- '21#.21.96.5':139
- '21#.#1.142.6':139
- '21#.#1.63.171':139
- '21#.#1.16.89':9988
- '21#.#1.105.165':9988
- '21#.#1.56.198':9988
- '21#.#1.145.177':9988
- '21#.#1.241.179':9988
- '21#.#1.143.23':9988
- '21#.#1.231.249':9988
- '21#.#1.2.143':9988
- '21#.#1.222.45':9988
- '21#.#1.26.57':9988
- '21#.#1.121.223':139
- '21#.#1.38.132':139
- '21#.#1.72.167':139
- '21#.#1.170.49':139
- '21#.#1.69.128':139
- '21#.#1.50.101':139
- '21#.#1.203.225':139
- '21#.#1.59.180':445
- '21#.21.4.41':139
- '21#.#1.68.247':139
- '21#.#1.148.243':139
- '21#.#1.161.3':139
- '21#.#1.73.41':139
- '21#.#1.35.25':139
- '21#.#1.69.183':139
- '21#.#1.47.224':139
- '21#.#1.20.53':139
- '21#.#1.216.35':139
- '21#.21.7.83':139
- '21#.21.0.96':139
- '21#.#1.112.69':139
- '21#.#1.11.52':445
- '21#.21.40.6':445
- '21#.#1.241.179':445
- '21#.#1.231.249':445
- '21#.#1.190.21':445
- '21#.#1.105.165':445
- '21#.#1.58.195':445
- '21#.#1.87.190':445
- '21#.#1.113.40':445
- '21#.#1.104.113':445
- '21#.21.90.7':445
- '21#.#1.0.225':445
- '21#.#1.176.61':445
- '21#.#1.27.17':445
- '21#.#1.145.177':445
- '21#.#1.232.138':445
- '21#.#1.118.232':445
- '21#.#1.18.251':445
- '21#.#1.2.143':445
- '21#.#1.155.162':445
- '21#.#1.30.105':9988
- '21#.#1.14.33':9988
- '21#.#1.225.13':9988
- '21#.#1.33.13':9988
- '21#.#1.117.163':9988
- '21#.#1.238.188':9988
- '21#.21.1.48':9988
- '21#.#1.69.64':9988
- '21#.#1.75.111':9988
- '21#.#1.115.225':9988
- '21#.#1.19.19':9988
- '21#.#1.107.121':9988
- '21#.#1.46.48':9988
- '21#.#1.211.113':9988
- '21#.#1.101.225':9988
- '21#.#1.77.209':9988
- '21#.#1.66.138':9988
- '21#.#1.163.167':9988
- '21#.#1.80.158':9988
- '21#.#1.36.145':9988
- '21#.#1.110.51':9988