Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WERb487.dir00\svchost.exe.mdmp 16325836412032120
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WERb487.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- '67.##6.37.245':445
- '67.##6.145.80':445
- '67.##6.199.83':445
- '67.##6.9.206':445
- '67.##6.254.169':445
- '67.##6.245.145':445
- '67.##6.31.199':139
- '67.##6.29.72':139
- '67.#16.5.94':139
- '67.##6.249.37':445
- '67.##6.94.182':139
- '67.##6.72.168':445
- '67.##6.106.4':445
- '67.##6.105.110':445
- '67.##6.224.92':445
- '67.##6.40.221':445
- '67.##6.31.92':445
- '67.##6.47.204':445
- '67.##6.57.168':445
- '67.##6.112.199':445
- '67.##6.105.81':445
- '67.##6.210.112':445
- '67.##6.45.13':445
- '67.##6.89.18':445
- '67.##6.156.22':445
- '67.##6.31.199':445
- '67.##6.184.166':139
- '67.#16.5.94':445
- '67.##6.66.235':445
- '67.##6.78.15':445
- '67.#16.47.3':445
- '67.##6.44.201':445
- '67.##6.255.157':445
- '67.##6.75.172':445
- '67.##6.82.206':445
- '67.##6.255.157':139
- '67.##6.37.186':445
- '67.##6.66.235':139
- '67.##6.89.18':139
- '67.##6.156.22':139
- '67.##6.75.172':139
- '67.##6.140.47':139
- '67.##6.82.206':139
- '67.#16.47.3':139
- '67.##6.44.201':139
- '67.##6.78.15':139
- '67.##6.82.150':445
- '67.##6.24.94':445
- '67.##6.104.217':445
- '67.##6.40.85':445
- '67.##6.130.40':445
- '67.##6.177.114':445
- '67.##6.77.220':445
- '67.##6.159.93':445
- '67.##6.219.223':445
- '67.##6.131.131':445
- '67.##6.181.27':445
- '67.##6.84.233':445
- '67.##6.71.102':445
- '67.##6.142.204':445
- '67.##6.102.126':445
- '67.##6.172.149':445
- '67.##6.126.117':445
- '67.##6.97.87':445
- '67.##6.189.148':445
- '67.##6.233.189':445
- '67.##6.162.130':445
- '67.#16.7.24':445
- '67.##6.216.143':445
- '67.##6.24.120':445
- '67.##6.85.254':445
- '67.##6.24.33':445
- '67.##6.149.32':445
- '67.##6.192.29':445
- '67.##6.108.18':445
- '67.##6.170.29':445
- '67.##6.30.86':445
- '67.##6.18.96':445
- '67.##6.192.42':445
- '67.##6.118.150':445
- '67.##6.6.121':445
- '67.##6.129.28':445
- '67.##6.58.10':445
- '67.##6.147.109':445
- '67.##6.93.140':445
- '67.##6.214.34':445
- '67.##6.218.132':445
- '67.##6.185.229':445
- '67.##6.26.211':445
- '67.##6.198.29':445
- '67.##6.157.70':445
- '67.##6.148.112':445
- '67.##6.140.47':445
- '67.##6.246.120':445
- '67.##6.78.115':445
- '67.##6.224.226':445
- '67.##6.228.29':445
- '67.##6.34.198':445
- '67.##6.88.98':445
- '67.##6.182.198':445
- '67.##6.127.82':445
- '67.##6.74.151':445
- '67.##6.188.18':445
- '67.##6.175.235':445
- '67.#16.41.5':445
- '67.##6.231.22':445
- '67.##6.149.180':445
- '67.##6.64.240':445
- '67.##6.6.112':445
- '67.##6.234.5':445
- '67.##6.169.149':445
- '67.##6.88.48':445
- '67.##6.52.116':445
- '67.##6.56.122':445
- '67.##6.151.169':445
- '67.##6.206.62':445
- '67.##6.219.115':139
- '67.##6.47.219':139
- '67.##6.116.47':139
- '67.##6.177.69':139
- '67.##6.46.177':139
- '67.##6.95.147':139
- '67.##6.230.96':139
- '67.##6.235.128':139
- '67.##6.207.223':139
- '67.##6.150.4':139
- '67.##6.190.68':139
- '67.##6.51.206':139
- '67.##6.189.209':445
- '67.##6.92.189':445
- '67.##6.103.89':445
- '67.##6.42.225':445
- '67.##6.223.212':445
- '67.##6.80.231':445
- '67.##6.52.143':445
- '67.##6.245.166':139
- '67.##6.0.219':445
- '67.##6.88.222':445
- '67.##6.113.113':445
- '67.##6.88.48':139
- '67.##6.52.116':139
- '67.##6.56.122':139
- '67.##6.151.169':139
- '67.##6.206.62':139
- '67.#16.41.5':139
- '67.##6.246.120':139
- '67.##6.78.115':139
- '67.##6.224.226':139
- '67.##6.228.29':139
- '67.##6.34.198':139
- '67.##6.169.149':139
- '67.##6.215.150':139
- '67.##6.189.158':139
- '67.##6.254.130':139
- '67.##6.184.166':445
- '67.##6.131.186':139
- '67.##6.111.119':139
- '67.##6.231.22':139
- '67.##6.149.180':139
- '67.##6.64.240':139
- '67.##6.6.112':139
- '67.##6.234.5':139
- '67.##6.113.113':139
- '67.##6.0.219':139
- '67.##6.88.222':139
- '67.##6.92.189':139
- '67.##6.80.231':139
- '67.##6.52.143':139
- '67.##6.189.158':445
- '67.##6.111.119':445
- '67.##6.215.150':445
- '67.##6.131.186':445
- '67.##6.254.130':445
- '67.##6.189.209':139
- '67.##6.74.151':139
- '67.##6.182.198':139
- '67.##6.175.235':139
- '67.##6.88.98':139
- '67.##6.188.18':139
- '67.##6.127.82':139
- '67.##6.20.60':445
- '67.##6.103.89':139
- '67.##6.20.60':139
- '67.##6.42.225':139
- '67.##6.223.212':139
- '67.##6.150.248':445
- '67.##6.217.200':445
- '67.##6.115.39':445
- '67.##6.167.180':445
- '67.##6.39.167':445
- '67.##6.51.43':445
- '67.##6.28.236':445
- '67.##6.218.22':445
- '67.##6.173.95':445
- '67.##6.65.117':445
- '67.##6.23.186':445
- '67.##6.255.7':445
- '67.##6.34.186':139
- '67.##6.26.28':139
- '67.##6.20.245':139
- '67.##6.125.84':139
- '67.##6.73.224':139
- '67.##6.135.9':445
- '67.##6.54.54':445
- '67.##6.224.95':445
- '67.##6.40.80':445
- '67.##6.80.54':445
- '67.##6.166.40':445
- '67.##6.151.20':445
- '67.##6.180.151':445
- '67.##6.125.232':445
- '67.##6.215.103':445
- '67.##6.90.15':445
- '67.##6.154.180':445
- '67.##6.109.175':445
- '67.##6.42.36':445
- '67.##6.78.161':445
- '67.##6.64.154':445
- '67.##6.136.110':445
- '67.##6.185.193':445
- '67.##6.55.216':445
- '67.##6.242.1':445
- '67.##6.242.53':445
- '67.##6.225.133':445
- '67.##6.53.225':445
- '67.##6.73.106':445
- '67.##6.68.58':445
- '67.##6.125.14':445
- '67.##6.21.239':445
- '67.##6.7.108':445
- '67.##6.48.149':445
- '67.##6.173.95':139
- '67.##6.28.236':139
- '67.##6.23.186':139
- '67.##6.51.43':139
- '67.##6.65.117':139
- '67.##6.218.22':139
- '67.##6.55.216':139
- '67.##6.242.1':139
- '67.##6.242.53':139
- '67.##6.225.133':139
- '67.##6.53.225':139
- '67.##6.217.200':139
- '67.##6.135.9':139
- '67.##6.54.54':139
- '67.##6.166.40':139
- '67.##6.80.54':139
- '67.##6.40.80':139
- '67.##6.255.7':139
- '67.##6.115.39':139
- '67.##6.150.248':139
- '67.##6.39.167':139
- '67.##6.224.95':139
- '67.##6.167.180':139
- '67.##6.78.161':139
- '67.##6.109.175':139
- '67.##6.136.110':139
- '67.##6.154.180':139
- '67.##6.64.154':139
- '67.##6.42.36':139
- '67.##6.38.87':139
- '67.##6.224.219':139
- '67.#16.4.17':139
- '67.##6.53.209':139
- '67.##6.218.91':139
- '67.##6.180.151':139
- '67.##6.68.58':139
- '67.##6.21.239':139
- '67.##6.48.149':139
- '67.##6.73.106':139
- '67.##6.7.108':139
- '67.##6.125.14':139
- '67.##6.125.232':139
- '67.##6.151.20':139
- '67.##6.90.15':139
- '67.##6.185.193':139
- '67.##6.215.103':139
- '67.##6.53.209':445
- '67.##6.30.86':139
- '67.##6.85.254':139
- '67.##6.108.18':139
- '67.##6.105.110':139
- '67.##6.18.96':139
- '67.##6.192.29':139
- '67.##6.24.33':139
- '67.##6.106.4':139
- '67.##6.31.92':139
- '67.##6.254.169':139
- '67.##6.40.221':139
- '67.##6.149.32':139
- '67.##6.58.10':139
- '67.##6.218.132':139
- '67.##6.129.28':139
- '67.##6.159.93':139
- '67.##6.147.109':139
- '67.##6.157.70':139
- '67.##6.6.121':139
- '67.##6.26.211':139
- '67.##6.185.229':139
- '67.##6.148.112':139
- '67.##6.198.29':139
- '67.##6.249.37':139
- '67.##6.245.145':139
- '67.##6.178.145':139
- '67.##6.9.206':139
- '67.##6.199.83':139
- '67.##6.145.80':139
- '67.##6.193.237':445
- '67.##6.54.108':445
- '67.##6.2.181':445
- '67.##6.37.245':139
- '67.##6.73.28':445
- '67.##6.112.199':139
- '67.##6.170.29':139
- '67.##6.47.204':139
- '67.##6.224.92':139
- '67.##6.24.120':139
- '67.##6.192.42':139
- '67.##6.72.168':139
- '67.##6.105.81':139
- '67.##6.57.168':139
- '67.##6.118.150':139
- '67.##6.210.112':139
- '67.##6.45.13':139
- '67.##6.217.200':9988
- '67.##6.65.117':9988
- '67.##6.173.95':9988
- '67.##6.21.239':9988
- '67.##6.115.39':9988
- '67.##6.26.28':9988
- '67.##6.54.108':139
- '67.##6.172.149':139
- '67.##6.193.237':139
- '67.##6.73.28':139
- '67.##6.2.181':139
- '67.##6.224.95':9988
- '67.##6.224.219':445
- '67.##6.125.84':445
- '67.##6.38.87':445
- '67.##6.218.91':445
- '67.#16.4.17':445
- '67.##6.73.224':445
- '67.##6.150.248':9988
- '67.##6.73.106':9988
- '67.##6.26.28':445
- '67.##6.20.245':445
- '67.##6.34.186':445
- '67.##6.131.131':139
- '67.##6.24.94':139
- '67.##6.104.217':139
- '67.##6.130.40':139
- '67.##6.82.150':139
- '67.##6.181.27':139
- '67.##6.214.34':139
- '67.##6.93.140':139
- '67.##6.77.220':139
- '67.##6.177.114':139
- '67.##6.219.223':139
- '67.##6.40.85':139
- '67.#16.7.24':139
- '67.##6.162.130':139
- '67.##6.71.102':139
- '67.##6.126.117':139
- '67.##6.102.126':139
- '67.##6.97.87':139
- '67.##6.233.189':139
- '67.##6.84.233':139
- '67.##6.189.148':139
- '67.##6.142.204':139
- '67.##6.216.143':139