Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WER9d94.dir00\svchost.exe.mdmp 16325836412032316
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER9d94.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '14.#28.19.7':139
- '14.##8.128.32':139
- '14.##8.63.74':139
- '14.##8.122.228':139
- '14.##8.35.222':139
- '14.##8.78.28':139
- '14.##8.86.225':139
- '14.##8.96.73':139
- '14.##8.29.59':139
- '14.##8.2.146':139
- '14.##8.228.163':139
- '14.##8.160.149':445
- '14.##8.112.252':445
- '14.##8.88.36':445
- '14.##8.159.105':445
- '14.##8.112.236':445
- '14.##8.105.209':445
- '14.##8.163.49':139
- '14.##8.43.165':445
- '14.##8.47.105':445
- '14.##8.131.164':445
- '14.##8.106.172':139
- '14.##8.6.112':139
- '14.##8.104.209':139
- '14.##8.74.195':139
- '14.##8.35.79':139
- '14.##8.163.49':445
- '14.##8.228.163':445
- '14.##8.236.225':139
- '14.##8.29.228':139
- '14.##8.124.107':139
- '14.##8.218.9':139
- '14.##8.49.95':139
- '14.##8.147.13':139
- '14.##8.213.39':139
- '14.##8.209.123':139
- '14.##8.39.38':139
- '14.##8.8.121':139
- '14.##8.22.39':139
- '14.##8.185.243':139
- '14.##8.66.145':139
- '14.##8.9.185':139
- '14.##8.249.157':139
- '14.##8.239.4':139
- '14.##8.29.186':139
- '14.##8.130.173':139
- '14.##8.199.130':139
- '14.##8.101.120':139
- '14.##8.204.180':139
- '14.##8.66.28':139
- '14.##8.185.126':139
- '14.##8.14.143':139
- '14.#28.4.34':445
- '14.##8.40.161':445
- '14.##8.147.29':445
- '14.##8.162.122':445
- '14.##8.247.64':445
- '14.##8.148.121':445
- '14.##8.212.150':445
- '14.##8.19.230':445
- '14.##8.113.158':445
- '14.##8.170.53':445
- '14.##8.168.223':445
- '14.##8.239.4':445
- '14.##8.185.126':445
- '14.##8.249.157':445
- '14.##8.199.130':445
- '14.##8.29.186':445
- '14.##8.204.180':445
- '14.##8.43.21':445
- '14.##8.101.120':445
- '14.##8.14.143':445
- '14.##8.66.28':445
- '14.##8.130.173':445
- '14.##8.88.36':139
- '14.##8.160.149':139
- '14.##8.112.236':139
- '14.##8.43.21':139
- '14.##8.159.105':139
- '14.##8.43.165':139
- '14.##8.105.209':139
- '14.##8.131.164':139
- '14.##8.112.252':139
- '14.##8.47.105':139
- '14.##8.80.184':445
- '14.##8.175.146':445
- '14.##8.80.145':445
- '14.##8.12.209':445
- '14.##8.45.185':445
- '14.##8.227.156':445
- '14.##8.91.114':445
- '14.##8.219.85':445
- '14.##8.178.158':445
- '14.##8.85.179':445
- '14.##8.186.174':445
- '14.##8.66.169':139
- '14.##8.22.141':139
- '14.#28.5.85':139
- '14.##8.91.114':139
- '14.##8.35.125':139
- '14.##8.222.235':445
- '14.##8.225.186':445
- '14.##8.67.105':445
- '14.##8.102.74':139
- '14.##8.136.102':139
- '14.##8.52.119':139
- '14.##8.219.224':139
- '14.##8.114.2':139
- '14.##8.118.149':139
- '14.##8.2.119':139
- '14.##8.40.122':139
- '14.##8.34.120':139
- '14.##8.10.147':139
- '14.##8.56.241':139
- '14.##8.184.56':139
- '14.##8.32.45':139
- '14.##8.22.141':445
- '14.##8.102.74':445
- '14.##8.66.169':445
- '14.##8.35.125':445
- '14.#28.5.85':445
- '14.##8.200.121':139
- '14.##8.158.167':139
- '14.#28.8.80':139
- '14.##8.136.102':445
- '14.##8.227.185':139
- '14.##8.147.13':445
- '14.##8.66.145':445
- '14.##8.49.95':445
- '14.##8.39.38':445
- '14.##8.213.39':445
- '14.##8.22.39':445
- '14.##8.218.9':445
- '14.##8.8.121':445
- '14.##8.9.185':445
- '14.##8.185.243':445
- '14.##8.209.123':445
- '14.#28.19.7':445
- '14.##8.128.32':445
- '14.##8.63.74':445
- '14.##8.122.228':445
- '14.##8.35.222':445
- '14.##8.78.28':445
- '14.##8.86.225':445
- '14.##8.96.73':445
- '14.##8.29.59':445
- '14.##8.2.146':445
- '14.##8.80.145':139
- '14.##8.80.184':139
- '14.##8.45.185':139
- '14.##8.186.174':139
- '14.##8.12.209':139
- '14.##8.219.85':139
- '14.##8.227.156':139
- '14.##8.85.179':139
- '14.##8.175.146':139
- '14.##8.178.158':139
- '14.##8.225.186':139
- '14.##8.106.172':445
- '14.##8.6.112':445
- '14.##8.104.209':445
- '14.##8.74.195':445
- '14.##8.35.79':445
- '14.##8.67.105':139
- '14.##8.222.235':139
- '14.##8.236.225':445
- '14.##8.29.228':445
- '14.##8.124.107':445
- '14.##8.110.203':445
- '14.##8.28.132':445
- '14.##8.135.28':445
- '14.##8.131.167':445
- '14.##8.87.178':445
- '14.##8.167.210':445
- '14.##8.219.18':445
- '14.##8.132.219':445
- '14.##8.22.30':445
- '14.##8.147.111':445
- '14.##8.36.12':445
- '14.##8.40.140':445
- '14.##8.89.133':139
- '14.##8.123.238':139
- '14.##8.106.135':139
- '14.##8.249.244':139
- '14.##8.181.241':139
- '14.##8.164.45':139
- '14.##8.82.191':445
- '14.##8.19.173':139
- '14.#28.7.1':139
- '14.##8.163.162':139
- '14.#28.7.61':445
- '14.##8.202.139':445
- '14.##8.76.38':445
- '14.##8.46.220':445
- '14.##8.115.246':445
- '14.#28.69.5':445
- '14.##8.111.115':445
- '14.##8.206.107':445
- '14.##8.86.108':445
- '14.##8.182.155':445
- '14.##8.2.122':445
- '14.##8.111.147':445
- '14.##8.250.190':445
- '14.##8.156.192':445
- '14.##8.85.216':445
- '14.##8.216.179':445
- '14.#28.4.32':445
- '14.##8.174.245':445
- '14.##8.118.123':445
- '14.##8.155.250':445
- '14.##8.16.242':445
- '14.##8.156.192':139
- '14.##8.111.147':139
- '14.##8.216.179':139
- '14.##8.132.219':139
- '14.##8.85.216':139
- '14.##8.118.123':139
- '14.#28.4.32':139
- '14.##8.16.242':139
- '14.##8.250.190':139
- '14.##8.155.250':139
- '14.##8.219.18':139
- '14.##8.40.140':139
- '14.##8.131.167':139
- '14.##8.82.191':139
- '14.##8.87.178':139
- '14.##8.167.210':139
- '14.##8.36.12':139
- '14.##8.22.30':139
- '14.##8.147.111':139
- '14.##8.28.132':139
- '14.##8.135.28':139
- '14.##8.21.227':139
- '14.##8.15.106':139
- '14.##8.43.205':139
- '14.##8.111.115':139
- '14.#28.12.3':139
- '14.##8.81.185':139
- '14.##8.126.116':139
- '14.##8.185.98':139
- '14.##8.21.47':139
- '14.##8.72.38':139
- '14.#28.69.5':139
- '14.##8.115.246':139
- '14.##8.76.38':139
- '14.##8.46.220':139
- '14.##8.174.245':139
- '14.##8.2.122':139
- '14.##8.182.155':139
- '14.##8.206.107':139
- '14.##8.86.108':139
- '14.#28.7.61':139
- '14.##8.202.139':139
- '14.##8.162.122':139
- '14.##8.40.161':139
- '14.##8.148.121':139
- '14.##8.110.203':139
- '14.##8.247.64':139
- '14.##8.113.158':139
- '14.##8.19.230':139
- '14.##8.168.223':139
- '14.##8.147.29':139
- '14.##8.170.53':139
- '14.##8.183.194':139
- '14.##8.242.114':139
- '14.##8.155.170':139
- '14.##8.19.133':139
- '14.##8.251.221':139
- '14.#28.91.4':139
- '14.##8.48.196':139
- '14.##8.146.183':139
- '14.##8.179.0':139
- '14.##8.2.241':139
- '14.##8.224.191':139
- '14.##8.155.170':445
- '14.##8.2.241':445
- '14.##8.242.114':445
- '14.#28.91.4':445
- '14.##8.19.133':445
- '14.##8.146.183':445
- '14.##8.183.194':445
- '14.##8.48.196':445
- '14.##8.224.191':445
- '14.##8.179.0':445
- '14.##8.251.221':445
- '14.##8.75.19':445
- '14.##8.53.222':445
- '14.##8.43.188':445
- '14.##8.212.150':139
- '14.#28.4.34':139
- '14.##8.82.81':445
- '14.##8.164.58':445
- '14.##8.204.60':445
- '14.##8.38.54':445
- '14.##8.62.205':445
- '14.#28.7.1':445
- '14.##8.163.162':445
- '14.##8.123.238':445
- '14.##8.106.135':445
- '14.##8.89.133':445
- '14.##8.28.132':9988
- '14.##8.87.178':9988
- '14.##8.82.191':9988
- '14.##8.19.173':445
- '14.##8.164.45':445
- '14.##8.181.241':445
- '14.##8.15.106':445
- '14.##8.21.47':445
- '14.##8.21.227':445
- '14.#28.12.3':445
- '14.##8.43.205':445
- '14.##8.126.116':445
- '14.##8.249.244':445
- '14.##8.81.185':445
- '14.##8.72.38':445
- '14.##8.185.98':445
- '14.##8.75.19':139
- '14.##8.53.222':139
- '14.##8.43.188':139
- '14.##8.111.115':9988
- '14.##8.106.135':9988
- '14.##8.82.81':139
- '14.##8.164.58':139
- '14.##8.204.60':139
- '14.##8.38.54':139
- '14.##8.62.205':139
- '14.##8.86.108':9988
- '14.##8.111.147':9988
- '14.##8.2.122':9988
- '14.##8.156.192':9988
- '14.##8.36.12':9988
- '14.##8.216.179':9988
- '14.#28.7.61':9988
- '14.##8.202.139':9988
- '14.##8.76.38':9988
- '14.##8.46.220':9988
- '14.##8.115.246':9988