Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERe9a6.dir00\svchost.exe.mdmp 16325836412032076
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WERe9a6.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '82.##.63.135':139
- '82.##.159.93':139
- '82.##.208.186':139
- '82.##.27.238':139
- '82.##.239.166':139
- '82.##.77.131':139
- '82.#6.29.7':139
- '82.##.217.115':139
- '82.##.11.212':139
- '82.#6.77.93':139
- '82.##.42.214':139
- '82.##.238.218':139
- '82.##.195.130':139
- '82.#6.33.41':139
- '82.##.127.95':139
- '82.##.23.187':139
- '82.##.173.218':139
- '82.##.222.216':139
- '82.##.202.13':139
- '82.##.219.136':139
- '82.##.14.248':139
- '82.#6.37.34':139
- '82.##.124.159':139
- '82.#6.81.71':445
- '82.##.126.81':445
- '82.##.136.250':445
- '82.##.118.19':139
- '82.#6.66.26':445
- '82.##.93.169':445
- '82.#6.94.57':445
- '82.##.150.94':445
- '82.##.56.160':445
- '82.##.114.177':445
- '82.##.160.114':445
- '82.#6.62.56':139
- '82.##.241.242':139
- '82.#6.86.75':139
- '82.##.243.34':139
- '82.#6.129.4':139
- '82.#6.13.78':139
- '82.##.18.160':139
- '82.##.229.231':139
- '82.##.55.230':139
- '82.##.247.47':139
- '82.##.154.32':139
- '82.#6.27.56':139
- '82.#6.86.28':445
- '82.##.16.154':445
- '82.##.122.18':445
- '82.##.63.250':445
- '82.##.240.198':445
- '82.##.254.144':445
- '82.##.184.156':445
- '82.##.117.150':445
- '82.##.182.241':445
- '82.#6.6.34':445
- '82.##.201.184':445
- '82.##.231.126':445
- '82.##.232.254':445
- '82.##.207.187':445
- '82.##.217.94':445
- '82.##.115.205':445
- '82.##.254.237':445
- '82.#6.187.7':445
- '82.##.73.122':445
- '82.##.190.211':445
- '82.#6.8.16':445
- '82.#6.5.43':445
- '82.##.149.233':445
- '82.##.56.160':139
- '82.#6.94.57':139
- '82.##.160.114':139
- '82.##.93.169':139
- '82.##.114.177':139
- '82.##.150.94':139
- '82.##.99.187':139
- '82.##.187.84':139
- '82.#6.1.13':139
- '82.##.135.180':139
- '82.##.169.119':139
- '82.##.126.81':139
- '82.##.240.56':445
- '82.##.155.23':445
- '82.#6.63.82':445
- '82.##.120.157':445
- '82.##.158.31':445
- '82.##.161.175':445
- '82.##.136.250':139
- '82.#6.81.71':139
- '82.#6.66.26':139
- '82.##.149.102':445
- '82.##.83.222':445
- '82.##.240.205':139
- '82.##.148.104':139
- '82.##.225.116':139
- '82.#6.53.20':139
- '82.##.130.230':139
- '82.##.165.20':139
- '82.#6.43.90':139
- '82.##.11.253':139
- '82.##.188.178':139
- '82.#6.15.18':139
- '82.##.156.206':139
- '82.##.148.156':139
- '82.#6.72.3':139
- '82.##.152.92':139
- '82.#6.53.59':139
- '82.#6.235.0':139
- '82.##.19.219':139
- '82.##.207.201':139
- '82.##.180.241':139
- '82.##.108.49':139
- '82.##.198.156':139
- '82.##.245.184':139
- '82.##.75.246':139
- '82.##.162.232':139
- '82.##.194.60':139
- '82.##.70.194':139
- '82.##.223.230':139
- '82.##.40.223':139
- '82.##.106.133':139
- '82.##.136.90':139
- '82.##.103.59':139
- '82.##.89.182':139
- '82.##.240.135':139
- '82.##.182.93':139
- '82.##.61.156':139
- '82.##.23.157':139
- '82.##.241.15':139
- '82.##.41.223':139
- '82.##.140.128':139
- '82.##.31.218':139
- '82.##.185.42':139
- '82.##.179.113':139
- '82.#6.145.9':139
- '82.#6.113.9':139
- '82.##.188.185':139
- '82.##.123.133':139
- '82.##.219.136':445
- '82.##.238.218':445
- '82.##.202.13':445
- '82.##.124.159':445
- '82.##.14.248':445
- '82.##.27.238':445
- '82.##.159.93':445
- '82.##.77.131':445
- '82.##.63.135':445
- '82.##.239.166':445
- '82.##.208.186':445
- '82.#6.37.34':445
- '82.##.99.187':445
- '82.##.187.84':445
- '82.#6.1.13':445
- '82.##.135.180':445
- '82.##.169.119':445
- '82.##.23.187':445
- '82.#6.33.41':445
- '82.##.222.216':445
- '82.##.195.130':445
- '82.##.173.218':445
- '82.##.127.95':445
- '82.##.55.230':445
- '82.#6.62.56':445
- '82.##.229.231':445
- '82.#6.27.56':445
- '82.##.247.47':445
- '82.##.118.19':445
- '82.##.74.122':139
- '82.##.50.119':139
- '82.#6.0.134':139
- '82.#6.25.23':139
- '82.#6.1.73':139
- '82.##.154.32':445
- '82.#6.29.7':445
- '82.##.217.115':445
- '82.##.11.212':445
- '82.#6.77.93':445
- '82.##.42.214':445
- '82.#6.129.4':445
- '82.#6.86.75':445
- '82.##.18.160':445
- '82.##.241.242':445
- '82.#6.13.78':445
- '82.##.243.34':445
- '82.##.229.72':445
- '82.##.69.251':445
- '82.##.66.180':445
- '82.##.196.105':445
- '82.##.242.163':445
- '82.##.117.228':445
- '82.##.235.241':445
- '82.##.145.178':445
- '82.#6.75.60':445
- '82.##.214.246':445
- '82.##.132.235':445
- '82.##.216.164':445
- '82.##.64.188':445
- '82.##.145.41':139
- '82.#6.71.69':139
- '82.##.41.241':139
- '82.##.166.112':139
- '82.##.121.227':139
- '82.##.120.123':445
- '82.##.200.36':445
- '82.##.187.158':445
- '82.#6.69.61':445
- '82.##.236.102':445
- '82.##.61.177':445
- '82.##.229.226':445
- '82.##.74.197':445
- '82.##.74.221':445
- '82.##.171.73':445
- '82.#6.28.6':445
- '82.#6.37.10':445
- '82.##.114.93':445
- '82.##.27.242':445
- '82.##.92.198':445
- '82.##.203.240':445
- '82.##.198.144':445
- '82.##.160.47':445
- '82.##.198.14':445
- '82.#6.81.17':445
- '82.#6.14.44':445
- '82.##.138.75':445
- '82.#6.8.14':445
- '82.##.83.254':445
- '82.##.46.249':445
- '82.#6.10.33':445
- '82.##.169.87':445
- '82.##.82.189':445
- '82.##.208.248':445
- '82.##.214.246':139
- '82.##.145.178':139
- '82.##.216.164':139
- '82.##.235.241':139
- '82.##.132.235':139
- '82.#6.75.60':139
- '82.##.198.14':139
- '82.#6.81.17':139
- '82.#6.14.44':139
- '82.##.138.75':139
- '82.#6.8.14':139
- '82.##.66.180':139
- '82.#6.69.61':139
- '82.##.200.36':139
- '82.##.61.177':139
- '82.##.236.102':139
- '82.##.120.123':139
- '82.##.187.158':139
- '82.##.196.105':139
- '82.##.69.251':139
- '82.##.117.228':139
- '82.##.64.188':139
- '82.##.242.163':139
- '82.##.92.198':139
- '82.##.114.93':139
- '82.##.198.144':139
- '82.#6.37.10':139
- '82.##.203.240':139
- '82.##.27.242':139
- '82.##.252.175':139
- '82.##.209.160':139
- '82.#6.176.5':139
- '82.##.142.172':139
- '82.##.111.30':139
- '82.##.74.197':139
- '82.##.169.87':139
- '82.##.46.249':139
- '82.##.208.248':139
- '82.##.83.254':139
- '82.##.82.189':139
- '82.##.160.47':139
- '82.##.74.221':139
- '82.##.229.226':139
- '82.##.171.73':139
- '82.#6.10.33':139
- '82.#6.28.6':139
- '82.##.184.156':139
- '82.##.201.184':139
- '82.##.254.144':139
- '82.#6.86.28':139
- '82.#6.6.34':139
- '82.##.182.241':139
- '82.##.161.175':139
- '82.##.240.56':139
- '82.##.158.31':139
- '82.##.117.150':139
- '82.##.120.157':139
- '82.##.16.154':139
- '82.##.254.237':139
- '82.##.217.94':139
- '82.##.207.187':139
- '82.#6.8.16':139
- '82.#6.187.7':139
- '82.##.232.254':139
- '82.##.63.250':139
- '82.##.122.18':139
- '82.##.240.198':139
- '82.##.149.233':139
- '82.##.231.126':139
- '82.#6.71.22':445
- '82.##.232.91':445
- '82.##.54.124':445
- '82.#6.13.62':445
- '82.##.35.202':445
- '82.##.241.210':445
- '82.#6.23.6':445
- '82.##.142.208':445
- '82.#6.0.216':445
- '82.#6.33.29':445
- '82.#6.91.58':445
- '82.##.124.148':445
- '82.##.149.102':139
- '82.#6.54.29':445
- '82.##.155.23':139
- '82.##.83.222':139
- '82.#6.63.82':139
- '82.#6.90.91':445
- '82.##.219.113':445
- '82.##.225.126':445
- '82.##.167.79':445
- '82.##.79.224':445
- '82.##.134.93':445
- '82.##.138.75':9988
- '82.#6.10.33':9988
- '82.##.74.221':9988
- '82.##.242.163':9988
- '82.##.132.235':9988
- '82.##.117.228':9988
- '82.##.64.188':9988
- '82.#6.90.91':139
- '82.##.120.123':9988
- '82.##.216.164':9988
- '82.##.200.36':9988
- '82.#6.8.14':9988
- '82.##.252.175':445
- '82.##.209.160':445
- '82.#6.176.5':445
- '82.##.142.172':445
- '82.##.111.30':445
- '82.##.166.112':445
- '82.#6.71.69':445
- '82.##.236.102':9988
- '82.##.145.41':445
- '82.##.121.227':445
- '82.##.41.241':445
- '82.#6.0.216':139
- '82.##.73.122':139
- '82.##.241.210':139
- '82.#6.33.29':139
- '82.#6.91.58':139
- '82.##.229.72':139
- '82.##.190.211':139
- '82.#6.5.43':139
- '82.##.115.205':139
- '82.#6.23.6':139
- '82.##.142.208':139
- '82.#6.71.22':139
- '82.##.167.79':139
- '82.##.219.113':139
- '82.##.79.224':139
- '82.#6.54.29':139
- '82.##.134.93':139
- '82.##.225.126':139
- '82.##.35.202':139
- '82.##.54.124':139
- '82.##.232.91':139
- '82.##.124.148':139
- '82.#6.13.62':139