Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WERb689.dir00\svchost.exe.mdmp 16325836412032552
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WERb689.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '81.##6.13.45':445
- '81.##6.232.43':445
- '81.##6.94.34':445
- '81.##6.60.251':445
- '81.##6.162.24':445
- '81.##6.3.132':139
- '81.##6.139.79':139
- '81.##6.80.113':445
- '81.##6.203.0':139
- '81.##6.49.41':445
- '81.##6.58.174':445
- '81.##6.8.170':445
- '81.##6.174.104':445
- '81.##6.174.240':445
- '81.##6.188.97':445
- '81.##6.234.164':445
- '81.##6.40.235':445
- '81.##6.69.113':445
- '81.##6.164.231':445
- '81.##6.9.149':139
- '81.##6.15.219':139
- '81.##6.247.167':139
- '81.##6.40.173':139
- '81.##6.219.191':139
- '81.##6.57.238':139
- '81.##6.169.143':139
- '81.##6.60.105':139
- '81.##6.250.19':139
- '81.##6.203.249':139
- '81.##6.103.241':139
- '81.##6.249.53':139
- '81.##6.18.160':139
- '81.##6.31.12':139
- '81.##6.71.85':139
- '81.##6.62.164':139
- '81.##6.61.76':139
- '81.##6.112.128':139
- '81.##6.146.62':139
- '81.##6.236.145':139
- '81.##6.200.182':445
- '81.##6.218.7':445
- '81.##6.23.11':445
- '81.##6.83.30':445
- '81.##6.73.162':445
- '81.##6.95.188':445
- '81.##6.242.88':445
- '81.##6.56.137':445
- '81.##6.139.132':445
- '81.##6.89.124':445
- '81.##6.11.54':445
- '81.##6.232.43':139
- '81.##6.162.24':139
- '81.##6.60.251':139
- '81.##6.13.45':139
- '81.##6.80.113':139
- '81.##6.226.244':445
- '81.##6.67.227':445
- '81.##6.151.172':445
- '81.##6.236.215':445
- '81.##6.132.55':445
- '81.##6.31.197':445
- '81.##6.8.154':445
- '81.#96.87.4':445
- '81.##6.152.132':445
- '81.##6.173.15':445
- '81.##6.220.95':445
- '81.##6.112.148':445
- '81.##6.245.172':445
- '81.##6.141.227':445
- '81.##6.29.21':445
- '81.##6.124.23':445
- '81.##6.242.161':445
- '81.##6.18.140':445
- '81.##6.101.147':445
- '81.##6.37.17':445
- '81.##6.158.48':445
- '81.##6.218.140':445
- '81.##6.154.36':445
- '81.##6.217.71':445
- '81.#96.15.7':445
- '81.##6.6.251':445
- '81.##6.60.105':445
- '81.##6.240.157':445
- '81.##6.81.106':445
- '81.##6.98.53':445
- '81.##6.174.97':445
- '81.##6.169.68':445
- '81.##6.1.101':445
- '81.##6.169.143':445
- '81.##6.40.173':445
- '81.##6.219.191':445
- '81.##6.112.128':445
- '81.##6.103.241':445
- '81.##6.15.219':445
- '81.##6.250.19':445
- '81.##6.203.249':445
- '81.##6.247.167':445
- '81.##6.57.238':445
- '81.##6.1.104':445
- '81.##6.45.101':445
- '81.##6.42.89':445
- '81.##6.127.66':445
- '81.##6.231.127':445
- '81.##6.3.232':445
- '81.##6.168.47':445
- '81.##6.220.38':445
- '81.##6.153.244':445
- '81.##6.41.174':445
- '81.##6.249.227':445
- '81.##6.156.42':445
- '81.##6.77.194':445
- '81.##6.137.204':445
- '81.##6.19.55':445
- '81.##6.124.153':445
- '81.##6.45.199':445
- '81.##6.37.106':445
- '81.##6.136.238':445
- '81.##6.55.44':445
- '81.##6.61.76':445
- '81.##6.77.194':139
- '81.##6.124.153':139
- '81.##6.19.55':139
- '81.##6.156.42':139
- '81.##6.136.238':139
- '81.##6.37.106':139
- '81.##6.249.227':139
- '81.##6.55.44':139
- '81.##6.45.199':139
- '81.##6.137.204':139
- '81.##6.6.251':139
- '81.##6.81.106':139
- '81.##6.240.157':139
- '81.#96.15.7':139
- '81.##6.169.68':139
- '81.##6.174.97':139
- '81.##6.1.104':139
- '81.##6.1.101':139
- '81.##6.98.53':139
- '81.##6.127.66':139
- '81.##6.31.12':445
- '81.##6.71.85':445
- '81.##6.139.79':445
- '81.##6.9.149':445
- '81.##6.249.53':445
- '81.##6.146.62':445
- '81.##6.236.145':445
- '81.##6.18.160':445
- '81.##6.62.164':445
- '81.##6.3.132':445
- '81.##6.42.89':139
- '81.##6.3.232':139
- '81.##6.231.127':139
- '81.##6.45.101':139
- '81.##6.153.244':139
- '81.##6.220.38':139
- '81.##6.203.0':445
- '81.##6.41.174':139
- '81.##6.168.47':139
- '81.##6.94.34':139
- '81.##6.178.203':445
- '81.##6.159.236':445
- '81.##6.53.74':139
- '81.##6.210.5':445
- '81.##6.255.245':445
- '81.##6.221.159':445
- '81.##6.58.173':445
- '81.##6.153.5':445
- '81.##6.172.251':445
- '81.##6.161.153':139
- '81.##6.26.101':139
- '81.##6.119.123':139
- '81.##6.135.173':139
- '81.##6.73.146':139
- '81.##6.221.114':139
- '81.##6.27.182':139
- '81.##6.169.18':139
- '81.##6.72.125':139
- '81.##6.12.150':139
- '81.##6.227.123':445
- '81.##6.200.74':445
- '81.##6.234.155':445
- '81.##6.172.216':445
- '81.##6.16.169':445
- '81.##6.220.223':445
- '81.##6.93.19':445
- '81.##6.225.116':445
- '81.##6.84.35':445
- '81.##6.219.8':445
- '81.##6.216.231':445
- '81.##6.64.73':445
- '81.##6.166.176':445
- '81.##6.236.23':445
- '81.##6.131.187':445
- '81.##6.84.249':445
- '81.##6.126.22':445
- '81.##6.196.84':445
- '81.##6.252.65':445
- '81.#96.9.67':445
- '81.##6.86.242':139
- '81.##6.252.65':139
- '81.##6.166.176':139
- '81.##6.58.173':139
- '81.##6.64.73':139
- '81.##6.84.249':139
- '81.##6.196.84':139
- '81.##6.216.231':139
- '81.#96.9.67':139
- '81.##6.126.22':139
- '81.##6.227.123':139
- '81.##6.159.236':139
- '81.##6.210.5':139
- '81.##6.131.187':139
- '81.##6.221.159':139
- '81.##6.255.245':139
- '81.##6.178.203':139
- '81.##6.236.23':139
- '81.##6.153.5':139
- '81.##6.172.251':139
- '81.##6.172.216':139
- '81.##6.140.86':139
- '81.##6.216.248':139
- '81.##6.68.210':139
- '81.##6.36.111':139
- '81.##6.232.239':139
- '81.##6.90.134':139
- '81.##6.22.105':139
- '81.##6.90.252':139
- '81.##6.222.148':139
- '81.##6.67.166':139
- '81.##6.234.155':139
- '81.##6.84.35':139
- '81.##6.16.169':139
- '81.##6.200.74':139
- '81.##6.220.223':139
- '81.##6.225.116':139
- '81.##6.211.104':139
- '81.##6.219.8':139
- '81.##6.93.19':139
- '81.##6.242.161':139
- '81.##6.37.17':139
- '81.##6.101.147':139
- '81.##6.124.23':139
- '81.##6.154.36':139
- '81.##6.218.140':139
- '81.##6.29.21':139
- '81.##6.217.71':139
- '81.##6.158.48':139
- '81.##6.18.140':139
- '81.##6.23.11':139
- '81.##6.95.188':139
- '81.##6.73.162':139
- '81.##6.218.7':139
- '81.##6.139.132':139
- '81.##6.56.137':139
- '81.##6.132.55':139
- '81.##6.89.124':139
- '81.##6.242.88':139
- '81.#96.87.4':139
- '81.##6.8.170':139
- '81.##6.188.97':139
- '81.##6.174.240':139
- '81.##6.58.174':139
- '81.##6.69.113':139
- '81.##6.40.235':139
- '81.##6.49.41':139
- '81.##6.164.231':139
- '81.##6.234.164':139
- '81.##6.174.104':139
- '81.##6.8.154':139
- '81.##6.173.15':139
- '81.##6.152.132':139
- '81.##6.31.197':139
- '81.##6.245.172':139
- '81.##6.112.148':139
- '81.##6.200.182':139
- '81.##6.141.227':139
- '81.##6.220.95':139
- '81.##6.83.30':139
- '81.##6.135.173':445
- '81.##6.26.101':445
- '81.##6.22.105':445
- '81.##6.86.242':445
- '81.##6.73.146':445
- '81.##6.72.125':445
- '81.##6.12.150':445
- '81.##6.119.123':445
- '81.##6.221.114':445
- '81.##6.90.134':445
- '81.##6.68.210':445
- '81.##6.36.111':445
- '81.##6.211.104':445
- '81.##6.67.166':445
- '81.##6.140.86':445
- '81.##6.90.252':445
- '81.##6.222.148':445
- '81.##6.216.248':445
- '81.##6.232.239':445
- '81.##6.27.182':445
- '81.##6.220.223':9988
- '81.##6.131.187':9988
- '81.##6.90.134':9988
- '81.##6.161.153':9988
- '81.##6.151.172':139
- '81.##6.67.227':139
- '81.##6.11.54':139
- '81.##6.236.215':139
- '81.##6.226.244':139
- '81.##6.210.5':9988
- '81.##6.53.74':445
- '81.##6.252.65':9988
- '81.##6.169.18':445
- '81.##6.161.153':445
- '81.##6.178.203':9988
- '81.##6.236.23':9988
- '81.##6.84.249':9988
- '81.##6.90.252':9988
- '81.##6.227.123':9988