Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %TEMP%\WER6a84.dir00\svchost.exe.mdmp 16325836412032828
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER6a84.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '21#.#3.34.225':445
- '21#.#3.120.80':445
- '21#.#3.181.49':445
- '21#.#3.221.0':445
- '21#.#3.7.157':445
- '21#.#3.208.3':139
- '21#.#3.74.204':139
- '21#.#3.27.171':445
- '21#.#3.78.28':139
- '21#.#3.167.191':445
- '21#.#3.225.238':445
- '21#.#3.22.70':445
- '21#.#3.126.186':445
- '21#.#3.109.127':445
- '21#.#3.215.105':445
- '21#.#3.21.238':445
- '21#.#3.247.12':445
- '21#.#3.246.214':445
- '21#.#3.163.241':445
- '21#.#3.219.74':139
- '21#.#3.26.205':139
- '21#.#3.87.201':139
- '21#.#3.220.212':139
- '21#.#3.220.7':139
- '21#.#3.11.205':139
- '21#.#3.3.120':139
- '21#.#3.4.129':139
- '21#.#3.102.12':139
- '21#.#3.42.208':139
- '21#.#3.39.160':139
- '21#.#3.96.118':139
- '21#.#3.109.48':139
- '21#.#3.103.133':139
- '21#.#3.186.87':139
- '21#.#3.184.170':139
- '21#.#3.160.240':139
- '21#.#3.251.68':139
- '21#.#3.128.212':139
- '21#.#3.172.107':139
- '21#.#3.187.31':445
- '21#.#3.79.160':445
- '21#.#3.110.101':445
- '21#.#3.34.118':445
- '21#.#3.196.218':445
- '21#.#3.162.148':445
- '21#.#3.5.194':445
- '21#.#3.24.156':445
- '21#.#3.19.223':445
- '21#.#3.77.173':445
- '21#.#3.84.112':445
- '21#.#3.120.80':139
- '21#.#3.7.157':139
- '21#.#3.221.0':139
- '21#.#3.34.225':139
- '21#.#3.27.171':139
- '21#.#3.107.159':445
- '21#.#3.103.99':445
- '21#.#3.74.101':445
- '21#.#3.45.158':445
- '21#.#3.146.253':445
- '21#.#3.69.53':445
- '21#.#3.248.181':445
- '21#.#3.23.26':445
- '21#.#3.221.204':445
- '21#.#3.29.37':445
- '21#.#3.164.246':445
- '21#.#3.44.49':445
- '21#.#3.71.136':445
- '21#.#3.117.197':445
- '21#.#3.191.187':445
- '21#.#3.60.175':445
- '21#.#3.196.53':445
- '21#.#3.218.22':445
- '21#.#3.125.46':445
- '21#.#3.81.52':445
- '21#.#3.208.5':445
- '21#.#3.202.133':445
- '21#.#3.193.3':445
- '21#.#3.15.163':445
- '21#.#3.34.152':445
- '21#.#3.133.211':445
- '21#.#3.4.129':445
- '21#.#3.149.82':445
- '21#.#3.83.134':445
- '21#.#3.247.100':445
- '21#.#3.19.69':445
- '21#.#3.22.83':445
- '21#.#3.173.21':445
- '21#.#3.3.120':445
- '21#.#3.220.212':445
- '21#.#3.220.7':445
- '21#.#3.251.68':445
- '21#.#3.39.160':445
- '21#.#3.26.205':445
- '21#.#3.102.12':445
- '21#.#3.42.208':445
- '21#.#3.87.201':445
- '21#.#3.11.205':445
- '21#.#3.249.39':445
- '21#.#3.203.37':445
- '21#.#3.192.203':445
- '21#.#3.123.37':445
- '21#.#3.31.30':445
- '21#.#3.233.148':445
- '21#.#3.104.14':445
- '21#.#3.32.107':445
- '21#.#3.13.49':445
- '21#.#3.14.110':445
- '21#.#3.46.143':445
- '21#.#3.25.21':445
- '21#.#3.205.62':445
- '21#.#3.55.59':445
- '21#.#3.47.201':445
- '21#.#3.58.241':445
- '21#.#3.123.5':445
- '21#.#3.218.246':445
- '21#.#3.216.173':445
- '21#.#3.193.246':445
- '21#.#3.160.240':445
- '21#.#3.205.62':139
- '21#.#3.58.241':139
- '21#.#3.47.201':139
- '21#.#3.25.21':139
- '21#.#3.216.173':139
- '21#.#3.218.246':139
- '21#.#3.46.143':139
- '21#.#3.193.246':139
- '21#.#3.123.5':139
- '21#.#3.55.59':139
- '21#.#3.133.211':139
- '21#.#3.83.134':139
- '21#.#3.149.82':139
- '21#.#3.34.152':139
- '21#.#3.22.83':139
- '21#.#3.19.69':139
- '21#.#3.249.39':139
- '21#.#3.173.21':139
- '21#.#3.247.100':139
- '21#.#3.123.37':139
- '21#.#3.103.133':445
- '21#.#3.186.87':445
- '21#.#3.74.204':445
- '21#.#3.219.74':445
- '21#.#3.96.118':445
- '21#.#3.128.212':445
- '21#.#3.172.107':445
- '21#.#3.109.48':445
- '21#.#3.184.170':445
- '21#.#3.208.3':445
- '21#.#3.192.203':139
- '21#.#3.233.148':139
- '21#.#3.31.30':139
- '21#.#3.203.37':139
- '21#.#3.13.49':139
- '21#.#3.32.107':139
- '21#.#3.78.28':445
- '21#.#3.14.110':139
- '21#.#3.104.14':139
- '21#.#3.120.76':445
- '21#.#3.231.145':445
- '21#.#3.51.130':139
- '21#.#3.30.221':445
- '21#.#3.115.182':445
- '21#.#3.122.211':445
- '21#.#3.181.147':445
- '21#.#3.197.213':445
- '21#.#3.254.108':445
- '21#.#3.94.190':139
- '21#.73.6.48':139
- '21#.#3.103.208':139
- '21#.#3.91.45':139
- '21#.#3.212.142':139
- '21#.#3.218.152':139
- '21#.#3.44.144':139
- '21#.#3.136.229':139
- '21#.#3.135.218':139
- '21#.#3.20.135':139
- '21#.#3.19.42':445
- '21#.#3.209.56':445
- '21#.#3.51.209':445
- '21#.#3.76.200':445
- '21#.#3.37.37':445
- '21#.73.4.42':445
- '21#.#3.156.73':445
- '21#.#3.114.94':445
- '21#.#3.254.130':445
- '21#.#3.9.111':445
- '21#.#3.55.246':445
- '21#.#3.129.133':445
- '21#.#3.89.169':445
- '21#.#3.192.252':445
- '21#.#3.100.48':445
- '21#.#3.135.89':445
- '21#.#3.46.115':445
- '21#.#3.20.71':445
- '21#.#3.51.135':445
- '21#.#3.115.51':445
- '21#.#3.190.214':139
- '21#.#3.89.169':139
- '21#.#3.135.89':139
- '21#.#3.100.48':139
- '21#.#3.129.133':139
- '21#.#3.51.135':139
- '21#.#3.20.71':139
- '21#.#3.55.246':139
- '21#.#3.115.51':139
- '21#.#3.46.115':139
- '21#.#3.192.252':139
- '21#.#3.120.76':139
- '21#.#3.115.182':139
- '21#.#3.231.145':139
- '21#.#3.30.221':139
- '21#.#3.254.108':139
- '21#.#3.181.147':139
- '21#.#3.19.42':139
- '21#.#3.122.211':139
- '21#.#3.197.213':139
- '21#.#3.76.200':139
- '21#.#3.105.66':139
- '21#.#3.165.248':139
- '21#.#3.211.52':139
- '21#.#3.107.211':139
- '21#.#3.111.165':139
- '21#.#3.174.158':139
- '21#.#3.201.179':139
- '21#.#3.154.111':139
- '21#.#3.43.97':139
- '21#.73.20.6':139
- '21#.#3.51.209':139
- '21#.73.4.42':139
- '21#.#3.37.37':139
- '21#.#3.209.56':139
- '21#.#3.254.130':139
- '21#.#3.114.94':139
- '21#.#3.234.114':139
- '21#.#3.9.111':139
- '21#.#3.156.73':139
- '21#.#3.81.52':139
- '21#.#3.193.3':139
- '21#.#3.60.175':139
- '21#.#3.196.53':139
- '21#.#3.15.163':139
- '21#.#3.191.187':139
- '21#.#3.23.26':139
- '21#.#3.208.5':139
- '21#.#3.202.133':139
- '21#.#3.125.46':139
- '21#.#3.162.148':139
- '21#.#3.19.223':139
- '21#.#3.79.160':139
- '21#.#3.110.101':139
- '21#.#3.77.173':139
- '21#.#3.146.253':139
- '21#.#3.218.22':139
- '21#.#3.5.194':139
- '21#.#3.24.156':139
- '21#.#3.221.204':139
- '21#.#3.215.105':139
- '21#.#3.246.214':139
- '21#.#3.225.238':139
- '21#.#3.22.70':139
- '21#.#3.163.241':139
- '21#.#3.167.191':139
- '21#.#3.181.49':139
- '21#.#3.21.238':139
- '21#.#3.247.12':139
- '21#.#3.109.127':139
- '21#.#3.29.37':139
- '21#.#3.71.136':139
- '21#.#3.69.53':139
- '21#.#3.248.181':139
- '21#.#3.117.197':139
- '21#.#3.187.31':139
- '21#.#3.126.186':139
- '21#.#3.164.246':139
- '21#.#3.44.49':139
- '21#.#3.196.218':139
- '21#.#3.91.45':445
- '21#.#3.212.142':445
- '21#.#3.201.179':445
- '21#.#3.190.214':445
- '21#.73.6.48':445
- '21#.#3.135.218':445
- '21#.#3.20.135':445
- '21#.#3.103.208':445
- '21#.#3.218.152':445
- '21#.#3.174.158':445
- '21#.#3.211.52':445
- '21#.#3.107.211':445
- '21#.#3.234.114':445
- '21#.73.20.6':445
- '21#.#3.105.66':445
- '21#.#3.154.111':445
- '21#.#3.43.97':445
- '21#.#3.165.248':445
- '21#.#3.111.165':445
- '21#.#3.44.144':445
- '21#.#3.20.135':9988
- '21#.#3.74.101':139
- '21#.#3.91.45':9988
- '21#.73.6.48':9988
- '21#.#3.45.158':139
- '21#.#3.84.112':139
- '21#.#3.34.118':139
- '21#.#3.107.159':139
- '21#.#3.103.99':139
- '21#.#3.115.182':9988
- '21#.#3.51.130':445
- '21#.#3.37.37':9988
- '21#.#3.94.190':445
- '21#.#3.136.229':445
- '21#.#3.30.221':9988
- '21#.#3.181.147':9988
- '21#.#3.254.108':9988
- '21#.#3.231.145':9988
- '21#.#3.254.130':9988