Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1128 -dm 7 7 %TEMP%\WER50b0.dir00\svchost.exe.mdmp 16325836412032732
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER50b0.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '60.##0.171.174':445
- '60.##0.0.229':445
- '60.##0.174.145':445
- '60.##0.60.75':445
- '60.##0.142.184':445
- '60.##0.233.76':445
- '60.##0.75.27':445
- '60.##0.54.164':445
- '60.##0.177.229':445
- '60.##0.221.73':445
- '60.##0.146.55':445
- '60.##0.137.36':445
- '60.##0.125.131':445
- '60.##0.154.143':445
- '60.##0.53.29':445
- '60.##0.35.225':445
- '60.##0.73.235':445
- '60.##0.150.7':445
- '60.##0.6.150':445
- '60.##0.47.159':139
- '60.##0.185.212':139
- '60.##0.160.248':139
- '60.##0.71.95':139
- '60.##0.179.185':139
- '60.##0.20.169':139
- '60.##0.32.152':139
- '60.##0.192.51':139
- '60.##0.169.28':139
- '60.##0.172.182':139
- '60.##0.159.26':445
- '60.##0.65.51':445
- '60.##0.43.226':445
- '60.##0.95.43':445
- '60.##0.64.65':139
- '60.##0.4.210':139
- '60.##0.44.253':139
- '60.##0.27.64':139
- '60.##0.141.206':139
- '60.##0.92.237':445
- '60.##0.111.136':445
- '60.##0.191.104':445
- '60.##0.65.51':139
- '60.##0.35.243':445
- '60.##0.61.144':445
- '60.##0.162.118':445
- '60.##0.42.75':445
- '60.##0.94.111':445
- '60.#10.6.8':445
- '60.##0.159.26':139
- '60.##0.142.184':139
- '60.##0.54.164':139
- '60.##0.174.145':139
- '60.##0.0.229':139
- '60.##0.177.229':139
- '60.##0.43.226':139
- '60.##0.95.43':139
- '60.##0.233.76':139
- '60.##0.75.27':139
- '60.##0.68.157':445
- '60.##0.150.115':445
- '60.##0.181.113':445
- '60.##0.226.180':445
- '60.##0.51.240':445
- '60.##0.212.142':445
- '60.##0.236.103':445
- '60.##0.9.209':445
- '60.##0.151.120':445
- '60.##0.113.215':445
- '60.##0.52.252':445
- '60.##0.39.176':445
- '60.##0.186.56':445
- '60.##0.24.135':445
- '60.##0.35.166':445
- '60.##0.131.156':445
- '60.##0.215.59':445
- '60.##0.15.97':445
- '60.##0.187.44':445
- '60.#10.9.12':139
- '60.##0.120.35':445
- '60.##0.210.252':445
- '60.##0.32.152':445
- '60.#10.9.12':445
- '60.##0.209.211':445
- '60.#10.9.74':445
- '60.##0.164.128':445
- '60.##0.105.239':445
- '60.##0.157.102':445
- '60.##0.20.169':445
- '60.##0.160.248':445
- '60.##0.71.95':445
- '60.##0.44.253':445
- '60.##0.172.182':445
- '60.##0.47.159':445
- '60.##0.192.51':445
- '60.##0.169.28':445
- '60.##0.185.212':445
- '60.##0.179.185':445
- '60.##0.254.245':445
- '60.##0.72.87':445
- '60.##0.60.78':445
- '60.##0.255.112':445
- '60.##0.161.133':445
- '60.##0.143.83':445
- '60.##0.57.169':445
- '60.##0.81.121':445
- '60.##0.55.138':445
- '60.##0.14.141':445
- '60.##0.138.120':445
- '60.##0.1.176':445
- '60.##0.209.26':445
- '60.##0.225.219':445
- '60.##0.20.164':445
- '60.##0.38.123':445
- '60.##0.40.189':445
- '60.##0.155.253':445
- '60.##0.26.186':445
- '60.##0.4.210':445
- '60.##0.155.253':139
- '60.##0.26.186':139
- '60.##0.1.176':139
- '60.##0.20.164':139
- '60.##0.38.123':139
- '60.##0.60.78':139
- '60.##0.255.112':139
- '60.##0.40.189':139
- '60.##0.14.141':139
- '60.##0.138.120':139
- '60.##0.209.211':139
- '60.##0.105.239':139
- '60.##0.120.35':139
- '60.##0.210.252':139
- '60.##0.157.102':139
- '60.##0.209.26':139
- '60.##0.225.219':139
- '60.#10.9.74':139
- '60.##0.164.128':139
- '60.##0.246.104':139
- '60.##0.15.163':139
- '60.##0.159.155':139
- '60.##0.182.121':139
- '60.##0.251.128':139
- '60.##0.27.64':445
- '60.##0.141.206':445
- '60.##0.64.17':139
- '60.##0.64.65':445
- '60.#10.28.4':139
- '60.##0.161.133':139
- '60.##0.81.121':139
- '60.##0.254.245':139
- '60.##0.72.87':139
- '60.##0.55.138':139
- '60.##0.234.179':139
- '60.##0.14.212':139
- '60.##0.143.83':139
- '60.##0.57.169':139
- '60.##0.95.66':445
- '60.##0.81.182':445
- '60.##0.3.199':139
- '60.##0.176.102':139
- '60.##0.128.82':445
- '60.##0.170.81':445
- '60.##0.25.91':445
- '60.##0.182.235':445
- '60.##0.141.144':445
- '60.##0.199.63':139
- '60.##0.177.235':139
- '60.##0.234.177':139
- '60.##0.58.17':139
- '60.##0.235.170':139
- '60.##0.111.221':139
- '60.##0.128.236':139
- '60.##0.64.129':139
- '60.##0.123.244':139
- '60.##0.217.221':139
- '60.##0.229.146':445
- '60.##0.222.127':445
- '60.##0.147.214':445
- '60.##0.18.12':445
- '60.##0.210.152':445
- '60.##0.31.196':445
- '60.##0.255.123':445
- '60.##0.120.102':445
- '60.##0.40.120':445
- '60.##0.80.50':445
- '60.##0.33.51':445
- '60.##0.114.27':445
- '60.##0.45.26':445
- '60.##0.38.45':445
- '60.##0.206.98':445
- '60.##0.236.6':445
- '60.##0.43.185':445
- '60.##0.57.211':445
- '60.##0.235.190':445
- '60.##0.90.63':139
- '60.##0.57.211':139
- '60.##0.235.190':139
- '60.##0.114.27':139
- '60.##0.206.98':139
- '60.##0.236.6':139
- '60.##0.147.214':139
- '60.##0.18.12':139
- '60.##0.43.185':139
- '60.##0.80.50':139
- '60.##0.33.51':139
- '60.##0.182.235':139
- '60.##0.141.144':139
- '60.##0.81.182':139
- '60.##0.95.66':139
- '60.##0.170.81':139
- '60.##0.45.26':139
- '60.##0.38.45':139
- '60.##0.128.82':139
- '60.##0.25.91':139
- '60.##0.27.100':139
- '60.##0.44.58':139
- '60.##0.32.94':139
- '60.##0.232.196':139
- '60.##0.184.43':139
- '60.##0.28.211':139
- '60.##0.74.85':139
- '60.##0.108.164':139
- '60.##0.232.240':139
- '60.##0.131.183':139
- '60.##0.210.152':139
- '60.##0.120.102':139
- '60.##0.229.146':139
- '60.##0.222.127':139
- '60.##0.40.120':139
- '60.##0.121.44':139
- '60.##0.200.165':139
- '60.##0.31.196':139
- '60.##0.255.123':139
- '60.##0.121.44':445
- '60.##0.187.44':139
- '60.##0.131.156':139
- '60.##0.35.166':139
- '60.##0.15.97':139
- '60.##0.215.59':139
- '60.##0.226.180':139
- '60.##0.68.157':139
- '60.##0.113.215':139
- '60.##0.181.113':139
- '60.##0.39.176':139
- '60.##0.94.111':139
- '60.#10.6.8':139
- '60.##0.191.104':139
- '60.##0.61.144':139
- '60.##0.162.118':139
- '60.##0.24.135':139
- '60.##0.52.252':139
- '60.##0.42.75':139
- '60.##0.186.56':139
- '60.##0.150.7':139
- '60.##0.6.150':139
- '60.##0.137.36':139
- '60.##0.53.29':139
- '60.##0.35.225':139
- '60.##0.60.75':139
- '60.##0.171.174':139
- '60.##0.73.235':139
- '60.##0.221.73':139
- '60.##0.146.55':139
- '60.##0.9.209':139
- '60.##0.212.142':139
- '60.##0.150.115':139
- '60.##0.51.240':139
- '60.##0.151.120':139
- '60.##0.125.131':139
- '60.##0.154.143':139
- '60.##0.236.103':139
- '60.##0.92.237':139
- '60.##0.111.136':139
- '60.##0.58.17':445
- '60.##0.235.170':445
- '60.##0.74.85':445
- '60.##0.90.63':445
- '60.##0.177.235':445
- '60.##0.123.244':445
- '60.##0.217.221':445
- '60.##0.234.177':445
- '60.##0.111.221':445
- '60.##0.28.211':445
- '60.##0.32.94':445
- '60.##0.232.196':445
- '60.##0.200.165':445
- '60.##0.131.183':445
- '60.##0.27.100':445
- '60.##0.108.164':445
- '60.##0.232.240':445
- '60.##0.44.58':445
- '60.##0.184.43':445
- '60.##0.235.190':9988
- '60.##0.43.185':9988
- '60.##0.128.82':9988
- '60.##0.114.27':9988
- '60.##0.80.50':9988
- '60.##0.31.196':9988
- '60.##0.35.243':139
- '60.##0.229.146':9988
- '60.##0.210.152':9988
- '60.##0.95.66':9988
- '60.##0.199.63':445
- '60.##0.3.199':445
- '60.##0.128.236':445
- '60.##0.64.129':445
- '60.##0.176.102':445
- '60.##0.141.144':9988
- '60.##0.81.182':9988
- '60.##0.170.81':9988
- '60.##0.38.45':9988