Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1128 -dm 7 7 %TEMP%\WER3847.dir00\svchost.exe.mdmp 16325836412032448
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER3847.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '64.##2.169.218':445
- '64.##2.141.46':445
- '64.#52.30.7':445
- '64.##2.91.202':445
- '64.##2.207.102':445
- '64.##2.106.93':139
- '64.##2.241.95':139
- '64.##2.172.14':445
- '64.##2.176.75':445
- '64.##2.153.20':445
- '64.##2.79.87':445
- '64.##2.124.201':445
- '64.##2.105.219':445
- '64.##2.54.138':445
- '64.##2.125.192':445
- '64.##2.146.92':445
- '64.##2.34.218':445
- '64.##2.192.234':445
- '64.##2.161.66':445
- '64.##2.215.83':445
- '64.##2.2.213':139
- '64.#52.2.40':139
- '64.##2.213.82':139
- '64.#52.21.4':139
- '64.##2.68.251':139
- '64.##2.108.189':139
- '64.##2.208.181':139
- '64.#52.8.12':139
- '64.##2.23.238':139
- '64.##2.114.34':139
- '64.##2.136.106':139
- '64.##2.126.97':139
- '64.##2.199.95':139
- '64.##2.195.91':139
- '64.##2.240.32':139
- '64.##2.78.233':139
- '64.##2.53.172':139
- '64.##2.100.136':139
- '64.##2.45.224':139
- '64.##2.161.246':139
- '64.##2.137.117':445
- '64.##2.7.207':445
- '64.##2.51.97':445
- '64.##2.183.76':445
- '64.##2.83.236':445
- '64.##2.179.28':445
- '64.##2.151.220':445
- '64.##2.107.207':445
- '64.##2.164.195':445
- '64.##2.32.165':445
- '64.##2.141.46':139
- '64.##2.176.75':139
- '64.##2.169.218':139
- '64.##2.207.102':139
- '64.#52.30.7':139
- '64.##2.236.189':445
- '64.##2.0.115':445
- '64.##2.54.44':445
- '64.##2.153.20':139
- '64.##2.172.14':139
- '64.##2.242.149':445
- '64.##2.4.196':445
- '64.##2.73.145':445
- '64.##2.187.90':445
- '64.##2.199.186':445
- '64.#52.58.6':445
- '64.##2.56.83':445
- '64.##2.195.25':445
- '64.##2.52.141':445
- '64.##2.25.59':445
- '64.##2.16.79':445
- '64.##2.16.16':445
- '64.##2.37.241':445
- '64.##2.155.119':445
- '64.##2.76.155':445
- '64.##2.1.122':445
- '64.##2.90.164':445
- '64.##2.78.244':445
- '64.##2.19.221':445
- '64.##2.213.48':445
- '64.##2.108.189':445
- '64.##2.75.107':445
- '64.##2.107.17':445
- '64.##2.35.78':445
- '64.##2.208.181':445
- '64.##2.240.116':445
- '64.##2.236.48':445
- '64.##2.103.49':445
- '64.##2.159.2':445
- '64.##2.23.175':445
- '64.##2.213.82':445
- '64.##2.2.213':445
- '64.##2.68.251':445
- '64.##2.53.172':445
- '64.#52.21.4':445
- '64.#52.8.12':445
- '64.##2.251.143':445
- '64.##2.114.34':445
- '64.#52.2.40':445
- '64.##2.23.238':445
- '64.##2.34.65':445
- '64.##2.37.235':445
- '64.##2.204.14':445
- '64.##2.192.9':445
- '64.##2.29.191':445
- '64.##2.159.166':445
- '64.#52.22.4':445
- '64.##2.22.26':445
- '64.##2.148.173':445
- '64.##2.130.196':445
- '64.##2.158.96':445
- '64.##2.184.86':445
- '64.##2.38.89':445
- '64.##2.222.235':445
- '64.##2.88.222':445
- '64.##2.11.129':445
- '64.##2.133.140':445
- '64.##2.187.213':445
- '64.##2.31.185':445
- '64.##2.213.31':445
- '64.##2.184.86':139
- '64.##2.31.185':139
- '64.##2.158.96':139
- '64.##2.88.222':139
- '64.##2.38.89':139
- '64.##2.133.140':139
- '64.##2.192.9':139
- '64.##2.11.129':139
- '64.##2.213.31':139
- '64.##2.187.213':139
- '64.##2.35.78':139
- '64.##2.107.17':139
- '64.##2.23.175':139
- '64.##2.251.143':139
- '64.##2.159.2':139
- '64.##2.236.48':139
- '64.##2.222.235':139
- '64.##2.240.116':139
- '64.##2.75.107':139
- '64.##2.103.49':139
- '64.##2.199.95':445
- '64.##2.136.106':445
- '64.##2.240.32':445
- '64.##2.241.95':445
- '64.##2.195.91':445
- '64.##2.100.136':445
- '64.##2.78.233':445
- '64.##2.161.246':445
- '64.##2.126.97':445
- '64.##2.45.224':445
- '64.##2.37.235':139
- '64.##2.148.173':139
- '64.##2.34.65':139
- '64.##2.29.191':139
- '64.##2.204.14':139
- '64.#52.22.4':139
- '64.##2.106.93':445
- '64.##2.159.166':139
- '64.##2.130.196':139
- '64.##2.22.26':139
- '64.##2.32.238':445
- '64.##2.153.191':445
- '64.##2.179.32':445
- '64.##2.18.84':139
- '64.##2.28.179':445
- '64.#52.0.71':445
- '64.##2.129.53':445
- '64.##2.106.254':445
- '64.##2.238.178':445
- '64.##2.239.138':445
- '64.##2.42.36':139
- '64.##2.90.174':139
- '64.##2.132.211':139
- '64.##2.130.232':139
- '64.##2.211.81':139
- '64.##2.86.38':139
- '64.##2.21.48':139
- '64.##2.38.15':139
- '64.##2.137.204':139
- '64.##2.36.142':139
- '64.##2.204.151':445
- '64.##2.235.204':445
- '64.##2.151.31':445
- '64.##2.247.0':445
- '64.##2.115.80':445
- '64.##2.29.145':445
- '64.##2.30.64':445
- '64.##2.145.146':445
- '64.##2.8.144':445
- '64.##2.147.41':445
- '64.##2.74.252':445
- '64.##2.124.74':445
- '64.##2.251.222':445
- '64.##2.223.143':445
- '64.##2.19.253':445
- '64.##2.135.133':445
- '64.##2.0.135':445
- '64.##2.143.175':445
- '64.##2.49.118':445
- '64.##2.119.127':445
- '64.##2.124.74':139
- '64.##2.49.118':139
- '64.##2.74.252':139
- '64.##2.223.143':139
- '64.##2.251.222':139
- '64.##2.0.135':139
- '64.##2.247.0':139
- '64.##2.135.133':139
- '64.##2.119.127':139
- '64.##2.143.175':139
- '64.##2.238.178':139
- '64.##2.153.191':139
- '64.##2.32.238':139
- '64.##2.28.179':139
- '64.##2.179.32':139
- '64.##2.129.53':139
- '64.##2.19.253':139
- '64.#52.0.71':139
- '64.##2.106.254':139
- '64.##2.239.138':139
- '64.##2.246.230':139
- '64.##2.34.14':139
- '64.##2.57.20':139
- '64.##2.182.43':139
- '64.##2.215.246':139
- '64.##2.22.114':139
- '64.##2.109.235':139
- '64.##2.161.193':139
- '64.##2.122.56':139
- '64.##2.207.165':139
- '64.##2.235.204':139
- '64.##2.8.144':139
- '64.##2.204.151':139
- '64.##2.115.80':139
- '64.##2.151.31':139
- '64.##2.30.64':139
- '64.##2.136.2':139
- '64.##2.29.145':139
- '64.##2.147.41':139
- '64.##2.145.146':139
- '64.##2.16.16':139
- '64.##2.19.221':139
- '64.##2.16.79':139
- '64.##2.76.155':139
- '64.##2.37.241':139
- '64.##2.90.164':139
- '64.##2.187.90':139
- '64.##2.1.122':139
- '64.##2.213.48':139
- '64.##2.78.244':139
- '64.##2.7.207':139
- '64.##2.164.195':139
- '64.##2.137.117':139
- '64.##2.83.236':139
- '64.##2.51.97':139
- '64.##2.151.220':139
- '64.##2.155.119':139
- '64.##2.179.28':139
- '64.##2.32.165':139
- '64.##2.107.207':139
- '64.##2.124.201':139
- '64.##2.161.66':139
- '64.##2.79.87':139
- '64.##2.125.192':139
- '64.##2.105.219':139
- '64.##2.34.218':139
- '64.##2.91.202':139
- '64.##2.146.92':139
- '64.##2.215.83':139
- '64.##2.192.234':139
- '64.##2.4.196':139
- '64.##2.52.141':139
- '64.##2.242.149':139
- '64.##2.199.186':139
- '64.##2.73.145':139
- '64.##2.56.83':139
- '64.##2.54.138':139
- '64.#52.58.6':139
- '64.##2.25.59':139
- '64.##2.195.25':139
- '64.##2.132.211':445
- '64.##2.42.36':445
- '64.##2.211.81':445
- '64.##2.109.235':445
- '64.##2.130.232':445
- '64.##2.38.15':445
- '64.##2.86.38':445
- '64.##2.36.142':445
- '64.##2.90.174':445
- '64.##2.137.204':445
- '64.##2.57.20':445
- '64.##2.246.230':445
- '64.##2.215.246':445
- '64.##2.136.2':445
- '64.##2.182.43':445
- '64.##2.161.193':445
- '64.##2.22.114':445
- '64.##2.207.165':445
- '64.##2.34.14':445
- '64.##2.122.56':445
- '64.##2.247.0':9988
- '64.##2.30.64':9988
- '64.##2.251.222':9988
- '64.##2.19.253':9988
- '64.##2.179.32':9988
- '64.##2.0.115':139
- '64.##2.183.76':139
- '64.##2.236.189':139
- '64.##2.246.230':9988
- '64.##2.54.44':139
- '64.##2.238.178':9988
- '64.#52.0.71':9988
- '64.##2.0.135':9988
- '64.##2.21.48':445
- '64.##2.18.84':445
- '64.##2.49.118':9988
- '64.##2.239.138':9988
- '64.##2.153.191':9988
- '64.##2.204.151':9988
- '64.##2.28.179':9988