Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WER0240.dir00\svchost.exe.mdmp 16325836412032652
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER0240.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '21#.18.54.1':139
- '21#.#8.70.219':139
- '21#.18.30.8':139
- '21#.#8.166.218':139
- '21#.#8.184.167':139
- '21#.#8.171.117':139
- '21#.#8.29.115':139
- '21#.#8.103.214':139
- '21#.#8.48.252':139
- '21#.#8.113.9':139
- '21#.#8.108.254':445
- '21#.18.1.0':445
- '21#.#8.122.130':445
- '21#.#8.2.110':445
- '21#.#8.74.216':445
- '21#.18.6.65':445
- '21#.#8.185.101':445
- '21#.#8.219.166':445
- '21#.#8.40.145':445
- '21#.#8.69.91':445
- '21#.#8.25.237':139
- '21#.#8.151.27':139
- '21#.#8.67.140':139
- '21#.#8.106.5':139
- '21#.#8.132.148':139
- '21#.#8.222.182':139
- '21#.#8.221.184':139
- '21#.#8.209.94':139
- '21#.#8.89.151':139
- '21#.#8.40.222':139
- '21#.#8.168.213':139
- '21#.#8.123.219':139
- '21#.#8.90.241':139
- '21#.#8.47.161':139
- '21#.#8.241.47':139
- '21#.#8.72.146':139
- '21#.#8.74.187':139
- '21#.#8.67.208':139
- '21#.#8.69.124':139
- '21#.#8.25.151':139
- '21#.#8.161.164':445
- '21#.#8.175.195':445
- '21#.#8.33.175':445
- '21#.#8.154.169':445
- '21#.#8.112.30':445
- '21#.#8.25.186':445
- '21#.#8.172.45':445
- '21#.#8.122.119':445
- '21#.#8.233.150':445
- '21#.18.7.17':445
- '21#.#8.15.56':445
- '21#.#8.220.167':445
- '21#.#8.170.146':445
- '21#.#8.29.242':445
- '21#.#8.79.180':445
- '21#.#8.107.89':445
- '21#.#8.17.223':445
- '21#.#8.23.252':445
- '21#.#8.103.98':445
- '21#.#8.93.218':445
- '21#.#8.245.187':445
- '21#.#8.30.217':445
- '21#.#8.169.98':445
- '21#.#8.217.30':445
- '21#.#8.227.250':445
- '21#.#8.238.97':445
- '21#.#8.9.100':445
- '21#.#8.11.174':445
- '21#.#8.191.137':445
- '21#.#8.88.95':445
- '21#.#8.220.124':445
- '21#.#8.132.201':445
- '21#.#8.8.202':445
- '21#.#8.59.54':445
- '21#.#8.25.199':445
- '21#.#8.120.152':445
- '21#.#8.199.19':445
- '21#.#8.76.61':445
- '21#.#8.19.145':445
- '21#.#8.12.164':445
- '21#.#8.200.115':445
- '21#.#8.43.102':139
- '21#.#8.29.97':445
- '21#.#8.73.194':445
- '21#.18.15.3':445
- '21#.#8.113.62':445
- '21#.#8.47.22':445
- '21#.#8.1.101':445
- '21#.18.7.74':445
- '21#.#8.9.246':445
- '21#.#8.119.18':445
- '21#.#8.101.131':445
- '21#.#8.151.27':445
- '21#.#8.89.151':445
- '21#.#8.25.237':445
- '21#.#8.132.148':445
- '21#.#8.67.140':445
- '21#.#8.221.184':445
- '21#.#8.43.102':445
- '21#.#8.222.182':445
- '21#.#8.40.222':445
- '21#.#8.209.94':445
- '21#.#8.64.208':139
- '21#.#8.180.108':139
- '21#.#8.208.45':139
- '21#.#8.163.105':139
- '21#.#8.38.37':139
- '21#.#8.87.108':139
- '21#.#8.114.200':139
- '21#.#8.154.197':139
- '21#.#8.224.20':139
- '21#.#8.54.66':139
- '21#.#8.213.165':445
- '21#.#8.177.31':445
- '21#.#8.211.98':445
- '21#.#8.29.42':445
- '21#.#8.53.248':445
- '21#.#8.36.41':445
- '21#.#8.107.99':445
- '21#.#8.79.131':445
- '21#.#8.127.122':445
- '21#.#8.1.216':445
- '21#.#8.106.5':445
- '21#.#8.211.98':139
- '21#.#8.213.165':139
- '21#.#8.177.31':139
- '21#.#8.29.42':139
- '21#.#8.53.248':139
- '21#.#8.36.41':139
- '21#.#8.107.99':139
- '21#.#8.79.131':139
- '21#.#8.127.122':139
- '21#.#8.1.216':139
- '21#.#8.29.97':139
- '21#.#8.73.194':139
- '21#.18.15.3':139
- '21#.#8.113.62':139
- '21#.#8.47.22':139
- '21#.18.7.74':139
- '21#.#8.1.101':139
- '21#.#8.9.246':139
- '21#.#8.119.18':139
- '21#.#8.101.131':139
- '21#.#8.168.213':445
- '21#.#8.123.219':445
- '21#.#8.90.241':445
- '21#.#8.47.161':445
- '21#.#8.241.47':445
- '21#.#8.72.146':445
- '21#.#8.74.187':445
- '21#.#8.67.208':445
- '21#.#8.69.124':445
- '21#.#8.25.151':445
- '21#.18.54.1':445
- '21#.#8.70.219':445
- '21#.18.30.8':445
- '21#.#8.166.218':445
- '21#.#8.184.167':445
- '21#.#8.171.117':445
- '21#.#8.29.115':445
- '21#.#8.103.214':445
- '21#.#8.113.9':445
- '21#.#8.48.252':445
- '21#.#8.246.77':445
- '21#.#8.137.160':445
- '21#.#8.187.250':445
- '21#.#8.86.178':445
- '21#.#8.178.136':445
- '21#.18.3.54':445
- '21#.#8.63.22':445
- '21#.#8.130.142':445
- '21#.#8.180.246':445
- '21#.#8.136.157':445
- '21#.#8.235.36':139
- '21#.#8.65.94':139
- '21#.#8.174.187':139
- '21#.#8.90.139':139
- '21#.#8.187.89':139
- '21#.#8.155.164':139
- '21#.#8.52.156':139
- '21#.#8.111.14':139
- '21#.#8.22.112':139
- '21#.#8.201.205':139
- '21#.#8.217.234':445
- '21#.#8.99.44':445
- '21#.#8.94.71':445
- '21#.#8.185.12':445
- '21#.#8.201.53':445
- '21#.#8.110.122':445
- '21#.#8.138.176':445
- '21#.#8.163.154':445
- '21#.#8.97.126':445
- '21#.#8.236.121':445
- '21#.#8.238.177':445
- '21#.#8.178.59':445
- '21#.#8.96.107':445
- '21#.#8.210.97':445
- '21#.#8.209.185':445
- '21#.#8.205.78':445
- '21#.#8.81.204':445
- '21#.#8.239.130':445
- '21#.#8.213.238':445
- '21#.#8.28.214':445
- '21#.#8.250.87':139
- '21#.#8.178.59':139
- '21#.#8.238.177':139
- '21#.#8.96.107':139
- '21#.#8.209.185':139
- '21#.#8.210.97':139
- '21#.#8.205.78':139
- '21#.#8.81.204':139
- '21#.#8.239.130':139
- '21#.#8.213.238':139
- '21#.#8.28.214':139
- '21#.#8.187.250':139
- '21#.#8.246.77':139
- '21#.#8.137.160':139
- '21#.#8.136.157':139
- '21#.#8.86.178':139
- '21#.18.3.54':139
- '21#.#8.63.22':139
- '21#.#8.130.142':139
- '21#.#8.178.136':139
- '21#.#8.180.246':139
- '21#.#8.15.234':139
- '21#.18.7.34':139
- '21#.#8.234.113':139
- '21#.#8.50.159':139
- '21#.#8.113.102':139
- '21#.#8.76.199':139
- '21#.#8.78.229':139
- '21#.#8.248.159':139
- '21#.#8.254.197':139
- '21#.#8.34.43':139
- '21#.#8.217.234':139
- '21#.#8.99.44':139
- '21#.#8.94.71':139
- '21#.#8.185.12':139
- '21#.#8.201.53':139
- '21#.#8.110.122':139
- '21#.#8.138.176':139
- '21#.#8.163.154':139
- '21#.#8.97.126':139
- '21#.#8.236.121':139
- '21#.#8.50.159':445
- '21#.#8.8.202':139
- '21#.#8.12.164':139
- '21#.#8.132.201':139
- '21#.#8.120.152':139
- '21#.#8.59.54':139
- '21#.#8.76.61':139
- '21#.#8.227.250':139
- '21#.#8.199.19':139
- '21#.#8.200.115':139
- '21#.#8.19.145':139
- '21#.#8.33.175':139
- '21#.18.7.17':139
- '21#.#8.175.195':139
- '21#.#8.25.186':139
- '21#.#8.154.169':139
- '21#.#8.122.119':139
- '21#.#8.25.199':139
- '21#.#8.172.45':139
- '21#.#8.15.56':139
- '21#.#8.233.150':139
- '21#.#8.108.254':139
- '21#.18.1.0':139
- '21#.#8.122.130':139
- '21#.#8.2.110':139
- '21#.#8.74.216':139
- '21#.18.6.65':139
- '21#.#8.185.101':139
- '21#.#8.219.166':139
- '21#.#8.40.145':139
- '21#.#8.69.91':139
- '21#.#8.169.98':139
- '21#.#8.88.95':139
- '21#.#8.30.217':139
- '21#.#8.238.97':139
- '21#.#8.217.30':139
- '21#.#8.11.174':139
- '21#.#8.161.164':139
- '21#.#8.9.100':139
- '21#.#8.220.124':139
- '21#.#8.191.137':139
- '21#.#8.112.30':139
- '21#.#8.235.36':445
- '21#.#8.65.94':445
- '21#.#8.174.187':445
- '21#.#8.90.139':445
- '21#.#8.187.89':445
- '21#.#8.155.164':445
- '21#.#8.52.156':445
- '21#.#8.111.14':445
- '21#.#8.22.112':445
- '21#.#8.201.205':445
- '21#.18.7.34':445
- '21#.#8.254.197':445
- '21#.#8.234.113':445
- '21#.#8.113.102':445
- '21#.#8.15.234':445
- '21#.#8.78.229':445
- '21#.#8.250.87':445
- '21#.#8.76.199':445
- '21#.#8.34.43':445
- '21#.#8.248.159':445
- '21#.#8.220.167':139
- '21#.#8.170.146':139
- '21#.#8.29.242':139
- '21#.#8.79.180':139
- '21#.#8.107.89':139
- '21#.#8.17.223':139
- '21#.#8.23.252':139
- '21#.#8.103.98':139
- '21#.#8.93.218':139
- '21#.#8.245.187':139
- '21#.#8.180.246':9988
- '21#.#8.137.160':9988
- '21#.#8.130.142':9988
- '21#.#8.136.157':9988
- '21#.18.3.54':9988
- '21#.#8.217.234':9988
- '21#.#8.250.87':9988
- '21#.#8.210.97':9988
- '21#.#8.96.107':9988
- '21#.#8.213.238':9988