Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WERf3cd.dir00\svchost.exe.mdmp 16325836412032420
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- <SYSTEM32>\urdvxc.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- '19#.#3.2.206':139
- '19#.#3.148.125':139
- '19#.#3.131.136':139
- '19#.#3.6.163':139
- '19#.#3.100.6':139
- '19#.#3.95.148':139
- '19#.#3.226.59':139
- '19#.#3.136.10':139
- '19#.#3.254.96':139
- '19#.#3.140.95':139
- '19#.#3.135.203':139
- '19#.#3.248.60':139
- '19#.#3.22.229':139
- '19#.#3.90.163':139
- '19#.#3.117.18':139
- '19#.#3.164.12':139
- '19#.#3.168.46':139
- '19#.#3.113.114':139
- '19#.#3.162.113':139
- '19#.53.0.65':139
- '19#.#3.168.114':139
- '19#.#3.177.78':139
- '19#.#3.252.112':139
- '19#.#3.112.92':445
- '19#.#3.140.112':445
- '19#.#3.238.203':445
- '19#.#3.26.210':139
- '19#.#3.23.22':445
- '19#.#3.23.205':445
- '19#.#3.3.104':445
- '19#.#3.16.26':445
- '19#.#3.19.200':445
- '19#.#3.131.58':445
- '19#.#3.166.174':445
- '19#.53.0.21':139
- '19#.#3.124.184':139
- '19#.#3.159.218':139
- '19#.#3.167.150':139
- '19#.#3.85.13':139
- '19#.#3.82.19':139
- '19#.#3.35.72':139
- '19#.#3.181.212':139
- '19#.#3.65.22':139
- '19#.#3.234.134':139
- '19#.#3.144.33':139
- '19#.#3.2.233':139
- '19#.#3.221.25':445
- '19#.#3.156.223':445
- '19#.#3.19.125':445
- '19#.#3.55.88':445
- '19#.#3.40.179':445
- '19#.#3.61.12':445
- '19#.#3.50.214':445
- '19#.#3.167.192':445
- '19#.#3.52.143':445
- '19#.#3.51.93':445
- '19#.#3.93.73':445
- '19#.#3.250.207':445
- '19#.#3.29.251':445
- '19#.#3.245.183':445
- '19#.53.4.16':445
- '19#.#3.223.52':445
- '19#.#3.68.197':445
- '19#.#3.153.137':445
- '19#.#3.202.40':445
- '19#.#3.27.40':445
- '19#.#3.94.73':445
- '19#.#3.79.119':445
- '19#.#3.15.166':445
- '19#.#3.19.200':139
- '19#.#3.3.104':139
- '19#.#3.166.174':139
- '19#.#3.23.205':139
- '19#.#3.131.58':139
- '19#.#3.16.26':139
- '19#.#3.119.57':139
- '19#.#3.233.66':139
- '19#.#3.195.136':139
- '19#.#3.48.156':139
- '19#.#3.180.203':139
- '19#.#3.179.7':445
- '19#.#3.150.21':445
- '19#.#3.157.183':445
- '19#.#3.176.130':445
- '19#.#3.136.63':445
- '19#.#3.61.135':445
- '19#.#3.112.92':139
- '19#.#3.140.112':139
- '19#.#3.238.203':139
- '19#.#3.116.27':445
- '19#.#3.23.22':139
- '19#.#3.48.156':445
- '19#.#3.22.107':139
- '19#.#3.99.241':139
- '19#.#3.44.47':139
- '19#.#3.1.198':139
- '19#.#3.69.126':139
- '19#.#3.74.40':139
- '19#.#3.132.33':139
- '19#.#3.229.96':139
- '19#.#3.32.214':139
- '19#.#3.156.41':139
- '19#.#3.14.63':139
- '19#.#3.42.89':139
- '19#.#3.62.22':139
- '19#.#3.78.247':139
- '19#.#3.41.99':139
- '19#.#3.231.144':139
- '19#.#3.82.133':139
- '19#.#3.247.146':139
- '19#.#3.153.164':139
- '19#.#3.103.246':139
- '19#.#3.154.228':139
- '19#.#3.152.14':139
- '19#.#3.231.90':139
- '19#.#3.206.123':139
- '19#.#3.214.44':139
- '19#.#3.205.75':139
- '19#.#3.172.195':139
- '19#.#3.211.172':139
- '19#.#3.30.63':139
- '19#.#3.237.109':139
- '19#.#3.53.237':139
- '19#.#3.110.22':139
- '19#.53.9.83':139
- '19#.#3.21.186':139
- '19#.#3.147.211':139
- '19#.#3.212.77':139
- '19#.#3.225.111':139
- '19#.#3.206.13':139
- '19#.#3.142.208':139
- '19#.#3.120.88':139
- '19#.#3.170.194':139
- '19#.#3.196.5':139
- '19#.#3.168.38':139
- '19#.53.59.4':139
- '19#.53.84.7':139
- '19#.#3.34.24':139
- '19#.#3.113.114':445
- '19#.#3.162.113':445
- '19#.53.0.65':445
- '19#.#3.168.114':445
- '19#.#3.177.78':445
- '19#.#3.6.163':445
- '19#.#3.148.125':445
- '19#.#3.95.148':445
- '19#.#3.2.206':445
- '19#.#3.100.6':445
- '19#.#3.131.136':445
- '19#.#3.233.66':445
- '19#.#3.2.233':445
- '19#.#3.119.57':445
- '19#.#3.180.203':445
- '19#.#3.195.136':445
- '19#.#3.117.18':445
- '19#.#3.22.229':445
- '19#.#3.168.46':445
- '19#.#3.248.60':445
- '19#.#3.164.12':445
- '19#.#3.90.163':445
- '19#.#3.140.95':445
- '19#.#3.35.72':445
- '19#.#3.181.212':445
- '19#.#3.65.22':445
- '19#.#3.234.134':445
- '19#.#3.144.33':445
- '19#.#3.26.210':445
- '19#.#3.188.205':139
- '19#.#3.241.132':139
- '19#.#3.29.88':139
- '19#.#3.36.116':139
- '19#.#3.67.120':139
- '19#.#3.136.10':445
- '19#.#3.252.112':445
- '19#.#3.226.59':445
- '19#.#3.135.203':445
- '19#.#3.254.96':445
- '19#.#3.167.150':445
- '19#.#3.124.184':445
- '19#.#3.82.19':445
- '19#.53.0.21':445
- '19#.#3.85.13':445
- '19#.#3.159.218':445
- '19#.#3.112.60':445
- '19#.#3.142.108':445
- '19#.#3.46.161':445
- '19#.#3.108.172':445
- '19#.#3.56.39':445
- '19#.#3.172.55':445
- '19#.#3.70.78':445
- '19#.#3.19.166':445
- '19#.#3.50.230':445
- '19#.#3.236.208':445
- '19#.#3.219.155':445
- '19#.#3.208.229':445
- '19#.#3.0.176':139
- '19#.#3.72.81':139
- '19#.#3.42.36':139
- '19#.#3.68.36':139
- '19#.#3.78.72':139
- '19#.#3.37.239':445
- '19#.#3.207.236':445
- '19#.#3.39.123':445
- '19#.#3.245.176':445
- '19#.#3.90.20':445
- '19#.#3.116.208':445
- '19#.#3.18.51':445
- '19#.#3.79.175':445
- '19#.#3.69.97':445
- '19#.#3.108.192':445
- '19#.#3.146.203':445
- '19#.#3.52.147':445
- '19#.#3.206.192':445
- '19#.#3.29.22':445
- '19#.#3.43.175':445
- '19#.#3.186.203':445
- '19#.#3.116.207':445
- '19#.#3.185.114':445
- '19#.#3.89.201':445
- '19#.#3.168.172':445
- '19#.#3.253.7':445
- '19#.#3.224.17':445
- '19#.#3.117.132':445
- '19#.#3.122.254':445
- '19#.#3.141.42':445
- '19#.#3.184.40':445
- '19#.#3.90.69':445
- '19#.#3.65.72':445
- '19#.#3.83.110':445
- '19#.#3.99.181':139
- '19#.#3.236.208':139
- '19#.#3.19.166':139
- '19#.#3.208.229':139
- '19#.#3.70.78':139
- '19#.#3.219.155':139
- '19#.#3.50.230':139
- '19#.#3.253.7':139
- '19#.#3.89.201':139
- '19#.#3.117.132':139
- '19#.#3.18.51':139
- '19#.#3.224.17':139
- '19#.#3.37.239':139
- '19#.#3.207.236':139
- '19#.#3.245.176':139
- '19#.#3.116.208':139
- '19#.#3.90.20':139
- '19#.#3.39.123':139
- '19#.#3.142.108':139
- '19#.#3.46.161':139
- '19#.#3.108.172':139
- '19#.#3.56.39':139
- '19#.#3.172.55':139
- '19#.#3.168.172':139
- '19#.#3.186.203':139
- '19#.#3.29.22':139
- '19#.#3.185.114':139
- '19#.#3.206.192':139
- '19#.#3.116.207':139
- '19#.#3.43.175':139
- '19#.#3.61.65':139
- '19#.#3.170.43':139
- '19#.#3.144.234':139
- '19#.#3.149.77':139
- '19#.#3.234.243':139
- '19#.#3.90.69':139
- '19#.#3.141.42':139
- '19#.#3.83.110':139
- '19#.#3.122.254':139
- '19#.#3.65.72':139
- '19#.#3.184.40':139
- '19#.#3.79.175':139
- '19#.#3.69.97':139
- '19#.#3.108.192':139
- '19#.#3.146.203':139
- '19#.#3.52.147':139
- '19#.#3.149.77':445
- '19#.#3.52.143':139
- '19#.#3.50.214':139
- '19#.#3.93.73':139
- '19#.#3.61.12':139
- '19#.#3.51.93':139
- '19#.#3.167.192':139
- '19#.#3.157.183':139
- '19#.#3.179.7':139
- '19#.#3.136.63':139
- '19#.#3.15.166':139
- '19#.#3.176.130':139
- '19#.#3.27.40':139
- '19#.#3.153.137':139
- '19#.#3.79.119':139
- '19#.#3.68.197':139
- '19#.#3.94.73':139
- '19#.#3.202.40':139
- '19#.#3.221.25':139
- '19#.#3.156.223':139
- '19#.#3.19.125':139
- '19#.#3.55.88':139
- '19#.#3.40.179':139
- '19#.#3.150.21':139
- '19#.#3.187.150':445
- '19#.#3.177.187':445
- '19#.#3.105.192':445
- '19#.#3.224.237':445
- '19#.53.85.6':445
- '19#.#3.7.164':445
- '19#.#3.189.253':445
- '19#.#3.80.211':445
- '19#.#3.56.124':445
- '19#.#3.237.114':445
- '19#.#3.207.69':445
- '19#.#3.230.147':445
- '19#.#3.103.232':445
- '19#.#3.166.217':445
- '19#.#3.61.135':139
- '19#.#3.116.27':139
- '19#.#3.110.166':445
- '19#.#3.24.170':445
- '19#.#3.163.24':445
- '19#.#3.170.20':445
- '19#.#3.100.211':445
- '19#.#3.21.46':445
- '19#.#3.29.251':139
- '19#.#3.39.123':9988
- '19#.#3.79.175':9988
- '19#.#3.168.172':9988
- '19#.#3.70.78':9988
- '19#.#3.186.203':9988
- '19#.#3.208.229':9988
- '19#.#3.166.217':139
- '19#.#3.230.147':139
- '19#.#3.29.22':9988
- '19#.#3.245.176':9988
- '19#.#3.253.7':9988
- '19#.#3.170.43':445
- '19#.#3.99.181':445
- '19#.#3.61.65':445
- '19#.#3.234.243':445
- '19#.#3.144.234':445
- '19#.#3.68.36':445
- '19#.#3.72.81':445
- '19#.#3.56.39':9988
- '19#.#3.0.176':445
- '19#.#3.78.72':445
- '19#.#3.42.36':445
- '19#.#3.103.232':139
- '19#.#3.56.124':139
- '19#.#3.189.253':139
- '19#.#3.207.69':139
- '19#.#3.7.164':139
- '19#.#3.237.114':139
- '19#.#3.80.211':139
- '19#.#3.245.183':139
- '19#.#3.250.207':139
- '19#.#3.223.52':139
- '19#.#3.112.60':139
- '19#.53.4.16':139
- '19#.#3.170.20':139
- '19#.#3.24.170':139
- '19#.#3.21.46':139
- '19#.#3.110.166':139
- '19#.#3.100.211':139
- '19#.#3.163.24':139
- '19#.#3.187.150':139
- '19#.#3.177.187':139
- '19#.#3.105.192':139
- '19#.#3.224.237':139
- '19#.53.85.6':139