Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WERfc38.dir00\svchost.exe.mdmp 16325836412032184
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WERfc38.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '13#.#3.9.101':445
- '13#.#3.228.225':445
- '13#.#3.253.138':445
- '13#.33.72.9':445
- '13#.#3.202.141':445
- '13#.#3.115.234':445
- '13#.#3.56.10':139
- '13#.#3.220.106':445
- '13#.#3.113.46':445
- '13#.#3.212.212':445
- '13#.#3.24.197':445
- '13#.#3.48.188':445
- '13#.#3.93.234':445
- '13#.#3.215.115':445
- '13#.#3.37.177':445
- '13#.#3.118.71':445
- '13#.#3.51.219':445
- '13#.#3.124.156':445
- '13#.#3.191.198':445
- '13#.#3.149.215':445
- '13#.#3.65.81':139
- '13#.#3.24.130':139
- '13#.#3.216.103':139
- '13#.#3.131.29':139
- '13#.#3.141.231':139
- '13#.#3.66.159':139
- '13#.#3.107.66':139
- '13#.#3.42.196':139
- '13#.#3.98.189':139
- '13#.#3.124.11':139
- '13#.#3.139.199':139
- '13#.#3.178.60':139
- '13#.#3.199.216':139
- '13#.#3.185.98':139
- '13#.#3.143.130':139
- '13#.#3.20.179':139
- '13#.#3.95.62':139
- '13#.#3.125.137':139
- '13#.#3.48.66':139
- '13#.#3.38.71':139
- '13#.#3.44.228':445
- '13#.#3.211.211':445
- '13#.#3.190.160':445
- '13#.#3.33.185':445
- '13#.#3.160.33':445
- '13#.#3.110.85':445
- '13#.#3.180.46':445
- '13#.#3.105.212':445
- '13#.#3.95.118':445
- '13#.#3.212.75':445
- '13#.#3.228.225':139
- '13#.#3.113.46':139
- '13#.#3.9.101':139
- '13#.#3.202.141':139
- '13#.#3.253.138':139
- '13#.#3.106.64':445
- '13#.#3.25.135':445
- '13#.#3.115.234':139
- '13#.#3.212.212':139
- '13#.#3.220.106':139
- '13#.#3.97.248':445
- '13#.#3.106.209':445
- '13#.#3.124.28':445
- '13#.#3.97.138':445
- '13#.#3.240.5':445
- '13#.#3.196.167':445
- '13#.#3.195.195':445
- '13#.#3.101.105':445
- '13#.#3.140.53':445
- '13#.#3.60.72':445
- '13#.#3.165.225':445
- '13#.#3.118.123':445
- '13#.#3.221.163':445
- '13#.#3.192.137':445
- '13#.#3.84.192':445
- '13#.#3.252.105':445
- '13#.#3.40.84':445
- '13#.#3.161.188':445
- '13#.#3.240.118':445
- '13#.#3.118.131':445
- '13#.#3.158.106':139
- '13#.#3.167.110':445
- '13#.#3.89.128':445
- '13#.#3.111.19':445
- '13#.#3.158.106':445
- '13#.#3.50.42':445
- '13#.#3.64.64':445
- '13#.#3.81.64':445
- '13#.#3.206.201':445
- '13#.#3.57.85':445
- '13#.33.9.34':445
- '13#.#3.65.81':445
- '13#.#3.24.130':445
- '13#.#3.216.103':445
- '13#.#3.131.29':445
- '13#.#3.141.231':445
- '13#.#3.66.159':445
- '13#.#3.107.66':445
- '13#.#3.42.196':445
- '13#.#3.98.189':445
- '13#.#3.124.11':445
- '13#.#3.228.35':445
- '13#.#3.221.80':445
- '13#.#3.123.46':445
- '13#.#3.13.60':445
- '13#.#3.38.112':445
- '13#.#3.96.221':445
- '13#.#3.129.148':445
- '13#.#3.124.135':445
- '13#.#3.129.227':445
- '13#.#3.135.13':445
- '13#.#3.32.12':445
- '13#.#3.159.4':445
- '13#.#3.21.216':445
- '13#.#3.230.193':445
- '13#.#3.26.215':445
- '13#.#3.51.203':445
- '13#.#3.115.82':445
- '13#.#3.112.212':445
- '13#.#3.156.227':445
- '13#.#3.198.5':445
- '13#.#3.159.4':139
- '13#.#3.156.227':139
- '13#.#3.32.12':139
- '13#.#3.26.215':139
- '13#.#3.21.216':139
- '13#.#3.115.82':139
- '13#.#3.13.60':139
- '13#.#3.51.203':139
- '13#.#3.198.5':139
- '13#.#3.112.212':139
- '13#.#3.89.128':139
- '13#.#3.57.85':139
- '13#.#3.167.110':139
- '13#.#3.50.42':139
- '13#.#3.111.19':139
- '13#.#3.81.64':139
- '13#.#3.230.193':139
- '13#.#3.64.64':139
- '13#.33.9.34':139
- '13#.#3.206.201':139
- '13#.#3.139.199':445
- '13#.#3.178.60':445
- '13#.#3.199.216':445
- '13#.#3.185.98':445
- '13#.#3.143.130':445
- '13#.#3.20.179':445
- '13#.#3.95.62':445
- '13#.#3.125.137':445
- '13#.#3.48.66':445
- '13#.#3.38.71':445
- '13#.#3.221.80':139
- '13#.#3.129.227':139
- '13#.#3.228.35':139
- '13#.#3.38.112':139
- '13#.#3.123.46':139
- '13#.#3.129.148':139
- '13#.#3.56.10':445
- '13#.#3.96.221':139
- '13#.#3.135.13':139
- '13#.#3.124.135':139
- '13#.#3.22.250':445
- '13#.#3.186.206':445
- '13#.#3.174.11':445
- '13#.#3.153.41':139
- '13#.#3.14.220':445
- '13#.#3.144.231':445
- '13#.#3.218.222':445
- '13#.#3.9.198':445
- '13#.#3.206.2':445
- '13#.#3.183.84':445
- '13#.#3.30.137':139
- '13#.#3.103.133':139
- '13#.#3.41.214':139
- '13#.#3.168.150':139
- '13#.#3.54.243':139
- '13#.#3.193.38':139
- '13#.#3.21.214':139
- '13#.#3.38.212':139
- '13#.#3.179.173':139
- '13#.#3.214.65':139
- '13#.#3.100.90':445
- '13#.#3.234.199':445
- '13#.#3.30.139':445
- '13#.#3.131.18':445
- '13#.#3.117.140':445
- '13#.#3.48.29':445
- '13#.#3.33.98':445
- '13#.#3.29.113':445
- '13#.#3.141.213':445
- '13#.#3.254.243':445
- '13#.#3.130.236':445
- '13#.#3.181.130':445
- '13#.#3.223.62':445
- '13#.#3.133.94':445
- '13#.#3.224.164':445
- '13#.#3.187.11':445
- '13#.#3.202.176':445
- '13#.#3.11.210':445
- '13#.#3.181.157':445
- '13#.#3.148.70':445
- '13#.#3.181.130':139
- '13#.#3.181.157':139
- '13#.#3.130.236':139
- '13#.#3.224.164':139
- '13#.#3.223.62':139
- '13#.#3.202.176':139
- '13#.#3.131.18':139
- '13#.#3.187.11':139
- '13#.#3.148.70':139
- '13#.#3.11.210':139
- '13#.#3.14.220':139
- '13#.#3.206.2':139
- '13#.#3.186.206':139
- '13#.#3.183.84':139
- '13#.#3.174.11':139
- '13#.#3.218.222':139
- '13#.#3.133.94':139
- '13#.#3.144.231':139
- '13#.#3.22.250':139
- '13#.#3.9.198':139
- '13#.#3.83.113':139
- '13#.#3.90.92':139
- '13#.#3.225.138':139
- '13#.#3.79.201':139
- '13#.#3.234.217':139
- '13#.#3.88.208':139
- '13#.#3.14.235':139
- '13#.#3.30.152':139
- '13#.#3.50.46':139
- '13#.#3.151.241':139
- '13#.#3.234.199':139
- '13#.#3.141.213':139
- '13#.#3.100.90':139
- '13#.#3.117.140':139
- '13#.#3.30.139':139
- '13#.#3.33.98':139
- '13#.#3.182.144':139
- '13#.#3.48.29':139
- '13#.#3.254.243':139
- '13#.#3.29.113':139
- '13#.#3.182.144':445
- '13#.#3.118.123':139
- '13#.#3.240.118':139
- '13#.#3.165.225':139
- '13#.#3.84.192':139
- '13#.#3.221.163':139
- '13#.#3.40.84':139
- '13#.#3.97.138':139
- '13#.#3.252.105':139
- '13#.#3.118.131':139
- '13#.#3.161.188':139
- '13#.#3.211.211':139
- '13#.#3.95.118':139
- '13#.#3.44.228':139
- '13#.#3.160.33':139
- '13#.#3.190.160':139
- '13#.#3.180.46':139
- '13#.#3.192.137':139
- '13#.#3.110.85':139
- '13#.#3.212.75':139
- '13#.#3.105.212':139
- '13#.#3.48.188':139
- '13#.#3.191.198':139
- '13#.#3.24.197':139
- '13#.#3.37.177':139
- '13#.#3.93.234':139
- '13#.#3.51.219':139
- '13#.33.72.9':139
- '13#.#3.118.71':139
- '13#.#3.149.215':139
- '13#.#3.124.156':139
- '13#.#3.106.209':139
- '13#.#3.140.53':139
- '13#.#3.97.248':139
- '13#.#3.240.5':139
- '13#.#3.124.28':139
- '13#.#3.195.195':139
- '13#.#3.215.115':139
- '13#.#3.196.167':139
- '13#.#3.60.72':139
- '13#.#3.101.105':139
- '13#.#3.30.137':445
- '13#.#3.103.133':445
- '13#.#3.41.214':445
- '13#.#3.168.150':445
- '13#.#3.54.243':445
- '13#.#3.193.38':445
- '13#.#3.21.214':445
- '13#.#3.38.212':445
- '13#.#3.179.173':445
- '13#.#3.214.65':445
- '13#.#3.83.113':445
- '13#.#3.90.92':445
- '13#.#3.225.138':445
- '13#.#3.79.201':445
- '13#.#3.234.217':445
- '13#.#3.88.208':445
- '13#.#3.14.235':445
- '13#.#3.30.152':445
- '13#.#3.50.46':445
- '13#.#3.151.241':445
- '13#.#3.148.70':9988
- '13#.#3.9.198':9988
- '13#.#3.50.46':9988
- '13#.#3.133.94':9988
- '13#.#3.254.243':9988
- '13#.#3.25.135':139
- '13#.#3.33.185':139
- '13#.#3.106.64':139
- '13#.#3.202.176':9988
- '13#.#3.151.241':9988
- '13#.#3.41.214':9988
- '13#.#3.131.18':9988
- '13#.#3.30.139':9988
- '13#.#3.153.41':445
- '13#.#3.30.152':9988
- '13#.#3.187.11':9988
- '13#.#3.206.2':9988
- '13#.#3.117.140':9988
- '13#.#3.33.98':9988
- '13#.#3.30.137':9988