Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WERf46a.dir00\svchost.exe.mdmp 16325836412032792
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WERf46a.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '63.##0.97.182':445
- '63.##0.142.70':445
- '63.##0.184.4':445
- '63.##0.27.28':445
- '63.#10.3.73':445
- '63.##0.211.251':139
- '63.##0.252.199':139
- '63.#10.8.18':445
- '63.##0.116.142':445
- '63.##0.67.116':445
- '63.##0.186.33':445
- '63.##0.154.172':445
- '63.##0.129.244':445
- '63.##0.211.50':445
- '63.##0.23.142':445
- '63.##0.31.21':445
- '63.##0.141.155':445
- '63.##0.131.195':445
- '63.##0.217.154':445
- '63.##0.222.217':445
- '63.##0.96.32':139
- '63.##0.164.105':139
- '63.##0.107.177':139
- '63.##0.178.207':139
- '63.##0.189.241':139
- '63.##0.182.84':139
- '63.##0.101.96':139
- '63.##0.40.134':139
- '63.##0.139.167':139
- '63.##0.254.51':139
- '63.##0.44.80':139
- '63.##0.184.181':139
- '63.##0.63.94':139
- '63.##0.43.48':139
- '63.##0.94.213':139
- '63.##0.234.249':139
- '63.##0.162.175':139
- '63.##0.142.93':139
- '63.##0.31.202':139
- '63.##0.93.142':139
- '63.##0.149.83':445
- '63.##0.8.149':445
- '63.##0.128.12':445
- '63.##0.209.176':445
- '63.##0.100.196':445
- '63.##0.69.163':445
- '63.##0.225.161':445
- '63.##0.141.145':445
- '63.##0.164.8':445
- '63.##0.106.161':445
- '63.##0.142.70':139
- '63.##0.116.142':139
- '63.##0.97.182':139
- '63.#10.3.73':139
- '63.##0.184.4':139
- '63.##0.115.147':445
- '63.##0.36.115':445
- '63.##0.66.118':445
- '63.##0.67.116':139
- '63.#10.8.18':139
- '63.##0.147.39':445
- '63.##0.9.240':445
- '63.##0.172.110':445
- '63.##0.94.187':445
- '63.##0.127.57':445
- '63.##0.50.91':445
- '63.##0.143.14':445
- '63.##0.251.7':445
- '63.##0.19.53':445
- '63.##0.85.59':445
- '63.##0.100.120':445
- '63.##0.145.89':445
- '63.##0.121.31':445
- '63.##0.95.159':445
- '63.##0.31.95':445
- '63.##0.107.221':445
- '63.##0.186.246':445
- '63.##0.12.210':445
- '63.##0.168.237':445
- '63.##0.55.111':445
- '63.##0.63.80':445
- '63.##0.128.47':445
- '63.##0.13.229':445
- '63.##0.101.96':445
- '63.##0.10.199':445
- '63.##0.57.162':445
- '63.#10.62.9':445
- '63.##0.23.239':445
- '63.##0.20.176':445
- '63.#10.3.20':445
- '63.##0.107.177':445
- '63.##0.96.32':445
- '63.##0.189.241':445
- '63.##0.162.175':445
- '63.##0.178.207':445
- '63.##0.40.134':445
- '63.##0.182.84':445
- '63.##0.254.51':445
- '63.##0.164.105':445
- '63.##0.139.167':445
- '63.##0.38.249':445
- '63.##0.54.242':445
- '63.##0.129.123':445
- '63.##0.59.188':445
- '63.##0.123.30':445
- '63.##0.221.135':445
- '63.##0.7.109':445
- '63.##0.135.248':445
- '63.##0.57.131':445
- '63.##0.248.161':445
- '63.##0.109.191':445
- '63.##0.198.24':445
- '63.##0.34.147':445
- '63.##0.30.39':445
- '63.##0.219.234':445
- '63.##0.46.94':445
- '63.##0.246.197':445
- '63.##0.118.65':445
- '63.##0.103.173':445
- '63.##0.65.12':445
- '63.##0.198.24':139
- '63.##0.103.173':139
- '63.##0.109.191':139
- '63.##0.219.234':139
- '63.##0.34.147':139
- '63.##0.246.197':139
- '63.##0.59.188':139
- '63.##0.46.94':139
- '63.##0.65.12':139
- '63.##0.118.65':139
- '63.##0.128.47':139
- '63.##0.20.176':139
- '63.##0.63.80':139
- '63.##0.10.199':139
- '63.##0.13.229':139
- '63.#10.62.9':139
- '63.##0.30.39':139
- '63.##0.57.162':139
- '63.#10.3.20':139
- '63.##0.23.239':139
- '63.##0.63.94':445
- '63.##0.44.80':445
- '63.##0.94.213':445
- '63.##0.252.199':445
- '63.##0.43.48':445
- '63.##0.142.93':445
- '63.##0.234.249':445
- '63.##0.93.142':445
- '63.##0.184.181':445
- '63.##0.31.202':445
- '63.##0.54.242':139
- '63.##0.57.131':139
- '63.##0.38.249':139
- '63.##0.123.30':139
- '63.##0.129.123':139
- '63.##0.7.109':139
- '63.##0.211.251':445
- '63.##0.221.135':139
- '63.##0.248.161':139
- '63.##0.135.248':139
- '63.##0.197.78':445
- '63.##0.49.235':445
- '63.##0.78.16':445
- '63.##0.124.81':139
- '63.##0.17.30':445
- '63.#10.4.41':445
- '63.##0.219.133':445
- '63.#10.87.1':445
- '63.##0.47.10':445
- '63.##0.12.97':445
- '63.##0.144.138':139
- '63.##0.84.166':139
- '63.##0.168.103':139
- '63.##0.23.179':139
- '63.##0.233.139':139
- '63.##0.54.186':139
- '63.##0.81.146':139
- '63.##0.49.29':139
- '63.##0.128.143':139
- '63.##0.199.127':139
- '63.##0.22.104':445
- '63.##0.88.51':445
- '63.##0.103.187':445
- '63.##0.247.180':445
- '63.##0.187.229':445
- '63.##0.21.193':445
- '63.##0.46.104':445
- '63.##0.148.205':445
- '63.##0.26.158':445
- '63.##0.140.128':445
- '63.##0.19.107':445
- '63.##0.133.189':445
- '63.##0.156.139':445
- '63.##0.95.90':445
- '63.##0.115.0':445
- '63.##0.44.207':445
- '63.##0.28.226':445
- '63.##0.49.152':445
- '63.##0.225.105':445
- '63.##0.152.225':445
- '63.##0.133.189':139
- '63.##0.225.105':139
- '63.##0.19.107':139
- '63.##0.115.0':139
- '63.##0.156.139':139
- '63.##0.28.226':139
- '63.##0.247.180':139
- '63.##0.44.207':139
- '63.##0.152.225':139
- '63.##0.49.152':139
- '63.##0.49.235':139
- '63.##0.197.78':139
- '63.##0.47.10':139
- '63.##0.78.16':139
- '63.##0.17.30':139
- '63.##0.219.133':139
- '63.##0.95.90':139
- '63.#10.4.41':139
- '63.#10.87.1':139
- '63.##0.12.97':139
- '63.##0.25.176':139
- '63.##0.100.36':139
- '63.##0.29.160':139
- '63.##0.208.141':139
- '63.##0.29.219':139
- '63.##0.20.92':139
- '63.##0.195.19':139
- '63.##0.109.177':139
- '63.##0.115.109':139
- '63.##0.57.117':139
- '63.##0.88.51':139
- '63.##0.26.158':139
- '63.##0.22.104':139
- '63.##0.187.229':139
- '63.##0.103.187':139
- '63.##0.46.104':139
- '63.##0.141.46':139
- '63.##0.21.193':139
- '63.##0.140.128':139
- '63.##0.148.205':139
- '63.##0.145.89':139
- '63.##0.168.237':139
- '63.##0.100.120':139
- '63.##0.31.95':139
- '63.##0.121.31':139
- '63.##0.186.246':139
- '63.##0.94.187':139
- '63.##0.107.221':139
- '63.##0.55.111':139
- '63.##0.12.210':139
- '63.##0.8.149':139
- '63.##0.164.8':139
- '63.##0.149.83':139
- '63.##0.100.196':139
- '63.##0.128.12':139
- '63.##0.225.161':139
- '63.##0.95.159':139
- '63.##0.69.163':139
- '63.##0.106.161':139
- '63.##0.141.145':139
- '63.##0.154.172':139
- '63.##0.217.154':139
- '63.##0.186.33':139
- '63.##0.23.142':139
- '63.##0.129.244':139
- '63.##0.141.155':139
- '63.##0.27.28':139
- '63.##0.31.21':139
- '63.##0.222.217':139
- '63.##0.131.195':139
- '63.##0.9.240':139
- '63.##0.19.53':139
- '63.##0.147.39':139
- '63.##0.127.57':139
- '63.##0.172.110':139
- '63.##0.143.14':139
- '63.##0.211.50':139
- '63.##0.50.91':139
- '63.##0.85.59':139
- '63.##0.251.7':139
- '63.##0.168.103':445
- '63.##0.144.138':445
- '63.##0.233.139':445
- '63.##0.195.19':445
- '63.##0.23.179':445
- '63.##0.49.29':445
- '63.##0.54.186':445
- '63.##0.199.127':445
- '63.##0.84.166':445
- '63.##0.128.143':445
- '63.##0.29.160':445
- '63.##0.25.176':445
- '63.##0.29.219':445
- '63.##0.141.46':445
- '63.##0.208.141':445
- '63.##0.109.177':445
- '63.##0.20.92':445
- '63.##0.57.117':445
- '63.##0.100.36':445
- '63.##0.115.109':445
- '63.##0.19.107':9988
- '63.##0.23.179':9988
- '63.##0.49.152':9988
- '63.##0.17.30':9988
- '63.##0.12.97':9988
- '63.##0.36.115':139
- '63.##0.209.176':139
- '63.##0.115.147':139
- '63.#10.87.1':9988
- '63.##0.66.118':139
- '63.##0.152.225':9988
- '63.##0.78.16':9988
- '63.##0.103.187':9988
- '63.##0.81.146':445
- '63.##0.124.81':445
- '63.##0.247.180':9988
- '63.##0.21.193':9988
- '63.##0.197.78':9988
- '63.##0.115.109':9988
- '63.##0.26.158':9988