Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERaafe.dir00\svchost.exe.mdmp 16325836412032504
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WERaafe.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- '63.##6.142.174':445
- '63.##6.8.113':445
- '63.##6.209.3':445
- '63.##6.47.178':445
- '63.##6.89.131':445
- '63.##6.126.114':445
- '63.##6.204.204':445
- '63.##6.235.143':445
- '63.##6.42.164':445
- '63.##6.59.158':139
- '63.##6.80.224':139
- '63.##6.252.103':139
- '63.##6.158.252':139
- '63.##6.72.86':139
- '63.#26.4.82':139
- '63.#26.7.77':139
- '63.##6.157.129':139
- '63.##6.48.14':139
- '63.##6.64.61':445
- '63.#26.7.77':445
- '63.##6.44.201':139
- '63.##6.48.14':445
- '63.#26.4.82':445
- '63.##6.39.57':139
- '63.##6.129.51':139
- '63.##6.34.129':139
- '63.##6.53.153':139
- '63.##6.187.197':139
- '63.##6.150.136':445
- '63.##6.252.103':445
- '63.##6.152.246':445
- '63.##6.241.85':445
- '63.##6.158.252':445
- '63.##6.72.86':445
- '63.##6.157.129':445
- '63.##6.59.158':445
- '63.##6.80.224':445
- '63.##6.74.77':445
- '63.##6.83.206':445
- '63.##6.254.45':445
- '63.##6.188.114':445
- '63.##6.226.8':445
- '63.##6.64.238':445
- '63.##6.244.206':445
- '63.#26.4.59':445
- '63.##6.237.7':445
- '63.##6.6.121':445
- '63.##6.99.105':445
- '63.##6.80.211':445
- '63.##6.118.17':445
- '63.##6.195.180':445
- '63.##6.167.136':445
- '63.##6.45.124':445
- '63.##6.148.2':445
- '63.##6.218.100':445
- '63.#26.1.22':445
- '63.##6.42.164':139
- '63.##6.126.114':139
- '63.##6.89.131':139
- '63.##6.235.143':139
- '63.##6.204.204':139
- '63.##6.241.85':139
- '63.##6.150.136':139
- '63.##6.64.61':139
- '63.##6.152.246':139
- '63.##6.240.139':445
- '63.##6.205.50':445
- '63.##6.188.115':445
- '63.##6.78.207':445
- '63.#26.4.61':445
- '63.##6.142.174':139
- '63.##6.8.113':139
- '63.##6.209.3':139
- '63.##6.47.178':139
- '63.##6.86.226':445
- '63.##6.245.114':445
- '63.##6.17.122':445
- '63.##6.23.17':445
- '63.##6.27.77':445
- '63.##6.83.237':139
- '63.##6.4.185':139
- '63.##6.66.168':445
- '63.##6.199.65':139
- '63.##6.137.182':445
- '63.##6.4.133':445
- '63.##6.160.222':445
- '63.#26.9.46':445
- '63.##6.213.240':445
- '63.##6.149.15':445
- '63.##6.106.150':445
- '63.##6.206.169':445
- '63.##6.20.184':445
- '63.##6.121.34':139
- '63.##6.39.227':139
- '63.##6.64.22':139
- '63.##6.65.241':139
- '63.##6.143.66':139
- '63.##6.42.74':139
- '63.##6.182.219':139
- '63.##6.6.230':139
- '63.##6.157.7':139
- '63.##6.185.106':139
- '63.##6.230.6':139
- '63.##6.245.132':139
- '63.##6.136.192':139
- '63.##6.181.13':139
- '63.##6.211.175':139
- '63.##6.73.86':139
- '63.##6.142.106':139
- '63.##6.41.96':139
- '63.##6.0.179':139
- '63.##6.4.133':139
- '63.##6.213.240':139
- '63.#26.9.46':139
- '63.##6.137.182':139
- '63.##6.206.169':139
- '63.##6.106.150':139
- '63.##6.17.122':139
- '63.##6.20.184':139
- '63.##6.149.15':139
- '63.##6.140.191':139
- '63.##6.105.83':139
- '63.##6.33.34':139
- '63.##6.7.147':139
- '63.##6.131.215':139
- '63.##6.70.102':139
- '63.##6.160.222':139
- '63.##6.112.170':139
- '63.##6.205.158':139
- '63.##6.23.17':139
- '63.##6.7.147':445
- '63.##6.140.191':445
- '63.##6.34.129':445
- '63.##6.33.34':445
- '63.##6.105.83':445
- '63.##6.205.158':445
- '63.##6.70.102':445
- '63.##6.131.215':445
- '63.##6.112.170':445
- '63.##6.27.77':139
- '63.##6.66.168':139
- '63.##6.86.226':139
- '63.##6.245.114':139
- '63.##6.44.201':445
- '63.##6.187.197':445
- '63.##6.129.51':445
- '63.##6.39.57':445
- '63.##6.53.153':445
- '63.##6.16.244':445
- '63.##6.219.74':139
- '63.##6.225.222':139
- '63.##6.100.178':139
- '63.##6.75.144':139
- '63.##6.57.230':139
- '63.##6.50.129':445
- '63.##6.47.51':445
- '63.##6.168.147':445
- '63.##6.75.232':445
- '63.##6.144.222':139
- '63.##6.155.25':139
- '63.##6.53.97':139
- '63.##6.31.163':139
- '63.##6.52.202':139
- '63.##6.196.199':139
- '63.##6.200.166':139
- '63.##6.125.52':139
- '63.##6.157.125':139
- '63.##6.28.86':445
- '63.#26.44.3':445
- '63.##6.65.117':445
- '63.##6.117.70':445
- '63.##6.57.56':445
- '63.##6.196.65':445
- '63.##6.160.38':445
- '63.##6.125.196':445
- '63.##6.44.171':445
- '63.##6.102.65':445
- '63.##6.80.115':445
- '63.##6.252.6':445
- '63.##6.13.83':445
- '63.##6.195.79':445
- '63.##6.140.122':445
- '63.##6.112.85':445
- '63.##6.124.42':445
- '63.##6.102.140':445
- '63.##6.15.121':445
- '63.##6.15.121':139
- '63.##6.112.85':139
- '63.##6.140.122':139
- '63.##6.102.140':139
- '63.##6.124.42':139
- '63.#26.44.3':139
- '63.##6.65.117':139
- '63.##6.117.70':139
- '63.##6.57.56':139
- '63.##6.47.51':139
- '63.##6.168.147':139
- '63.##6.50.129':139
- '63.##6.75.232':139
- '63.##6.28.86':139
- '63.##6.80.115':139
- '63.##6.252.6':139
- '63.##6.13.83':139
- '63.##6.195.79':139
- '63.##6.196.65':139
- '63.##6.157.134':139
- '63.##6.171.147':139
- '63.##6.237.253':139
- '63.##6.146.66':139
- '63.##6.20.35':139
- '63.##6.220.0':139
- '63.##6.96.220':139
- '63.##6.124.219':139
- '63.##6.0.183':139
- '63.##6.160.38':139
- '63.##6.125.196':139
- '63.##6.44.171':139
- '63.##6.102.65':139
- '63.##6.22.237':139
- '63.##6.70.42':139
- '63.##6.254.87':139
- '63.##6.246.120':139
- '63.##6.232.151':139
- '63.##6.6.121':139
- '63.##6.99.105':139
- '63.##6.80.211':139
- '63.##6.118.17':139
- '63.##6.195.180':139
- '63.##6.167.136':139
- '63.##6.45.124':139
- '63.##6.148.2':139
- '63.##6.218.100':139
- '63.##6.168.147':9988
- '63.##6.20.35':9988
- '63.#26.44.3':9988
- '63.##6.31.163':9988
- '63.##6.157.91':139
- '63.##6.20.200':139
- '63.##6.16.244':139
- '63.##6.195.168':139
- '63.##6.164.65':139
- '63.##6.254.45':139
- '63.##6.240.139':139
- '63.##6.205.50':139
- '63.##6.188.115':139
- '63.##6.78.207':139
- '63.#26.4.61':139
- '63.##6.164.65':445
- '63.##6.20.200':445
- '63.##6.157.91':445
- '63.##6.195.168':445
- '63.##6.83.206':139
- '63.##6.226.8':139
- '63.##6.188.114':139
- '63.##6.74.77':139
- '63.#26.4.59':139
- '63.##6.244.206':139
- '63.#26.1.22':139
- '63.##6.237.7':139
- '63.##6.64.238':139
- '63.##6.0.183':445
- '63.##6.220.0':445
- '63.##6.20.35':445
- '63.##6.124.219':445
- '63.##6.96.220':445
- '63.##6.144.222':445
- '63.##6.155.25':445
- '63.##6.53.97':445
- '63.##6.31.163':445
- '63.##6.232.151':445
- '63.##6.70.42':445
- '63.##6.22.237':445
- '63.##6.246.120':445
- '63.##6.254.87':445
- '63.##6.157.134':445
- '63.##6.171.147':445
- '63.##6.237.253':445
- '63.##6.146.66':445
- '63.##6.125.52':445
- '63.##6.50.129':9988
- '63.##6.13.83':9988
- '63.##6.196.65':9988
- '63.##6.146.66':9988
- '63.##6.47.51':9988
- '63.##6.102.140':9988
- '63.##6.237.253':9988
- '63.##6.171.147':9988
- '63.##6.80.115':9988
- '63.##6.196.199':445
- '63.##6.200.166':445
- '63.##6.52.202':445
- '63.##6.157.125':445
- '63.##6.100.178':445
- '63.##6.225.222':445
- '63.##6.57.230':445
- '63.##6.75.144':445
- '63.##6.219.74':445