Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1152 -dm 7 7 %TEMP%\WER31ee.dir00\svchost.exe.mdmp 16325836412030052
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER31ee.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '60.##.118.74':139
- '60.##.193.41':139
- '60.##.76.137':139
- '60.##.167.197':139
- '60.##.19.144':139
- '60.##.208.201':139
- '60.##.33.156':445
- '60.##.247.224':139
- '60.##.233.110':139
- '60.##.64.233':139
- '60.#0.11.5':139
- '60.##.179.245':139
- '60.#0.24.88':139
- '60.#0.11.73':139
- '60.##.62.224':139
- '60.##.48.178':139
- '60.##.65.101':139
- '60.##.178.99':139
- '60.##.113.78':139
- '60.##.53.209':139
- '60.#0.24.88':445
- '60.#0.11.5':445
- '60.##.62.224':445
- '60.##.72.203':445
- '60.#0.11.73':445
- '60.##.178.99':445
- '60.##.48.178':445
- '60.##.53.209':445
- '60.##.179.245':445
- '60.##.113.78':445
- '60.##.14.192':445
- '60.##.46.106':445
- '60.##.77.110':445
- '60.##.65.239':445
- '60.##.196.218':445
- '60.#0.158.5':445
- '60.##.55.132':445
- '60.#0.5.80':445
- '60.#0.3.161':445
- '60.#0.80.46':445
- '60.##.72.203':139
- '60.#0.16.95':445
- '60.#0.22.95':445
- '60.##.95.151':445
- '60.##.165.177':445
- '60.##.98.206':445
- '60.##.95.250':445
- '60.#0.40.96':445
- '60.##.148.137':445
- '60.##.192.236':445
- '60.##.206.67':445
- '60.##.173.243':139
- '60.#0.35.97':139
- '60.##.243.102':139
- '60.##.53.242':139
- '60.##.150.29':139
- '60.##.114.124':139
- '60.##.93.138':445
- '60.##.53.167':139
- '60.##.44.156':139
- '60.##.218.79':139
- '60.##.14.192':139
- '60.##.46.106':139
- '60.##.77.110':139
- '60.##.65.239':139
- '60.##.196.218':139
- '60.#0.158.5':139
- '60.##.55.132':139
- '60.#0.5.80':139
- '60.#0.3.161':139
- '60.#0.80.46':139
- '60.##.173.243':445
- '60.#0.35.97':445
- '60.##.243.102':445
- '60.##.53.242':445
- '60.##.150.29':445
- '60.##.114.124':445
- '60.##.33.156':139
- '60.##.53.167':445
- '60.##.44.156':445
- '60.##.218.79':445
- '60.##.189.230':139
- '60.##.153.27':139
- '60.##.159.220':139
- '60.##.57.239':139
- '60.#0.32.45':139
- '60.#0.77.31':139
- '60.##.130.89':139
- '60.##.209.157':139
- '60.##.203.171':139
- '60.#0.82.24':139
- '60.#0.8.117':445
- '60.##.16.116':445
- '60.##.29.161':445
- '60.##.254.135':445
- '60.##.51.254':445
- '60.##.236.86':445
- '60.##.213.222':139
- '60.##.13.148':445
- '60.#0.66.79':445
- '60.##.245.189':445
- '60.##.189.188':139
- '60.##.139.37':139
- '60.##.201.96':139
- '60.##.25.102':139
- '60.#0.82.40':139
- '60.#0.12.10':139
- '60.##.123.191':139
- '60.##.153.222':139
- '60.##.59.254':139
- '60.#0.41.83':139
- '60.##.111.230':139
- '60.##.152.21':139
- '60.##.135.225':139
- '60.##.62.245':139
- '60.##.215.40':139
- '60.##.149.247':139
- '60.##.38.149':139
- '60.##.244.202':139
- '60.##.157.152':139
- '60.##.116.157':139
- '60.##.136.106':445
- '60.#0.77.18':139
- '60.#0.71.20':139
- '60.##.103.239':139
- '60.#0.187.1':139
- '60.#0.66.32':139
- '60.#0.74.33':139
- '60.#0.9.192':139
- '60.##.221.107':139
- '60.##.167.71':139
- '60.##.106.127':139
- '60.##.76.137':445
- '60.##.118.74':445
- '60.##.19.144':445
- '60.##.65.101':445
- '60.##.167.197':445
- '60.##.247.224':445
- '60.##.208.201':445
- '60.##.64.233':445
- '60.##.193.41':445
- '60.##.233.110':445
- '60.#0.77.18':445
- '60.#0.71.20':445
- '60.##.103.239':445
- '60.#0.187.1':445
- '60.#0.66.32':445
- '60.#0.74.33':445
- '60.#0.9.192':445
- '60.##.221.107':445
- '60.##.167.71':445
- '60.##.106.127':445
- '60.##.29.161':139
- '60.#0.8.117':139
- '60.##.51.254':139
- '60.##.136.106':139
- '60.##.254.135':139
- '60.##.13.148':139
- '60.##.236.86':139
- '60.##.245.189':139
- '60.##.16.116':139
- '60.#0.66.79':139
- '60.#0.40.96':139
- '60.##.236.120':445
- '60.#0.73.57':445
- '60.#0.23.44':445
- '60.##.254.117':445
- '60.##.128.185':445
- '60.##.14.218':445
- '60.##.170.63':445
- '60.##.216.251':445
- '60.#0.51.87':445
- '60.##.132.142':445
- '60.##.168.50':139
- '60.##.178.50':139
- '60.##.109.236':139
- '60.##.11.168':139
- '60.#0.72.48':139
- '60.#0.58.35':139
- '60.#0.54.17':139
- '60.##.132.67':139
- '60.##.128.186':139
- '60.##.154.242':139
- '60.#0.147.7':445
- '60.##.194.47':445
- '60.##.13.206':445
- '60.##.177.95':445
- '60.##.54.191':445
- '60.#0.35.66':445
- '60.##.217.35':445
- '60.#0.94.68':445
- '60.##.60.125':445
- '60.##.120.151':445
- '60.##.182.90':445
- '60.##.90.238':445
- '60.##.164.209':445
- '60.#0.53.50':445
- '60.##.248.52':445
- '60.##.238.162':445
- '60.##.47.197':445
- '60.##.101.149':445
- '60.#0.2.41':445
- '60.#0.66.88':445
- '60.##.213.152':139
- '60.##.90.238':139
- '60.##.182.90':139
- '60.##.164.209':139
- '60.##.248.52':139
- '60.#0.53.50':139
- '60.##.101.149':139
- '60.##.54.191':139
- '60.##.13.206':139
- '60.#0.2.41':139
- '60.#0.66.88':139
- '60.##.216.251':139
- '60.#0.51.87':139
- '60.##.236.120':139
- '60.##.254.117':139
- '60.#0.23.44':139
- '60.#0.73.57':139
- '60.##.14.218':139
- '60.##.128.185':139
- '60.##.132.142':139
- '60.##.170.63':139
- '60.##.58.230':139
- '60.##.59.133':139
- '60.##.181.20':139
- '60.##.133.29':139
- '60.##.88.129':139
- '60.##.119.252':139
- '60.##.153.120':139
- '60.##.216.17':139
- '60.#0.77.71':139
- '60.#0.15.78':139
- '60.##.177.95':139
- '60.##.47.197':139
- '60.##.238.162':139
- '60.#0.147.7':139
- '60.##.60.125':139
- '60.#0.35.66':139
- '60.##.217.35':139
- '60.#0.94.68':139
- '60.##.194.47':139
- '60.##.120.151':139
- '60.#0.84.47':445
- '60.#0.15.84':445
- '60.#0.38.72':445
- '60.##.15.201':445
- '60.##.224.15':445
- '60.##.208.24':445
- '60.##.208.182':445
- '60.##.144.45':445
- '60.#0.23.15':445
- '60.##.101.23':445
- '60.##.121.183':139
- '60.##.86.193':139
- '60.##.125.89':139
- '60.##.28.107':139
- '60.##.158.173':139
- '60.##.234.137':445
- '60.##.16.231':445
- '60.##.161.78':445
- '60.##.118.110':139
- '60.##.190.28':139
- '60.##.95.151':139
- '60.#0.16.95':139
- '60.##.98.206':139
- '60.##.93.138':139
- '60.##.165.177':139
- '60.##.148.137':139
- '60.##.95.250':139
- '60.##.206.67':139
- '60.#0.22.95':139
- '60.##.192.236':139
- '60.##.28.107':445
- '60.##.158.173':445
- '60.#0.12.28':445
- '60.##.225.207':445
- '60.##.28.163':445
- '60.##.118.110':445
- '60.##.190.28':445
- '60.##.86.193':445
- '60.##.125.89':445
- '60.##.121.183':445
- '60.#0.12.28':139
- '60.##.109.236':445
- '60.##.168.50':445
- '60.#0.72.48':445
- '60.##.213.152':445
- '60.##.11.168':445
- '60.##.132.67':445
- '60.#0.58.35':445
- '60.##.154.242':445
- '60.##.178.50':445
- '60.##.128.186':445
- '60.##.58.230':445
- '60.##.59.133':445
- '60.##.181.20':445
- '60.##.133.29':445
- '60.##.88.129':445
- '60.##.119.252':445
- '60.##.153.120':445
- '60.##.216.17':445
- '60.#0.77.71':445
- '60.#0.15.78':445
- '60.#0.23.15':139
- '60.##.101.23':139
- '60.#0.15.84':139
- '60.#0.38.72':139
- '60.#0.84.47':139
- '60.##.225.207':139
- '60.##.28.163':139
- '60.##.208.182':139
- '60.##.144.45':139
- '60.##.208.24':139
- '60.##.14.218':9988
- '60.##.170.63':9988
- '60.##.132.142':9988
- '60.#0.54.17':445
- '60.##.254.117':9988
- '60.##.15.201':139
- '60.##.224.15':139
- '60.##.16.231':139
- '60.##.161.78':139
- '60.##.234.137':139