Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERf82d.dir00\svchost.exe.mdmp 16325836412032108
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WERf82d.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '67.##3.49.177':139
- '67.##3.207.167':445
- '67.##3.207.120':139
- '67.##3.168.174':139
- '67.##3.166.246':445
- '67.##3.43.119':445
- '67.##3.207.120':445
- '67.##3.169.151':445
- '67.##3.151.199':445
- '67.##3.43.119':139
- '67.##3.238.157':445
- '67.##3.166.129':445
- '67.##3.211.252':445
- '67.#43.86.9':445
- '67.##3.36.82':445
- '67.##3.169.151':139
- '67.##3.151.199':139
- '67.##3.207.167':139
- '67.##3.166.246':139
- '67.##3.78.60':139
- '67.##3.226.77':139
- '67.##3.82.120':139
- '67.##3.12.64':139
- '67.##3.230.239':139
- '67.##3.65.219':139
- '67.##3.114.38':139
- '67.#43.36.0':139
- '67.##3.27.110':139
- '67.##3.188.245':139
- '67.##3.229.182':139
- '67.##3.21.244':139
- '67.##3.168.174':445
- '67.##3.49.177':445
- '67.##3.229.98':139
- '67.##3.113.120':139
- '67.##3.246.61':139
- '67.##3.69.225':139
- '67.##3.7.188':139
- '67.##3.209.43':445
- '67.##3.181.55':445
- '67.##3.243.217':445
- '67.##3.73.186':445
- '67.##3.88.143':445
- '67.##3.36.84':445
- '67.##3.205.180':445
- '67.##3.31.88':445
- '67.##3.255.197':445
- '67.##3.97.130':445
- '67.##3.200.110':445
- '67.##3.23.136':445
- '67.##3.194.81':445
- '67.##3.93.222':445
- '67.##3.117.100':445
- '67.##3.211.52':445
- '67.##3.48.210':445
- '67.##3.120.105':445
- '67.##3.26.219':445
- '67.##3.163.46':445
- '67.##3.87.249':445
- '67.##3.202.212':445
- '67.##3.125.112':445
- '67.##3.90.88':445
- '67.##3.176.173':445
- '67.##3.45.15':445
- '67.##3.249.131':445
- '67.##3.6.118':445
- '67.##3.83.58':445
- '67.##3.122.168':445
- '67.##3.57.184':445
- '67.##3.223.71':445
- '67.##3.143.168':445
- '67.##3.127.203':445
- '67.##3.15.80':445
- '67.##3.54.154':445
- '67.##3.179.146':445
- '67.##3.50.16':445
- '67.##3.128.113':139
- '67.##3.45.121':445
- '67.##3.59.219':445
- '67.##3.177.185':445
- '67.##3.163.189':445
- '67.##3.215.192':445
- '67.##3.123.220':445
- '67.##3.18.177':445
- '67.##3.65.215':445
- '67.##3.103.89':445
- '67.##3.219.240':445
- '67.##3.114.38':445
- '67.##3.65.219':445
- '67.#43.36.0':445
- '67.##3.27.110':445
- '67.##3.128.113':445
- '67.##3.157.178':445
- '67.##3.121.222':445
- '67.##3.222.219':445
- '67.##3.120.225':445
- '67.##3.28.65':139
- '67.##3.45.141':139
- '67.##3.203.39':445
- '67.##3.17.203':139
- '67.##3.151.233':139
- '67.##3.166.189':139
- '67.##3.84.35':139
- '67.##3.165.238':139
- '67.##3.169.243':139
- '67.##3.39.145':445
- '67.##3.48.154':445
- '67.##3.87.183':445
- '67.##3.154.48':445
- '67.##3.60.124':445
- '67.##3.64.99':445
- '67.##3.215.197':445
- '67.##3.144.199':445
- '67.##3.86.71':445
- '67.##3.59.120':445
- '67.##3.123.220':139
- '67.##3.60.124':139
- '67.##3.65.215':139
- '67.##3.103.89':139
- '67.##3.18.177':139
- '67.##3.87.183':139
- '67.##3.64.99':139
- '67.##3.48.154':139
- '67.##3.154.48':139
- '67.##3.215.192':139
- '67.##3.219.240':139
- '67.##3.121.222':139
- '67.##3.59.219':139
- '67.##3.157.178':139
- '67.##3.222.219':139
- '67.##3.163.189':139
- '67.##3.45.121':139
- '67.##3.120.225':139
- '67.##3.177.185':139
- '67.##3.246.61':445
- '67.##3.188.245':445
- '67.##3.7.188':445
- '67.##3.113.120':445
- '67.##3.82.120':445
- '67.##3.226.77':445
- '67.##3.230.239':445
- '67.##3.12.64':445
- '67.##3.78.60':445
- '67.##3.69.225':445
- '67.##3.215.197':139
- '67.##3.144.199':139
- '67.##3.86.71':139
- '67.##3.59.120':139
- '67.##3.39.145':139
- '67.##3.21.244':445
- '67.##3.229.98':445
- '67.##3.203.39':139
- '67.##3.229.182':445
- '67.##3.36.82':139
- '67.##3.212.30':139
- '67.##3.8.214':445
- '67.##3.91.233':139
- '67.##3.102.65':139
- '67.##3.14.53':445
- '67.##3.112.229':445
- '67.##3.128.13':445
- '67.##3.214.77':445
- '67.##3.58.89':445
- '67.##3.233.68':139
- '67.##3.49.229':139
- '67.##3.164.51':139
- '67.##3.203.8':139
- '67.##3.229.21':139
- '67.##3.78.69':139
- '67.##3.255.145':139
- '67.##3.108.150':139
- '67.##3.105.200':139
- '67.##3.91.241':139
- '67.##3.36.169':445
- '67.#43.7.89':445
- '67.##3.121.82':445
- '67.##3.238.152':445
- '67.##3.20.223':445
- '67.##3.118.225':445
- '67.##3.62.74':445
- '67.##3.223.113':445
- '67.##3.134.113':445
- '67.##3.82.94':445
- '67.##3.54.241':445
- '67.##3.184.54':445
- '67.##3.168.239':445
- '67.##3.241.116':445
- '67.##3.104.153':445
- '67.##3.94.207':445
- '67.##3.207.17':445
- '67.##3.31.94':445
- '67.##3.166.192':445
- '67.##3.166.192':139
- '67.##3.207.17':139
- '67.##3.104.153':139
- '67.##3.31.94':139
- '67.##3.94.207':139
- '67.##3.238.152':139
- '67.##3.36.169':139
- '67.##3.82.94':139
- '67.##3.121.82':139
- '67.##3.184.54':139
- '67.##3.8.214':139
- '67.##3.58.89':139
- '67.##3.14.53':139
- '67.##3.214.77':139
- '67.##3.112.229':139
- '67.##3.241.116':139
- '67.##3.54.241':139
- '67.##3.168.239':139
- '67.##3.128.13':139
- '67.##3.231.219':139
- '67.##3.45.45':139
- '67.##3.34.10':139
- '67.##3.65.228':139
- '67.#43.67.2':139
- '67.##3.116.41':139
- '67.#43.1.95':139
- '67.##3.7.230':139
- '67.##3.16.179':139
- '67.##3.86.201':139
- '67.##3.20.223':139
- '67.##3.134.113':139
- '67.#43.7.89':139
- '67.##3.223.113':139
- '67.##3.118.225':139
- '67.##3.19.139':139
- '67.##3.61.19':139
- '67.##3.62.74':139
- '67.##3.82.64':139
- '67.##3.19.139':445
- '67.##3.255.197':139
- '67.##3.36.84':139
- '67.##3.88.143':139
- '67.##3.31.88':139
- '67.##3.205.180':139
- '67.##3.122.168':139
- '67.##3.57.184':139
- '67.##3.223.71':139
- '67.##3.143.168':139
- '67.##3.181.55':139
- '67.##3.26.219':139
- '67.##3.211.52':139
- '67.##3.117.100':139
- '67.##3.120.105':139
- '67.##3.48.210':139
- '67.##3.73.186':139
- '67.##3.209.43':139
- '67.##3.97.130':139
- '67.##3.243.217':139
- '67.##3.6.118':139
- '67.##3.176.173':139
- '67.##3.90.88':139
- '67.##3.249.131':139
- '67.##3.45.15':139
- '67.##3.238.157':139
- '67.##3.166.129':139
- '67.##3.211.252':139
- '67.#43.86.9':139
- '67.##3.87.249':139
- '67.##3.50.16':139
- '67.##3.15.80':139
- '67.##3.127.203':139
- '67.##3.179.146':139
- '67.##3.54.154':139
- '67.##3.125.112':139
- '67.##3.163.46':139
- '67.##3.83.58':139
- '67.##3.202.212':139
- '67.##3.203.8':445
- '67.##3.229.21':445
- '67.##3.116.41':445
- '67.#43.1.95':445
- '67.##3.49.229':445
- '67.##3.78.69':445
- '67.##3.91.233':445
- '67.##3.164.51':445
- '67.##3.91.241':445
- '67.##3.16.179':445
- '67.##3.34.10':445
- '67.##3.86.201':445
- '67.##3.82.64':445
- '67.##3.61.19':445
- '67.##3.65.228':445
- '67.##3.7.230':445
- '67.#43.67.2':445
- '67.##3.45.45':445
- '67.##3.231.219':445
- '67.##3.203.8':9988
- '67.##3.45.45':9988
- '67.##3.134.113':9988
- '67.##3.61.19':9988
- '67.##3.91.233':9988
- '67.##3.200.110':139
- '67.##3.23.136':139
- '67.##3.194.81':139
- '67.##3.93.222':139
- '67.##3.20.223':9988
- '67.##3.105.200':445
- '67.##3.255.145':445
- '67.##3.212.30':445
- '67.##3.108.150':445
- '67.##3.102.65':445
- '67.##3.184.54':9988
- '67.##3.94.207':9988
- '67.##3.233.68':445
- '67.##3.14.53':9988