Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- <SYSTEM32>\urdvxc.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- '14#.#36.35.153':139
- '14#.#36.64.183':139
- '14#.#36.153.161':139
- '14#.#36.69.182':139
- '14#.#36.161.230':139
- '14#.#36.63.156':139
- '14#.#36.167.152':139
- '14#.#36.184.9':139
- '14#.#36.31.192':139
- '14#.#36.9.195':139
- '14#.#36.29.59':139
- '14#.#36.53.15':139
- '14#.#36.220.108':139
- '14#.#36.122.196':139
- '14#.#36.211.173':445
- '14#.#36.225.252':139
- '14#.#36.63.56':139
- '14#.#36.203.24':139
- '14#.#36.55.121':139
- '14#.#36.225.9':139
- '14#.#36.200.239':139
- '14#.#36.60.208':139
- '14#.#36.151.21':139
- '14#.#36.49.184':139
- '14#.#36.21.95':139
- '14#.#36.67.81':139
- '14#.#36.65.101':139
- '14#.#36.219.95':139
- '14#.#36.48.25':139
- '14#.#36.43.52':139
- '14#.#36.215.189':139
- '14#.#36.23.191':139
- '14#.#36.210.10':139
- '14#.#36.248.23':139
- '14#.#36.226.139':139
- '14#.#36.180.125':139
- '14#.#36.151.61':139
- '14#.#36.89.239':139
- '14#.#36.233.237':139
- '14#.#36.120.100':139
- '14#.#36.82.96':139
- '14#.#36.64.242':139
- '14#.#36.165.75':139
- '14#.#36.157.34':445
- '14#.#36.50.224':445
- '14#.#36.34.83':445
- '14#.#36.119.150':445
- '14#.#36.23.217':445
- '14#.#36.131.124':445
- '14#.#36.64.3':445
- '14#.#36.44.144':445
- '14#.#36.74.176':445
- '14#.#36.27.139':445
- '14#.#36.171.212':445
- '14#.#36.85.165':445
- '14#.#36.6.78':445
- '14#.#36.55.222':445
- '14#.#36.86.242':445
- '14#.#36.85.51':445
- '14#.#36.72.60':445
- '14#.#36.79.185':445
- '14#.#36.176.131':445
- '14#.#36.232.16':445
- '14#.#36.78.232':445
- '14#.#36.33.227':445
- '14#.#36.133.21':445
- '14#.#36.33.84':445
- '14#.#36.121.49':445
- '14#.#36.49.199':445
- '14#.#36.47.56':445
- '14#.#36.194.74':445
- '14#.#36.173.194':445
- '14#.#36.74.159':445
- '14#.#36.180.159':445
- '14#.#36.35.81':445
- '14#.#36.4.161':445
- '14#.#36.166.205':445
- '14#.#36.225.6':445
- '14#.#36.84.195':445
- '14#.#36.204.64':445
- '14#.#36.5.207':445
- '14#.#36.247.146':445
- '14#.#36.47.239':445
- '14#.#36.20.250':445
- '14#.#36.59.102':445
- '14#.#36.83.209':445
- '14#.#36.253.28':139
- '14#.#36.146.146':445
- '14#.#36.106.220':445
- '14#.#36.127.148':445
- '14#.#36.61.85':445
- '14#.#36.132.110':445
- '14#.#36.38.202':139
- '14#.#36.67.116':139
- '14#.#36.178.153':139
- '14#.#36.235.106':139
- '14#.#36.10.218':139
- '14#.#36.210.152':445
- '14#.#36.23.191':445
- '14#.#36.43.52':445
- '14#.#36.215.189':445
- '14#.#36.151.21':445
- '14#.#36.49.184':445
- '14#.#36.127.46':445
- '14#.#36.204.76':445
- '14#.#36.253.28':445
- '14#.#36.219.95':445
- '14#.#36.48.25':445
- '14#.#36.42.238':139
- '14#.#36.164.176':139
- '14#.#36.126.245':139
- '14#.#36.153.134':139
- '14#.#36.111.240':139
- '14#.#36.80.70':139
- '14#.#36.112.246':139
- '14#.#36.76.9':139
- '14#.#36.21.76':139
- '14#.#36.64.253':139
- '14#.#36.128.16':139
- '14#.#36.240.238':139
- '14#.#36.62.248':139
- '14#.#36.56.202':139
- '14#.#36.95.126':139
- '14#.#36.174.249':139
- '14#.#36.51.14':139
- '14#.#36.153.62':139
- '14#.#36.238.227':139
- '14#.#36.96.86':139
- '14#.#36.78.57':139
- '14#.#36.199.251':139
- '14#.#36.55.121':445
- '14#.#36.63.56':445
- '14#.#36.200.239':445
- '14#.#36.220.108':445
- '14#.#36.225.9':445
- '14#.#36.161.230':445
- '14#.#36.153.161':445
- '14#.#36.69.182':445
- '14#.#36.203.24':445
- '14#.#36.29.59':445
- '14#.#36.53.15':445
- '14#.#36.61.85':139
- '14#.#36.132.110':139
- '14#.#36.210.152':139
- '14#.#36.127.46':139
- '14#.#36.204.76':139
- '14#.#36.225.252':445
- '14#.#36.122.196':445
- '14#.#36.106.220':139
- '14#.#36.127.148':139
- '14#.#36.146.146':139
- '14#.#36.35.153':445
- '14#.#36.82.96':445
- '14#.#36.233.237':445
- '14#.#36.165.75':445
- '14#.#36.226.139':445
- '14#.#36.64.242':445
- '14#.#36.65.101':445
- '14#.#36.21.95':445
- '14#.#36.67.81':445
- '14#.#36.120.100':445
- '14#.#36.210.10':445
- '14#.#36.248.23':445
- '14#.#36.184.9':445
- '14#.#36.63.156':445
- '14#.#36.9.195':445
- '14#.#36.64.183':445
- '14#.#36.31.192':445
- '14#.#36.89.239':445
- '14#.#36.180.125':445
- '14#.#36.151.61':445
- '14#.#36.167.152':445
- '14#.#36.60.208':445
- '14#.#36.76.105':445
- '14#.#36.189.224':445
- '14#.#36.143.133':445
- '14#.#36.197.96':445
- '14#.#36.0.150':445
- '14#.#36.23.196':445
- '14#.#36.72.236':445
- '14#.#36.217.204':445
- '14#.#36.222.64':445
- '14#.#36.135.46':445
- '14#.#36.146.190':445
- '14#.#36.81.148':139
- '14#.#36.135.81':139
- '14#.#36.87.34':139
- '14#.#36.126.22':139
- '14#.#36.111.146':139
- '14#.#36.45.27':445
- '14#.#36.67.152':445
- '14#.#36.252.162':139
- '14#.#36.90.228':139
- '14#.#36.202.46':139
- '14#.#36.135.39':445
- '14#.#36.203.204':445
- '14#.#36.16.32':445
- '14#.#36.108.193':445
- '14#.#36.234.20':445
- '14#.#36.143.29':445
- '14#.#36.235.182':445
- '14#.#36.30.224':445
- '14#.#36.183.24':445
- '14#.#36.141.147':445
- '14#.#36.24.153':445
- '14#.#36.20.174':445
- '14#.#36.27.78':445
- '14#.#36.127.55':445
- '14#.#36.16.120':445
- '14#.#36.97.182':445
- '14#.#36.29.4':445
- '14#.#36.49.175':445
- '14#.#36.75.62':445
- '14#.#36.82.117':445
- '14#.#36.77.201':445
- '14#.#36.214.220':445
- '14#.#36.97.182':139
- '14#.#36.29.4':139
- '14#.#36.135.39':139
- '14#.#36.23.196':139
- '14#.#36.72.236':139
- '14#.#36.77.201':139
- '14#.#36.214.220':139
- '14#.#36.127.55':139
- '14#.#36.16.120':139
- '14#.#36.27.78':139
- '14#.#36.217.204':139
- '14#.#36.197.96':139
- '14#.#36.0.150':139
- '14#.#36.146.190':139
- '14#.#36.67.152':139
- '14#.#36.45.27':139
- '14#.#36.222.64':139
- '14#.#36.135.46':139
- '14#.#36.189.224':139
- '14#.#36.76.105':139
- '14#.#36.143.133':139
- '14#.#36.82.117':139
- '14#.#36.229.167':139
- '14#.#36.101.134':139
- '14#.#36.66.57':139
- '14#.#36.235.182':139
- '14#.#36.30.224':139
- '14#.#36.241.37':139
- '14#.#36.21.201':139
- '14#.#36.85.156':139
- '14#.#36.27.252':139
- '14#.#36.115.43':139
- '14#.#36.183.24':139
- '14#.#36.234.20':139
- '14#.#36.143.29':139
- '14#.#36.20.174':139
- '14#.#36.49.175':139
- '14#.#36.75.62':139
- '14#.#36.141.147':139
- '14#.#36.24.153':139
- '14#.#36.16.32':139
- '14#.#36.108.193':139
- '14#.#36.203.204':139
- '14#.#36.66.57':445
- '14#.#36.204.64':139
- '14#.#36.5.207':139
- '14#.#36.33.227':139
- '14#.#36.131.124':139
- '14#.#36.64.3':139
- '14#.#36.59.102':139
- '14#.#36.83.209':139
- '14#.#36.225.6':139
- '14#.#36.84.195':139
- '14#.#36.166.205':139
- '14#.#36.44.144':139
- '14#.#36.119.150':139
- '14#.#36.23.217':139
- '14#.#36.171.212':139
- '14#.#36.72.60':139
- '14#.#36.79.185':139
- '14#.#36.74.176':139
- '14#.#36.27.139':139
- '14#.#36.50.224':139
- '14#.#36.34.83':139
- '14#.#36.157.34':139
- '14#.#36.20.250':139
- '14#.#36.114.116':445
- '14#.#36.10.114':445
- '14#.#36.211.173':139
- '14#.#36.194.74':139
- '14#.#36.173.194':139
- '14#.#36.8.140':445
- '14#.#36.166.151':445
- '14#.#36.255.19':445
- '14#.#36.182.150':445
- '14#.#36.173.214':445
- '14#.#36.74.159':139
- '14#.#36.49.199':139
- '14#.#36.47.56':139
- '14#.#36.4.161':139
- '14#.#36.247.146':139
- '14#.#36.47.239':139
- '14#.#36.180.159':139
- '14#.#36.35.81':139
- '14#.#36.33.84':139
- '14#.#36.121.49':139
- '14#.#36.133.21':139
- '14#.#36.252.162':445
- '14#.#36.197.96':9988
- '14#.#36.202.46':445
- '14#.#36.135.81':445
- '14#.#36.90.228':445
- '14#.#36.23.196':9988
- '14#.#36.217.204':9988
- '14#.#36.135.46':9988
- '14#.#36.76.105':9988
- '14#.#36.189.224':9988
- '14#.#36.81.148':445
- '14#.#36.115.43':445
- '14#.#36.85.156':445
- '14#.#36.27.252':445
- '14#.#36.229.167':445
- '14#.#36.101.134':445
- '14#.#36.111.146':445
- '14#.#36.87.34':445
- '14#.#36.126.22':445
- '14#.#36.241.37':445
- '14#.#36.21.201':445
- '14#.#36.135.39':9988
- '14#.#36.85.51':139
- '14#.#36.55.222':139
- '14#.#36.86.242':139
- '14#.#36.8.140':139
- '14#.#36.166.151':139
- '14#.#36.78.232':139
- '14#.#36.176.131':139
- '14#.#36.232.16':139
- '14#.#36.85.165':139
- '14#.#36.6.78':139
- '14#.#36.255.19':139
- '14#.#36.229.167':9988
- '14#.#36.85.156':9988
- '14#.#36.235.182':9988
- '14#.#36.214.220':9988
- '14#.#36.141.147':9988
- '14#.#36.182.150':139
- '14#.#36.173.214':139
- '14#.#36.10.114':139
- '14#.#36.87.34':9988
- '14#.#36.114.116':139