Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1108 -dm 7 7 %TEMP%\WER07c4.dir00\svchost.exe.mdmp 16325836412029040
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER07c4.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '84.##6.203.27':139
- '84.##6.225.203':139
- '84.##6.255.52':445
- '84.##6.106.196':445
- '84.##6.11.116':139
- '84.##6.70.99':139
- '84.##6.49.75':139
- '84.##6.50.105':139
- '84.##6.97.50':139
- '84.##6.53.79':445
- '84.##6.10.217':445
- '84.##6.163.186':445
- '84.##6.197.76':445
- '84.##6.133.231':445
- '84.##6.42.132':445
- '84.##6.197.48':445
- '84.##6.87.107':445
- '84.##6.18.148':445
- '84.##6.13.118':445
- '84.##6.52.178':139
- '84.##6.21.24':139
- '84.##6.175.232':139
- '84.##6.224.156':139
- '84.#06.1.7':139
- '84.##6.216.229':139
- '84.##6.51.171':139
- '84.##6.59.60':139
- '84.##6.43.163':139
- '84.#06.5.50':139
- '84.##6.151.92':139
- '84.##6.11.161':139
- '84.##6.76.192':139
- '84.##6.43.116':139
- '84.##6.175.79':139
- '84.##6.236.178':139
- '84.##6.58.50':139
- '84.##6.92.206':139
- '84.##6.236.87':139
- '84.#06.85.9':139
- '84.##6.106.196':139
- '84.##6.109.110':445
- '84.##6.56.127':445
- '84.##6.99.15':445
- '84.#06.8.96':445
- '84.##6.34.79':445
- '84.##6.10.112':445
- '84.##6.31.29':445
- '84.##6.160.100':445
- '84.##6.157.37':445
- '84.##6.68.55':445
- '84.##6.14.137':445
- '84.##6.177.73':445
- '84.##6.84.75':445
- '84.##6.16.200':445
- '84.##6.69.81':445
- '84.##6.42.146':445
- '84.##6.179.5':445
- '84.##6.178.69':445
- '84.##6.35.179':445
- '84.##6.97.96':445
- '84.##6.42.132':139
- '84.##6.18.148':139
- '84.##6.10.217':139
- '84.##6.163.186':139
- '84.##6.13.118':139
- '84.##6.53.79':139
- '84.##6.255.52':139
- '84.##6.197.48':139
- '84.##6.87.107':139
- '84.##6.133.231':139
- '84.##6.210.206':445
- '84.##6.14.45':445
- '84.##6.45.151':445
- '84.##6.40.218':445
- '84.##6.93.20':445
- '84.##6.219.28':445
- '84.##6.197.76':139
- '84.##6.158.92':445
- '84.##6.221.106':445
- '84.##6.72.41':139
- '84.##6.157.72':139
- '84.##6.128.29':445
- '84.##6.211.4':139
- '84.##6.189.157':139
- '84.##6.155.84':139
- '84.##6.120.154':139
- '84.##6.124.189':139
- '84.##6.28.173':139
- '84.##6.231.246':445
- '84.##6.122.23':445
- '84.##6.43.122':445
- '84.##6.143.112':445
- '84.##6.22.232':445
- '84.##6.121.43':445
- '84.##6.49.141':445
- '84.##6.246.203':445
- '84.##6.119.120':445
- '84.##6.161.3':445
- '84.##6.151.192':139
- '84.##6.7.190':445
- '84.##6.167.167':445
- '84.##6.120.154':445
- '84.##6.151.192':445
- '84.##6.187.136':445
- '84.##6.18.201':139
- '84.##6.64.208':139
- '84.##6.170.190':139
- '84.##6.41.72':139
- '84.##6.155.84':445
- '84.##6.187.136':139
- '84.##6.211.4':445
- '84.##6.167.167':139
- '84.##6.7.190':139
- '84.##6.72.41':445
- '84.##6.124.189':445
- '84.##6.28.173':445
- '84.##6.157.72':445
- '84.##6.189.157':445
- '84.##6.213.14':445
- '84.##6.203.27':445
- '84.##6.225.203':445
- '84.##6.231.246':139
- '84.##6.128.29':139
- '84.##6.11.116':445
- '84.##6.70.99':445
- '84.##6.49.75':445
- '84.##6.50.105':445
- '84.##6.97.50':445
- '84.##6.246.203':139
- '84.##6.22.232':139
- '84.##6.122.23':139
- '84.##6.213.14':139
- '84.##6.143.112':139
- '84.##6.43.122':139
- '84.##6.161.3':139
- '84.##6.49.141':139
- '84.##6.121.43':139
- '84.##6.119.120':139
- '84.##6.52.178':445
- '84.##6.21.24':445
- '84.##6.175.232':445
- '84.##6.224.156':445
- '84.#06.1.7':445
- '84.##6.216.229':445
- '84.##6.51.171':445
- '84.##6.59.60':445
- '84.##6.43.163':445
- '84.#06.5.50':445
- '84.##6.151.92':445
- '84.##6.11.161':445
- '84.##6.76.192':445
- '84.##6.43.116':445
- '84.##6.175.79':445
- '84.##6.236.178':445
- '84.##6.58.50':445
- '84.##6.92.206':445
- '84.##6.236.87':445
- '84.#06.85.9':445
- '84.##6.3.199':445
- '84.##6.77.21':445
- '84.##6.39.141':139
- '84.##6.227.50':445
- '84.##6.169.226':445
- '84.##6.241.84':445
- '84.##6.136.23':445
- '84.##6.168.34':445
- '84.##6.64.109':445
- '84.##6.29.35':139
- '84.##6.178.190':139
- '84.##6.34.152':139
- '84.##6.187.45':139
- '84.##6.44.213':139
- '84.##6.157.114':139
- '84.##6.204.33':139
- '84.##6.63.63':139
- '84.##6.162.27':139
- '84.##6.21.112':139
- '84.##6.193.140':445
- '84.##6.181.154':445
- '84.##6.61.182':445
- '84.##6.38.84':445
- '84.##6.64.71':445
- '84.##6.189.61':445
- '84.##6.154.196':445
- '84.##6.245.173':445
- '84.##6.102.146':445
- '84.##6.242.202':445
- '84.##6.42.77':445
- '84.##6.200.162':445
- '84.##6.104.87':445
- '84.##6.216.144':445
- '84.##6.166.27':445
- '84.##6.180.145':445
- '84.##6.107.182':445
- '84.##6.119.199':445
- '84.##6.162.6':445
- '84.##6.215.114':445
- '84.##6.236.225':139
- '84.##6.104.87':139
- '84.##6.180.145':139
- '84.##6.166.27':139
- '84.##6.200.162':139
- '84.##6.215.114':139
- '84.##6.42.77':139
- '84.##6.119.199':139
- '84.##6.162.6':139
- '84.##6.107.182':139
- '84.##6.216.144':139
- '84.##6.169.226':139
- '84.##6.241.84':139
- '84.##6.3.199':139
- '84.##6.227.50':139
- '84.##6.168.34':139
- '84.##6.136.23':139
- '84.##6.193.140':139
- '84.##6.64.109':139
- '84.##6.77.21':139
- '84.##6.38.84':139
- '84.##6.105.45':139
- '84.##6.95.105':139
- '84.##6.54.38':139
- '84.##6.45.54':139
- '84.##6.91.199':139
- '84.##6.150.4':139
- '84.##6.62.149':139
- '84.##6.252.226':139
- '84.##6.49.223':139
- '84.##6.90.191':139
- '84.##6.61.182':139
- '84.##6.189.61':139
- '84.##6.64.71':139
- '84.##6.181.154':139
- '84.##6.242.202':139
- '84.##6.245.173':139
- '84.##6.138.23':139
- '84.##6.154.196':139
- '84.##6.102.146':139
- '84.##6.109.110':139
- '84.##6.56.127':139
- '84.##6.99.15':139
- '84.#06.8.96':139
- '84.##6.34.79':139
- '84.##6.10.112':139
- '84.##6.31.29':139
- '84.##6.160.100':139
- '84.##6.157.37':139
- '84.##6.68.55':139
- '84.##6.14.137':139
- '84.##6.177.73':139
- '84.##6.84.75':139
- '84.##6.16.200':139
- '84.##6.69.81':139
- '84.##6.42.146':139
- '84.##6.179.5':139
- '84.##6.178.69':139
- '84.##6.35.179':139
- '84.##6.97.96':139
- '84.##6.224.130':445
- '84.##6.48.31':445
- '84.##6.57.230':445
- '84.#06.0.58':445
- '84.##6.162.252':445
- '84.##6.81.32':445
- '84.##6.88.178':445
- '84.##6.19.250':445
- '84.##6.196.174':445
- '84.##6.46.219':445
- '84.##6.210.206':139
- '84.##6.14.45':139
- '84.##6.45.151':139
- '84.##6.40.218':139
- '84.##6.93.20':139
- '84.##6.219.28':139
- '84.##6.45.252':445
- '84.##6.158.92':139
- '84.##6.221.106':139
- '84.##6.88.178':139
- '84.##6.187.45':445
- '84.##6.44.213':445
- '84.##6.62.149':445
- '84.##6.236.225':445
- '84.##6.178.190':445
- '84.##6.162.27':445
- '84.##6.21.112':445
- '84.##6.157.114':445
- '84.##6.34.152':445
- '84.##6.150.4':445
- '84.##6.54.38':445
- '84.##6.45.54':445
- '84.##6.90.191':445
- '84.##6.138.23':445
- '84.##6.105.45':445
- '84.##6.252.226':445
- '84.##6.49.223':445
- '84.##6.95.105':445
- '84.##6.91.199':445
- '84.##6.204.33':445
- '84.#06.0.58':139
- '84.##6.224.130':139
- '84.##6.46.219':139
- '84.##6.57.230':139
- '84.##6.48.31':139
- '84.##6.196.174':139
- '84.##6.81.32':139
- '84.##6.162.252':139
- '84.##6.19.250':139
- '84.##6.45.252':139
- '84.##6.39.141':445
- '84.##6.3.199':9988
- '84.##6.63.63':445
- '84.##6.29.35':445
- '84.##6.227.50':9988
- '84.##6.42.77':9988
- '84.##6.200.162':9988
- '84.##6.162.6':9988
- '84.##6.180.145':9988