Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WER39ac.dir00\svchost.exe.mdmp 16325836412032436
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER39ac.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '21#.#5.58.59':139
- '21#.#5.62.249':139
- '21#.#5.103.75':139
- '21#.#5.217.226':139
- '21#.25.23.2':139
- '21#.#5.132.131':139
- '21#.#5.16.235':139
- '21#.#5.76.16':139
- '21#.#5.22.75':139
- '21#.#5.118.33':139
- '21#.25.7.25':139
- '21#.#5.220.214':139
- '21#.#5.214.111':139
- '21#.#5.18.155':139
- '21#.#5.220.152':139
- '21#.#5.134.197':139
- '21#.#5.34.78':139
- '21#.#5.87.59':139
- '21#.#5.205.60':139
- '21#.#5.61.74':139
- '21#.#5.78.34':139
- '21#.#5.19.78':139
- '21#.#5.21.123':139
- '21#.#5.69.170':445
- '21#.#5.61.37':445
- '21#.#5.85.51':445
- '21#.#5.250.115':139
- '21#.#5.51.36':445
- '21#.#5.90.38':445
- '21#.#5.24.222':445
- '21#.#5.57.25':445
- '21#.#5.99.194':445
- '21#.#5.52.79':445
- '21#.#5.33.125':445
- '21#.#5.10.49':139
- '21#.#5.10.11':139
- '21#.#5.48.236':139
- '21#.#5.40.41':139
- '21#.25.6.51':139
- '21#.#5.181.9':139
- '21#.#5.175.71':139
- '21#.#5.237.123':139
- '21#.#5.60.191':139
- '21#.#5.158.3':139
- '21#.#5.3.230':139
- '21#.#5.205.206':139
- '21#.#5.47.93':445
- '21#.#5.2.247':445
- '21#.#5.21.160':445
- '21#.#5.246.237':445
- '21#.#5.116.23':445
- '21#.#5.178.219':445
- '21#.#5.73.157':445
- '21#.#5.215.73':445
- '21#.#5.158.27':445
- '21#.#5.34.66':445
- '21#.#5.96.63':445
- '21#.#5.234.204':445
- '21#.#5.143.234':445
- '21#.#5.202.12':445
- '21#.#5.65.155':445
- '21#.#5.169.31':445
- '21#.#5.184.144':445
- '21#.#5.181.151':445
- '21#.#5.96.163':445
- '21#.#5.56.80':445
- '21#.#5.53.143':445
- '21#.#5.149.84':445
- '21#.#5.67.215':445
- '21#.#5.99.194':139
- '21#.#5.24.222':139
- '21#.#5.33.125':139
- '21#.#5.90.38':139
- '21#.#5.52.79':139
- '21#.#5.57.25':139
- '21#.#5.251.212':139
- '21#.#5.95.237':139
- '21#.#5.37.152':139
- '21#.#5.250.57':139
- '21#.#5.153.229':139
- '21#.#5.188.99':445
- '21#.#5.165.0':445
- '21#.#5.113.82':445
- '21#.#5.119.16':445
- '21#.#5.254.83':445
- '21#.#5.93.155':445
- '21#.#5.69.170':139
- '21#.#5.61.37':139
- '21#.#5.85.51':139
- '21#.#5.36.88':445
- '21#.#5.51.36':139
- '21#.#5.250.57':445
- '21#.#5.230.161':139
- '21#.#5.188.171':139
- '21#.#5.120.250':139
- '21#.#5.252.95':139
- '21#.#5.250.123':139
- '21#.#5.101.141':139
- '21#.#5.162.237':139
- '21#.#5.56.60':139
- '21#.#5.67.133':139
- '21#.#5.115.227':139
- '21#.#5.249.115':139
- '21#.#5.17.176':139
- '21#.#5.133.17':139
- '21#.#5.176.107':139
- '21#.#5.171.125':139
- '21#.#5.53.218':139
- '21#.#5.200.129':139
- '21#.#5.198.44':139
- '21#.#5.65.94':139
- '21#.#5.44.53':139
- '21#.#5.139.102':139
- '21#.#5.150.77':139
- '21#.#5.203.128':139
- '21#.#5.51.70':139
- '21#.#5.91.189':139
- '21#.#5.79.192':139
- '21#.#5.192.172':139
- '21#.#5.173.127':139
- '21#.#5.232.210':139
- '21#.#5.156.1':139
- '21#.#5.125.11':139
- '21#.#5.28.232':139
- '21#.#5.235.232':139
- '21#.#5.213.235':139
- '21#.#5.13.147':139
- '21#.#5.250.19':139
- '21#.#5.52.248':139
- '21#.#5.141.223':139
- '21#.#5.248.187':139
- '21#.#5.97.212':139
- '21#.#5.212.59':139
- '21#.#5.20.244':139
- '21#.25.30.0':139
- '21#.#5.118.238':139
- '21#.#5.49.119':139
- '21#.#5.169.198':139
- '21#.#5.87.59':445
- '21#.#5.205.60':445
- '21#.#5.61.74':445
- '21#.#5.78.34':445
- '21#.#5.19.78':445
- '21#.#5.217.226':445
- '21#.#5.58.59':445
- '21#.#5.132.131':445
- '21#.#5.62.249':445
- '21#.25.23.2':445
- '21#.#5.103.75':445
- '21#.#5.95.237':445
- '21#.#5.205.206':445
- '21#.#5.251.212':445
- '21#.#5.153.229':445
- '21#.#5.37.152':445
- '21#.#5.220.152':445
- '21#.#5.214.111':445
- '21#.#5.34.78':445
- '21#.#5.220.214':445
- '21#.#5.134.197':445
- '21#.#5.18.155':445
- '21#.#5.118.33':445
- '21#.#5.175.71':445
- '21#.#5.237.123':445
- '21#.#5.60.191':445
- '21#.#5.158.3':445
- '21#.#5.3.230':445
- '21#.#5.250.115':445
- '21#.#5.113.14':139
- '21#.#5.36.42':139
- '21#.#5.173.208':139
- '21#.#5.75.128':139
- '21#.#5.252.75':139
- '21#.#5.76.16':445
- '21#.#5.21.123':445
- '21#.#5.16.235':445
- '21#.25.7.25':445
- '21#.#5.22.75':445
- '21#.#5.40.41':445
- '21#.#5.10.11':445
- '21#.#5.181.9':445
- '21#.#5.10.49':445
- '21#.25.6.51':445
- '21#.#5.48.236':445
- '21#.#5.194.235':445
- '21#.#5.21.146':445
- '21#.#5.72.209':445
- '21#.#5.234.122':445
- '21#.#5.25.73':445
- '21#.#5.110.214':445
- '21#.#5.153.189':445
- '21#.#5.93.150':445
- '21#.#5.35.54':445
- '21#.#5.15.145':445
- '21#.25.7.75':445
- '21#.#5.165.122':139
- '21#.#5.102.165':139
- '21#.#5.201.80':139
- '21#.#5.112.206':139
- '21#.#5.157.179':139
- '21#.#5.122.220':445
- '21#.#5.129.115':445
- '21#.#5.208.234':445
- '21#.#5.95.216':445
- '21#.#5.64.175':445
- '21#.#5.188.247':445
- '21#.25.5.27':445
- '21#.#5.60.216':445
- '21#.#5.44.81':445
- '21#.#5.109.133':445
- '21#.#5.13.13':445
- '21#.#5.105.72':445
- '21#.#5.226.49':445
- '21#.#5.45.103':445
- '21#.#5.162.115':445
- '21#.#5.96.239':445
- '21#.#5.202.122':445
- '21#.#5.52.17':445
- '21#.#5.191.217':445
- '21#.#5.188.101':445
- '21#.#5.169.30':445
- '21#.#5.132.31':445
- '21#.#5.179.139':445
- '21#.#5.237.14':445
- '21#.#5.22.54':445
- '21#.#5.46.237':445
- '21#.#5.29.47':445
- '21#.#5.35.188':445
- '21#.#5.15.35':445
- '21#.#5.3.227':139
- '21#.#5.35.54':139
- '21#.#5.153.189':139
- '21#.25.7.75':139
- '21#.#5.110.214':139
- '21#.#5.15.145':139
- '21#.#5.93.150':139
- '21#.#5.188.101':139
- '21#.#5.169.30':139
- '21#.#5.179.139':139
- '21#.#5.132.31':139
- '21#.25.5.27':139
- '21#.#5.95.216':139
- '21#.#5.129.115':139
- '21#.#5.188.247':139
- '21#.#5.122.220':139
- '21#.#5.64.175':139
- '21#.#5.208.234':139
- '21#.#5.194.235':139
- '21#.#5.21.146':139
- '21#.#5.72.209':139
- '21#.#5.234.122':139
- '21#.#5.25.73':139
- '21#.#5.191.217':139
- '21#.#5.96.239':139
- '21#.#5.45.103':139
- '21#.#5.52.17':139
- '21#.#5.226.49':139
- '21#.#5.202.122':139
- '21#.#5.162.115':139
- '21#.#5.58.241':139
- '21#.#5.44.50':139
- '21#.#5.179.102':139
- '21#.#5.9.172':139
- '21#.#5.58.43':139
- '21#.#5.46.237':139
- '21#.#5.29.47':139
- '21#.#5.237.14':139
- '21#.#5.35.188':139
- '21#.#5.15.35':139
- '21#.#5.22.54':139
- '21#.#5.109.133':139
- '21#.#5.44.81':139
- '21#.#5.60.216':139
- '21#.#5.13.13':139
- '21#.#5.105.72':139
- '21#.#5.9.172':445
- '21#.#5.73.157':139
- '21#.#5.215.73':139
- '21#.#5.158.27':139
- '21#.#5.34.66':139
- '21#.#5.96.63':139
- '21#.#5.67.215':139
- '21#.#5.188.99':139
- '21#.#5.165.0':139
- '21#.#5.113.82':139
- '21#.#5.119.16':139
- '21#.#5.254.83':139
- '21#.#5.181.151':139
- '21#.#5.96.163':139
- '21#.#5.56.80':139
- '21#.#5.53.143':139
- '21#.#5.149.84':139
- '21#.#5.246.237':139
- '21#.#5.2.247':139
- '21#.#5.178.219':139
- '21#.#5.47.93':139
- '21#.#5.116.23':139
- '21#.#5.21.160':139
- '21#.#5.93.155':139
- '21#.#5.60.88':445
- '21#.25.8.66':445
- '21#.#5.88.37':445
- '21#.#5.144.102':445
- '21#.#5.36.144':445
- '21#.#5.97.170':445
- '21#.#5.14.161':445
- '21#.#5.53.92':445
- '21#.#5.160.188':445
- '21#.#5.157.205':445
- '21#.#5.189.48':445
- '21#.#5.184.73':445
- '21#.#5.163.66':445
- '21#.#5.75.252':445
- '21#.#5.36.88':139
- '21#.#5.26.103':445
- '21#.#5.88.73':445
- '21#.#5.41.194':445
- '21#.#5.106.205':445
- '21#.#5.162.145':445
- '21#.#5.6.223':445
- '21#.#5.228.161':445
- '21#.#5.184.144':139
- '21#.#5.194.235':9988
- '21#.#5.169.30':9988
- '21#.#5.35.54':9988
- '21#.#5.64.175':9988
- '21#.#5.72.209':9988
- '21#.#5.60.216':9988
- '21#.#5.75.252':139
- '21#.#5.184.73':139
- '21#.#5.26.103':139
- '21#.#5.188.101':9988
- '21#.25.5.27':9988
- '21#.#5.58.43':445
- '21#.#5.157.179':445
- '21#.#5.44.50':445
- '21#.#5.165.122':445
- '21#.#5.102.165':445
- '21#.#5.58.241':445
- '21#.#5.179.102':445
- '21#.#5.15.35':9988
- '21#.#5.201.80':445
- '21#.#5.3.227':445
- '21#.#5.112.206':445
- '21#.#5.163.66':139
- '21#.#5.160.188':139
- '21#.#5.14.161':139
- '21#.#5.189.48':139
- '21#.#5.97.170':139
- '21#.#5.157.205':139
- '21#.#5.53.92':139
- '21#.#5.234.204':139
- '21#.#5.143.234':139
- '21#.#5.202.12':139
- '21#.#5.65.155':139
- '21#.#5.169.31':139
- '21#.#5.162.145':139
- '21#.#5.41.194':139
- '21#.#5.228.161':139
- '21#.#5.88.73':139
- '21#.#5.6.223':139
- '21#.#5.106.205':139
- '21#.#5.60.88':139
- '21#.25.8.66':139
- '21#.#5.88.37':139
- '21#.#5.144.102':139
- '21#.#5.36.144':139