Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1132 -dm 7 7 %TEMP%\WEReda5.dir00\svchost.exe.mdmp 16325836412032176
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WEReda5.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- '81.##0.155.18':139
- '81.##0.40.225':139
- '81.##0.204.158':139
- '81.##0.7.253':139
- '81.##0.6.157':139
- '81.##0.40.24':139
- '81.##0.2.138':139
- '81.##0.101.54':139
- '81.##0.25.173':139
- '81.##0.22.18':139
- '81.##0.27.157':139
- '81.##0.190.194':139
- '81.##0.47.162':139
- '81.##0.181.198':139
- '81.##0.116.122':139
- '81.##0.65.140':139
- '81.##0.221.17':139
- '81.##0.125.133':139
- '81.##0.142.133':139
- '81.##0.178.233':139
- '81.##0.124.248':139
- '81.##0.155.46':139
- '81.##0.7.201':139
- '81.##0.78.231':139
- '81.##0.177.24':445
- '81.##0.183.10':445
- '81.##0.91.156':445
- '81.##0.31.169':445
- '81.##0.216.103':445
- '81.##0.131.216':445
- '81.##0.206.220':445
- '81.##0.231.212':445
- '81.##0.75.231':445
- '81.##0.220.176':445
- '81.##0.245.235':445
- '81.##0.212.179':445
- '81.##0.5.190':139
- '81.##0.203.75':139
- '81.##0.16.138':139
- '81.##0.120.65':139
- '81.##0.197.95':139
- '81.##0.168.128':139
- '81.##0.79.15':445
- '81.##0.27.157':445
- '81.##0.7.150':445
- '81.##0.176.211':139
- '81.##0.164.91':139
- '81.##0.240.239':139
- '81.##0.140.143':139
- '81.##0.105.53':445
- '81.##0.8.198':445
- '81.##0.36.105':445
- '81.##0.38.55':445
- '81.##0.153.10':445
- '81.##0.143.152':445
- '81.##0.104.129':139
- '81.##0.216.103':139
- '81.##0.131.216':139
- '81.##0.31.192':445
- '81.##0.7.150':139
- '81.##0.31.169':139
- '81.##0.188.124':445
- '81.##0.219.188':445
- '81.##0.66.204':445
- '81.##0.247.165':445
- '81.##0.65.186':445
- '81.##0.124.213':445
- '81.##0.76.132':445
- '81.##0.92.58':445
- '81.##0.9.227':445
- '81.##0.87.215':445
- '81.##0.117.154':445
- '81.##0.93.247':445
- '81.#80.1.74':139
- '81.#80.46.2':139
- '81.##0.89.45':139
- '81.##0.136.126':139
- '81.##0.49.57':139
- '81.##0.74.115':139
- '81.##0.29.166':139
- '81.##0.14.30':139
- '81.##0.61.139':139
- '81.##0.78.254':139
- '81.##0.133.233':139
- '81.##0.105.96':139
- '81.##0.177.24':139
- '81.##0.220.176':139
- '81.##0.206.220':139
- '81.##0.91.156':139
- '81.##0.59.25':139
- '81.##0.183.10':139
- '81.##0.75.231':139
- '81.##0.119.142':139
- '81.##0.127.16':139
- '81.##0.245.235':139
- '81.##0.212.179':139
- '81.##0.231.212':139
- '81.##0.86.89':139
- '81.##0.36.63':139
- '81.##0.176.104':139
- '81.##0.107.143':139
- '81.##0.230.247':139
- '81.##0.32.195':139
- '81.##0.114.153':139
- '81.##0.248.173':139
- '81.##0.13.12':139
- '81.##0.110.40':139
- '81.##0.185.110':139
- '81.##0.150.28':139
- '81.##0.158.204':139
- '81.##0.25.72':139
- '81.##0.34.120':139
- '81.#80.40.6':139
- '81.##0.6.230':139
- '81.##0.75.190':139
- '81.##0.253.114':139
- '81.##0.51.148':139
- '81.##0.169.244':139
- '81.##0.120.114':139
- '81.##0.61.15':139
- '81.##0.25.80':139
- '81.##0.92.122':139
- '81.##0.24.111':139
- '81.##0.244.23':139
- '81.##0.90.38':139
- '81.##0.60.57':139
- '81.##0.222.133':139
- '81.##0.110.47':139
- '81.##0.81.130':139
- '81.##0.164.115':139
- '81.##0.102.188':139
- '81.##0.75.116':139
- '81.#80.0.18':139
- '81.##0.36.167':139
- '81.##0.47.59':139
- '81.##0.96.196':139
- '81.##0.88.106':139
- '81.##0.61.89':139
- '81.##0.241.35':139
- '81.##0.13.22':139
- '81.##0.187.71':139
- '81.##0.91.170':139
- '81.##0.33.236':139
- '81.##0.151.116':139
- '81.##0.138.223':139
- '81.##0.135.219':139
- '81.##0.221.17':445
- '81.##0.125.133':445
- '81.##0.6.157':445
- '81.##0.29.166':445
- '81.##0.140.143':445
- '81.##0.65.140':445
- '81.##0.124.248':445
- '81.##0.155.46':445
- '81.##0.116.122':445
- '81.##0.178.233':445
- '81.##0.7.253':445
- '81.##0.7.201':445
- '81.##0.49.57':445
- '81.##0.74.115':445
- '81.#80.1.74':445
- '81.##0.119.142':445
- '81.##0.127.16':445
- '81.##0.136.126':445
- '81.##0.133.233':445
- '81.##0.14.30':445
- '81.##0.105.96':445
- '81.##0.78.254':445
- '81.##0.89.45':445
- '81.#80.46.2':445
- '81.##0.120.65':445
- '81.##0.25.173':445
- '81.##0.203.75':445
- '81.##0.168.128':445
- '81.##0.5.190':445
- '81.##0.164.91':445
- '81.##0.240.239':445
- '81.##0.98.249':139
- '81.##0.219.57':139
- '81.##0.2.138':445
- '81.##0.176.211':445
- '81.##0.16.138':445
- '81.##0.47.162':445
- '81.##0.155.18':445
- '81.##0.40.225':445
- '81.##0.181.198':445
- '81.##0.142.133':445
- '81.##0.78.231':445
- '81.##0.204.158':445
- '81.##0.197.95':445
- '81.##0.190.194':445
- '81.##0.40.24':445
- '81.##0.22.18':445
- '81.##0.101.54':445
- '81.##0.64.87':445
- '81.##0.95.34':445
- '81.#80.0.40':445
- '81.##0.147.88':445
- '81.##0.130.14':445
- '81.##0.16.130':445
- '81.##0.165.2':445
- '81.##0.175.4':445
- '81.##0.156.221':445
- '81.##0.54.117':445
- '81.##0.139.106':445
- '81.##0.119.7':445
- '81.##0.71.106':445
- '81.##0.152.54':445
- '81.##0.0.157':445
- '81.##0.196.123':445
- '81.##0.245.4':139
- '81.##0.76.245':139
- '81.##0.52.205':445
- '81.##0.172.202':445
- '81.##0.195.54':445
- '81.##0.82.27':445
- '81.##0.73.180':445
- '81.##0.147.109':445
- '81.##0.160.218':445
- '81.##0.203.84':445
- '81.##0.3.137':445
- '81.##0.157.191':445
- '81.#80.56.9':445
- '81.##0.3.205':445
- '81.##0.67.250':445
- '81.##0.249.227':445
- '81.##0.212.143':445
- '81.##0.63.212':445
- '81.##0.147.22':445
- '81.##0.121.81':445
- '81.##0.26.174':445
- '81.##0.32.225':445
- '81.##0.211.171':445
- '81.##0.225.113':445
- '81.##0.61.157':445
- '81.##0.116.39':445
- '81.##0.158.116':445
- '81.##0.190.53':445
- '81.#80.18.4':445
- '81.##0.247.167':445
- '81.##0.165.87':445
- '81.##0.191.73':445
- '81.##0.54.23':445
- '81.##0.48.46':139
- '81.##0.130.14':139
- '81.##0.82.27':139
- '81.#80.0.40':139
- '81.##0.165.2':139
- '81.##0.147.109':139
- '81.##0.95.34':139
- '81.##0.156.221':139
- '81.##0.61.157':139
- '81.##0.71.106':139
- '81.##0.139.106':139
- '81.##0.119.7':139
- '81.##0.175.4':139
- '81.##0.0.157':139
- '81.##0.16.130':139
- '81.##0.195.54':139
- '81.##0.172.202':139
- '81.##0.160.218':139
- '81.##0.54.23':139
- '81.##0.191.73':139
- '81.##0.152.54':139
- '81.##0.147.88':139
- '81.##0.52.205':139
- '81.##0.196.123':139
- '81.##0.73.180':139
- '81.##0.3.137':139
- '81.##0.121.81':139
- '81.##0.26.174':139
- '81.##0.67.250':139
- '81.##0.203.84':139
- '81.##0.157.191':139
- '81.##0.63.212':139
- '81.##0.96.38':139
- '81.##0.130.192':139
- '81.##0.147.22':139
- '81.##0.249.227':139
- '81.##0.212.143':139
- '81.##0.32.225':139
- '81.##0.211.171':139
- '81.##0.165.87':139
- '81.##0.54.117':139
- '81.##0.116.39':139
- '81.##0.158.116':139
- '81.#80.56.9':139
- '81.##0.247.167':139
- '81.##0.3.205':139
- '81.##0.225.113':139
- '81.##0.190.53':139
- '81.#80.18.4':139
- '81.##0.105.53':139
- '81.##0.36.105':139
- '81.##0.28.54':445
- '81.##0.153.10':139
- '81.##0.143.152':139
- '81.##0.8.198':139
- '81.##0.189.217':445
- '81.##0.169.98':445
- '81.##0.17.22':445
- '81.##0.65.88':445
- '81.##0.24.16':445
- '81.##0.225.10':445
- '81.##0.66.204':139
- '81.##0.31.192':139
- '81.##0.117.154':139
- '81.##0.124.213':139
- '81.##0.188.124':139
- '81.##0.219.188':139
- '81.##0.9.227':139
- '81.##0.87.215':139
- '81.##0.92.58':139
- '81.##0.76.132':139
- '81.##0.38.55':139
- '81.##0.93.247':139
- '81.##0.178.19':445
- '81.##0.45.233':445
- '81.##0.38.122':445
- '81.#80.6.8':445
- '81.##0.33.199':445
- '81.##0.79.169':445
- '81.##0.143.146':445
- '81.##0.71.135':445
- '81.##0.216.143':445
- '81.##0.44.72':445
- '81.##0.172.34':445
- '81.##0.48.97':445
- '81.#80.48.7':445
- '81.##0.233.119':445
- '81.##0.198.210':445
- '81.##0.119.178':445
- '81.##0.237.40':445
- '81.##0.123.235':445
- '81.##0.13.160':445
- '81.##0.130.69':445
- '81.##0.8.216':445
- '81.##0.10.97':445
- '81.##0.177.184':445
- '81.##0.38.140':445
- '81.##0.65.186':139
- '81.##0.28.54':139
- '81.##0.225.10':139
- '81.##0.65.88':139
- '81.##0.147.88':9988
- '81.##0.116.39':9988
- '81.##0.3.205':9988
- '81.##0.17.22':139
- '81.##0.237.40':139
- '81.##0.119.178':139
- '81.##0.189.217':139
- '81.##0.24.16':139
- '81.##0.169.98':139
- '81.##0.48.46':445
- '81.##0.76.245':445
- '81.#80.0.40':9988
- '81.##0.96.38':445
- '81.##0.245.4':445
- '81.##0.130.192':445
- '81.##0.172.202':9988
- '81.##0.52.205':9988
- '81.##0.139.106':9988
- '81.##0.130.14':9988
- '81.##0.195.54':9988
- '81.##0.196.123':9988
- '81.##0.45.233':139
- '81.##0.44.72':139
- '81.##0.172.34':139
- '81.##0.177.184':139
- '81.#80.6.8':139
- '81.##0.13.160':139
- '81.##0.216.143':139
- '81.##0.64.87':139
- '81.##0.247.165':139
- '81.##0.48.97':139
- '81.##0.71.135':139
- '81.##0.143.146':139
- '81.##0.10.97':139
- '81.##0.130.69':139
- '81.##0.198.210':139
- '81.##0.233.119':139
- '81.##0.123.235':139
- '81.#80.48.7':139
- '81.##0.79.169':139
- '81.##0.38.122':139
- '81.##0.38.140':139
- '81.##0.33.199':139
- '81.##0.8.216':139
- '81.##0.178.19':139