Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WER0734.dir00\svchost.exe.mdmp 16325836412032744
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER0734.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '21#.#13.2.150':139
- '21#.#13.5.207':139
- '21#.#13.223.237':139
- '21#.#13.215.197':139
- '21#.#13.65.106':139
- '21#.#13.151.74':139
- '21#.#13.0.104':139
- '21#.#13.194.93':139
- '21#.#13.189.13':139
- '21#.#13.196.13':139
- '21#.#13.238.171':139
- '21#.#13.125.22':139
- '21#.#13.96.148':139
- '21#.#13.40.224':139
- '21#.#13.142.8':139
- '21#.#13.129.99':139
- '21#.#13.51.186':139
- '21#.#13.16.172':139
- '21#.#13.163.23':139
- '21#.#13.75.238':139
- '21#.#13.114.181':139
- '21#.#13.12.142':139
- '21#.#13.9.166':139
- '21#.#13.71.175':445
- '21#.#13.25.10':445
- '21#.#13.176.52':445
- '21#.#13.31.39':139
- '21#.#13.107.16':139
- '21#.#13.187.2':445
- '21#.#13.241.214':445
- '21#.#13.97.6':445
- '21#.#13.57.180':445
- '21#.#13.167.204':445
- '21#.#13.75.242':445
- '21#.#13.52.104':139
- '21#.#13.51.163':139
- '21#.#13.51.33':139
- '21#.#13.191.219':139
- '21#.#13.25.194':139
- '21#.#13.85.103':139
- '21#.#13.171.17':139
- '21#.#13.184.181':139
- '21#.#13.212.174':139
- '21#.#13.149.87':139
- '21#.#13.2.141':139
- '21#.#13.104.107':139
- '21#.#13.56.176':445
- '21#.#13.55.145':445
- '21#.#13.236.96':445
- '21#.#13.128.32':445
- '21#.#13.97.57':445
- '21#.#13.34.105':445
- '21#.#13.206.54':445
- '21#.#13.60.217':445
- '21#.#13.131.183':445
- '21#.#13.164.150':445
- '21#.#13.20.227':445
- '21#.#13.206.109':445
- '21#.#13.28.218':445
- '21#.#13.204.234':445
- '21#.#13.168.201':445
- '21#.#13.252.67':445
- '21#.#13.164.38':445
- '21#.#13.104.131':445
- '21#.#13.59.68':445
- '21#.#13.27.210':445
- '21#.#13.71.184':445
- '21#.#13.23.94':445
- '21#.#13.252.110':445
- '21#.#13.57.180':139
- '21#.#13.241.214':139
- '21#.#13.75.242':139
- '21#.#13.187.2':139
- '21#.#13.167.204':139
- '21#.#13.97.6':139
- '21#.#13.113.172':139
- '21#.#13.246.113':139
- '21#.#13.117.208':139
- '21#.#13.74.152':139
- '21#.#13.79.176':139
- '21#.#13.25.10':139
- '21#.#13.151.172':445
- '21#.#13.160.151':445
- '21#.#13.33.73':445
- '21#.#13.197.252':445
- '21#.#13.79.105':445
- '21#.#13.92.177':445
- '21#.#13.176.52':139
- '21#.#13.71.175':139
- '21#.#13.15.253':445
- '21#.#13.120.110':445
- '21#.#13.43.175':445
- '21#.#13.74.152':445
- '21#.#13.26.156':139
- '21#.#13.248.251':139
- '21#.#13.204.92':139
- '21#.#13.98.172':139
- '21#.#13.94.11':139
- '21#.#13.134.249':139
- '21#.#13.89.77':139
- '21#.#13.73.252':139
- '21#.#13.30.173':139
- '21#.#13.232.69':139
- '21#.#13.195.225':139
- '21#.#13.172.95':139
- '21#.#13.244.97':139
- '21#.#13.164.246':139
- '21#.#13.34.112':139
- '21#.#13.69.61':139
- '21#.#13.234.129':139
- '21#.#13.18.126':139
- '21#.#13.235.25':139
- '21#.#13.94.235':139
- '21#.#13.20.0':139
- '21#.#13.169.81':139
- '21#.#13.116.206':139
- '21#.#13.197.181':139
- '21#.#13.65.197':139
- '21#.#13.27.25':139
- '21#.#13.79.145':139
- '21#.#13.199.169':139
- '21#.#13.70.228':139
- '21#.#13.196.90':139
- '21#.#13.3.145':139
- '21#.#13.124.76':139
- '21#.#13.75.212':139
- '21#.#13.39.76':139
- '21#.#13.16.197':139
- '21#.#13.74.202':139
- '21#.#13.165.17':139
- '21#.#13.12.103':139
- '21#.#13.182.50':139
- '21#.#13.24.57':139
- '21#.#13.62.84':139
- '21#.#13.185.220':139
- '21#.#13.36.37':139
- '21#.#13.143.124':139
- '21#.#13.236.184':139
- '21#.#13.117.217':139
- '21#.#13.125.22':445
- '21#.#13.215.197':445
- '21#.#13.75.238':445
- '21#.#13.114.181':445
- '21#.#13.163.23':445
- '21#.#13.65.106':445
- '21#.#13.151.74':445
- '21#.#13.196.13':445
- '21#.#13.5.207':445
- '21#.#13.223.237':445
- '21#.#13.2.150':445
- '21#.#13.9.166':445
- '21#.#13.246.113':445
- '21#.#13.129.99':445
- '21#.#13.113.172':445
- '21#.#13.79.176':445
- '21#.#13.117.208':445
- '21#.#13.51.186':445
- '21#.#13.16.172':445
- '21#.#13.12.142':445
- '21#.#13.40.224':445
- '21#.#13.142.8':445
- '21#.#13.96.148':445
- '21#.#13.52.104':445
- '21#.#13.31.39':445
- '21#.#13.212.174':445
- '21#.#13.149.87':445
- '21#.#13.184.181':445
- '21#.#13.107.16':445
- '21#.#13.101.201':139
- '21#.#13.180.211':139
- '21#.#13.201.147':139
- '21#.#13.41.43':139
- '21#.#13.1.243':139
- '21#.#13.104.107':445
- '21#.#13.194.93':445
- '21#.#13.25.194':445
- '21#.#13.0.104':445
- '21#.#13.238.171':445
- '21#.#13.189.13':445
- '21#.#13.85.103':445
- '21#.#13.171.17':445
- '21#.#13.2.141':445
- '21#.#13.51.33':445
- '21#.#13.191.219':445
- '21#.#13.51.163':445
- '21#.#13.29.148':445
- '21#.#13.83.152':445
- '21#.#13.46.238':445
- '21#.#13.22.103':445
- '21#.#13.79.102':445
- '21#.#13.13.83':445
- '21#.#13.49.66':445
- '21#.#13.231.32':445
- '21#.#13.166.49':445
- '21#.#13.75.13':445
- '21#.#13.154.74':445
- '21#.#13.118.32':445
- '21#.#13.200.176':139
- '21#.#13.61.111':139
- '21#.#13.51.32':139
- '21#.#13.226.154':139
- '21#.#13.181.226':139
- '21#.#13.236.140':445
- '21#.#13.42.135':445
- '21#.#13.78.68':445
- '21#.#13.209.187':445
- '21#.#13.132.240':445
- '21#.#13.179.81':445
- '21#.#13.209.117':445
- '21#.#13.209.73':445
- '21#.#13.240.80':445
- '21#.#13.13.76':445
- '21#.#13.150.15':445
- '21#.#13.99.29':445
- '21#.#13.116.99':445
- '21#.#13.223.76':445
- '21#.#13.26.246':445
- '21#.#13.223.241':445
- '21#.#13.133.215':445
- '21#.#13.183.3':445
- '21#.#13.9.57':445
- '21#.#13.157.9':445
- '21#.#13.57.54':445
- '21#.#13.109.109':445
- '21#.#13.19.215':445
- '21#.#13.50.157':445
- '21#.#13.197.42':445
- '21#.#13.187.40':445
- '21#.#13.182.207':445
- '21#.#13.242.218':445
- '21#.#13.158.81':445
- '21#.#13.166.49':139
- '21#.#13.49.66':139
- '21#.#13.154.74':139
- '21#.#13.13.83':139
- '21#.#13.75.13':139
- '21#.#13.231.32':139
- '21#.#13.9.57':139
- '21#.#13.157.9':139
- '21#.#13.57.54':139
- '21#.#13.109.109':139
- '21#.#13.19.215':139
- '21#.#13.83.152':139
- '21#.#13.209.187':139
- '21#.#13.42.135':139
- '21#.#13.179.81':139
- '21#.#13.236.140':139
- '21#.#13.132.240':139
- '21#.#13.78.68':139
- '21#.#13.46.238':139
- '21#.#13.29.148':139
- '21#.#13.79.102':139
- '21#.#13.118.32':139
- '21#.#13.22.103':139
- '21#.#13.26.246':139
- '21#.#13.116.99':139
- '21#.#13.133.215':139
- '21#.#13.99.29':139
- '21#.#13.223.241':139
- '21#.#13.223.76':139
- '21#.#13.155.4':139
- '21#.#13.154.154':139
- '21#.#13.222.243':139
- '21#.#13.28.142':139
- '21#.#13.125.102':139
- '21#.#13.209.73':139
- '21#.#13.182.207':139
- '21#.#13.197.42':139
- '21#.#13.158.81':139
- '21#.#13.50.157':139
- '21#.#13.242.218':139
- '21#.#13.187.40':139
- '21#.#13.240.80':139
- '21#.#13.209.117':139
- '21#.#13.150.15':139
- '21#.#13.183.3':139
- '21#.#13.13.76':139
- '21#.#13.28.142':445
- '21#.#13.131.183':139
- '21#.#13.206.54':139
- '21#.#13.20.227':139
- '21#.#13.34.105':139
- '21#.#13.164.150':139
- '21#.#13.60.217':139
- '21#.#13.151.172':139
- '21#.#13.160.151':139
- '21#.#13.33.73':139
- '21#.#13.197.252':139
- '21#.#13.79.105':139
- '21#.#13.55.145':139
- '21#.#13.71.184':139
- '21#.#13.59.68':139
- '21#.#13.252.110':139
- '21#.#13.104.131':139
- '21#.#13.23.94':139
- '21#.#13.27.210':139
- '21#.#13.236.96':139
- '21#.#13.56.176':139
- '21#.#13.97.57':139
- '21#.#13.206.109':139
- '21#.#13.128.32':139
- '21#.#13.71.251':445
- '21#.#13.48.106':445
- '21#.#13.142.229':445
- '21#.#13.36.240':445
- '21#.#13.42.24':445
- '21#.#13.76.46':445
- '21#.#13.173.61':445
- '21#.#13.153.30':445
- '21#.#13.55.87':445
- '21#.#13.93.1':445
- '21#.#13.198.109':445
- '21#.#13.33.120':445
- '21#.#13.15.253':139
- '21#.#13.126.176':445
- '21#.#13.43.175':139
- '21#.#13.92.177':139
- '21#.#13.120.110':139
- '21#.#13.16.127':445
- '21#.#13.16.61':445
- '21#.#13.44.200':445
- '21#.#13.113.194':445
- '21#.#13.168.16':445
- '21#.#13.194.167':445
- '21#.#13.42.135':9988
- '21#.#13.49.66':9988
- '21#.#13.150.15':9988
- '21#.#13.209.187':9988
- '21#.#13.183.3':9988
- '21#.#13.158.81':9988
- '21#.#13.28.142':9988
- '21#.#13.126.176':139
- '21#.#13.83.152':9988
- '21#.#13.231.32':9988
- '21#.#13.166.49':9988
- '21#.#13.109.109':9988
- '21#.#13.154.154':445
- '21#.#13.226.154':445
- '21#.#13.155.4':445
- '21#.#13.125.102':445
- '21#.#13.222.243':445
- '21#.#13.181.226':445
- '21#.#13.240.80':9988
- '21#.#13.209.73':9988
- '21#.#13.61.111':445
- '21#.#13.51.32':445
- '21#.#13.200.176':445
- '21#.#13.55.87':139
- '21#.#13.173.61':139
- '21#.#13.198.109':139
- '21#.#13.76.46':139
- '21#.#13.93.1':139
- '21#.#13.153.30':139
- '21#.#13.28.218':139
- '21#.#13.204.234':139
- '21#.#13.168.201':139
- '21#.#13.252.67':139
- '21#.#13.164.38':139
- '21#.#13.48.106':139
- '21#.#13.113.194':139
- '21#.#13.16.61':139
- '21#.#13.194.167':139
- '21#.#13.16.127':139
- '21#.#13.168.16':139
- '21#.#13.44.200':139
- '21#.#13.142.229':139
- '21#.#13.71.251':139
- '21#.#13.42.24':139
- '21#.#13.33.120':139
- '21#.#13.36.240':139