Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER0daa.dir00\svchost.exe.mdmp 16325836412032840
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER0daa.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '61.##2.120.232':139
- '61.##2.74.121':139
- '61.##2.233.27':139
- '61.##2.81.42':139
- '61.##2.13.66':139
- '61.##2.123.34':139
- '61.##2.239.39':139
- '61.##2.2.235':139
- '61.##2.238.3':139
- '61.##2.138.143':139
- '61.##2.251.250':139
- '61.##2.157.154':139
- '61.##2.13.242':139
- '61.##2.163.102':139
- '61.##2.54.138':139
- '61.#92.1.13':139
- '61.##2.149.28':139
- '61.##2.25.102':139
- '61.##2.167.215':139
- '61.##2.87.139':139
- '61.##2.25.55':139
- '61.#92.72.6':139
- '61.##2.70.136':139
- '61.##2.34.140':445
- '61.##2.47.250':445
- '61.##2.100.206':445
- '61.##2.157.73':139
- '61.##2.176.42':139
- '61.##2.178.39':445
- '61.##2.129.156':445
- '61.##2.192.129':445
- '61.##2.156.45':445
- '61.##2.222.218':445
- '61.##2.28.90':445
- '61.##2.132.139':139
- '61.##2.166.112':139
- '61.##2.206.165':139
- '61.##2.112.222':139
- '61.##2.241.32':139
- '61.##2.166.6':139
- '61.##2.60.155':139
- '61.##2.42.30':139
- '61.##2.88.152':139
- '61.##2.91.211':139
- '61.##2.158.37':139
- '61.##2.228.190':139
- '61.##2.48.13':445
- '61.##2.50.134':445
- '61.##2.249.114':445
- '61.##2.187.32':445
- '61.##2.41.238':445
- '61.##2.82.55':445
- '61.##2.119.56':445
- '61.##2.166.62':445
- '61.##2.10.147':445
- '61.##2.191.104':445
- '61.##2.21.42':445
- '61.##2.97.154':445
- '61.##2.196.145':445
- '61.##2.202.158':445
- '61.##2.5.145':445
- '61.##2.32.30':445
- '61.##2.228.248':445
- '61.##2.235.17':445
- '61.##2.157.77':445
- '61.##2.103.222':445
- '61.##2.167.244':445
- '61.##2.136.234':445
- '61.##2.29.137':445
- '61.##2.156.45':139
- '61.##2.129.156':139
- '61.##2.28.90':139
- '61.##2.178.39':139
- '61.##2.222.218':139
- '61.##2.192.129':139
- '61.##2.234.41':139
- '61.##2.70.53':139
- '61.##2.41.232':139
- '61.#92.8.69':139
- '61.##2.232.50':139
- '61.##2.47.250':139
- '61.##2.131.158':445
- '61.##2.40.67':445
- '61.##2.135.224':445
- '61.##2.220.66':445
- '61.##2.151.167':445
- '61.##2.107.8':445
- '61.##2.100.206':139
- '61.##2.34.140':139
- '61.##2.10.146':445
- '61.##2.189.84':445
- '61.##2.180.228':445
- '61.#92.8.69':445
- '61.##2.215.156':139
- '61.##2.70.83':139
- '61.##2.61.171':139
- '61.##2.202.89':139
- '61.##2.245.248':139
- '61.##2.61.70':139
- '61.##2.67.10':139
- '61.##2.253.66':139
- '61.#92.3.64':139
- '61.##2.51.50':139
- '61.#92.2.2':139
- '61.##2.133.135':139
- '61.##2.139.114':139
- '61.##2.251.221':139
- '61.##2.152.26':139
- '61.##2.11.171':139
- '61.##2.100.45':139
- '61.##2.99.251':139
- '61.##2.135.202':139
- '61.##2.146.163':139
- '61.##2.89.103':139
- '61.##2.84.100':139
- '61.##2.149.237':139
- '61.##2.74.139':139
- '61.##2.78.150':139
- '61.##2.209.58':139
- '61.##2.104.174':139
- '61.##2.58.227':139
- '61.##2.42.77':139
- '61.##2.131.187':139
- '61.##2.76.22':139
- '61.##2.129.197':139
- '61.##2.125.98':139
- '61.##2.70.167':139
- '61.##2.3.159':139
- '61.##2.215.244':139
- '61.##2.215.119':139
- '61.##2.97.117':139
- '61.##2.223.252':139
- '61.##2.24.254':139
- '61.##2.9.200':139
- '61.##2.243.228':139
- '61.##2.167.246':139
- '61.##2.185.143':139
- '61.##2.129.249':139
- '61.##2.0.208':139
- '61.##2.157.154':445
- '61.##2.81.42':445
- '61.##2.87.139':445
- '61.##2.25.55':445
- '61.##2.167.215':445
- '61.##2.13.66':445
- '61.##2.123.34':445
- '61.##2.138.143':445
- '61.##2.74.121':445
- '61.##2.233.27':445
- '61.##2.120.232':445
- '61.##2.70.136':445
- '61.##2.70.53':445
- '61.#92.1.13':445
- '61.##2.234.41':445
- '61.##2.232.50':445
- '61.##2.41.232':445
- '61.##2.149.28':445
- '61.##2.25.102':445
- '61.#92.72.6':445
- '61.##2.163.102':445
- '61.##2.54.138':445
- '61.##2.13.242':445
- '61.##2.132.139':445
- '61.##2.157.73':445
- '61.##2.88.152':445
- '61.##2.91.211':445
- '61.##2.42.30':445
- '61.##2.176.42':445
- '61.##2.199.112':139
- '61.##2.191.81':139
- '61.##2.122.116':139
- '61.##2.241.175':139
- '61.##2.221.241':139
- '61.##2.228.190':445
- '61.##2.2.235':445
- '61.##2.241.32':445
- '61.##2.239.39':445
- '61.##2.251.250':445
- '61.##2.238.3':445
- '61.##2.166.6':445
- '61.##2.60.155':445
- '61.##2.158.37':445
- '61.##2.206.165':445
- '61.##2.112.222':445
- '61.##2.166.112':445
- '61.##2.146.71':445
- '61.##2.71.215':445
- '61.##2.215.74':445
- '61.##2.171.202':445
- '61.##2.107.234':445
- '61.##2.223.107':445
- '61.##2.41.115':445
- '61.##2.16.62':445
- '61.##2.29.101':445
- '61.##2.237.65':445
- '61.##2.101.17':445
- '61.##2.212.49':445
- '61.##2.132.223':445
- '61.##2.229.123':139
- '61.##2.58.247':139
- '61.##2.19.239':139
- '61.##2.177.42':139
- '61.##2.239.177':139
- '61.##2.48.169':445
- '61.#92.5.80':445
- '61.##2.146.120':445
- '61.##2.7.184':445
- '61.##2.28.227':445
- '61.##2.80.152':445
- '61.##2.49.161':445
- '61.##2.156.183':445
- '61.##2.100.48':445
- '61.##2.159.106':445
- '61.##2.70.100':445
- '61.#92.16.0':445
- '61.##2.41.118':445
- '61.##2.234.42':445
- '61.##2.183.79':445
- '61.##2.44.233':445
- '61.##2.151.142':445
- '61.##2.49.77':445
- '61.##2.37.89':445
- '61.##2.44.48':445
- '61.##2.89.28':445
- '61.##2.38.23':445
- '61.##2.66.230':445
- '61.##2.23.46':445
- '61.##2.15.58':445
- '61.##2.69.112':445
- '61.##2.26.161':445
- '61.##2.145.105':445
- '61.##2.161.191':445
- '61.##2.101.17':139
- '61.##2.29.101':139
- '61.##2.71.215':139
- '61.##2.237.65':139
- '61.##2.66.230':139
- '61.##2.215.74':139
- '61.##2.37.89':139
- '61.##2.44.48':139
- '61.##2.89.28':139
- '61.##2.38.23':139
- '61.##2.41.115':139
- '61.##2.212.49':139
- '61.##2.7.184':139
- '61.#92.5.80':139
- '61.##2.80.152':139
- '61.##2.28.227':139
- '61.##2.48.169':139
- '61.##2.146.120':139
- '61.##2.171.202':139
- '61.##2.16.62':139
- '61.##2.132.223':139
- '61.##2.107.234':139
- '61.##2.223.107':139
- '61.##2.10.156':139
- '61.#92.16.0':139
- '61.##2.156.183':139
- '61.##2.70.100':139
- '61.##2.183.79':139
- '61.##2.41.118':139
- '61.##2.142.1':139
- '61.##2.55.163':139
- '61.##2.76.170':139
- '61.##2.42.133':139
- '61.##2.234.42':139
- '61.##2.49.161':139
- '61.##2.161.191':139
- '61.##2.26.161':139
- '61.##2.23.46':139
- '61.##2.69.112':139
- '61.##2.145.105':139
- '61.##2.15.58':139
- '61.##2.159.106':139
- '61.##2.49.77':139
- '61.##2.44.233':139
- '61.##2.100.48':139
- '61.##2.151.142':139
- '61.##2.42.133':445
- '61.##2.50.134':139
- '61.##2.41.238':139
- '61.##2.119.56':139
- '61.##2.151.167':139
- '61.##2.249.114':139
- '61.##2.10.147':139
- '61.##2.135.224':139
- '61.##2.107.8':139
- '61.##2.21.42':139
- '61.##2.166.62':139
- '61.##2.220.66':139
- '61.##2.48.13':139
- '61.##2.29.137':139
- '61.##2.167.244':139
- '61.##2.136.234':139
- '61.##2.202.158':139
- '61.##2.235.17':139
- '61.##2.157.77':139
- '61.##2.103.222':139
- '61.##2.82.55':139
- '61.##2.191.104':139
- '61.##2.97.154':139
- '61.##2.187.32':139
- '61.##2.50.124':445
- '61.##2.17.215':445
- '61.##2.240.163':445
- '61.##2.239.147':445
- '61.##2.12.199':445
- '61.##2.81.181':445
- '61.##2.240.107':445
- '61.##2.206.214':445
- '61.##2.21.116':445
- '61.##2.151.237':445
- '61.##2.178.214':445
- '61.##2.149.15':445
- '61.##2.40.67':139
- '61.##2.131.158':139
- '61.##2.10.146':139
- '61.##2.189.84':139
- '61.##2.180.228':139
- '61.##2.132.17':445
- '61.##2.21.198':445
- '61.##2.237.174':445
- '61.##2.251.15':445
- '61.##2.223.53':445
- '61.#92.7.47':445
- '61.##2.16.62':9988
- '61.#92.16.0':9988
- '61.##2.49.161':9988
- '61.##2.55.163':9988
- '61.##2.223.107':9988
- '61.##2.26.161':9988
- '61.##2.212.49':9988
- '61.##2.69.112':9988
- '61.##2.23.46':9988
- '61.##2.171.202':9988
- '61.##2.37.89':9988
- '61.##2.80.152':9988
- '61.##2.177.42':445
- '61.##2.239.177':445
- '61.##2.142.1':445
- '61.##2.76.170':445
- '61.##2.10.156':445
- '61.##2.55.163':445
- '61.##2.28.227':9988
- '61.##2.89.28':9988
- '61.##2.58.247':445
- '61.##2.19.239':445
- '61.##2.229.123':445
- '61.##2.21.116':139
- '61.##2.240.107':139
- '61.##2.178.214':139
- '61.##2.81.181':139
- '61.##2.151.237':139
- '61.##2.206.214':139
- '61.##2.5.145':139
- '61.##2.196.145':139
- '61.##2.228.248':139
- '61.##2.146.71':139
- '61.##2.32.30':139
- '61.##2.50.124':139
- '61.##2.21.198':139
- '61.##2.237.174':139
- '61.#92.7.47':139
- '61.##2.132.17':139
- '61.##2.223.53':139
- '61.##2.251.15':139
- '61.##2.240.163':139
- '61.##2.17.215':139
- '61.##2.12.199':139
- '61.##2.149.15':139
- '61.##2.239.147':139