Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1152 -dm 7 7 %TEMP%\WER2dc8.dir00\svchost.exe.mdmp 16325836412031908
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER2dc8.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- '14.##1.74.141':139
- '14.##1.114.121':139
- '14.##1.103.16':139
- '14.##1.218.111':445
- '14.##1.85.157':139
- '14.##1.218.111':139
- '14.##1.85.157':445
- '14.##1.126.200':139
- '14.##1.10.19':139
- '14.##1.212.122':139
- '14.##1.251.229':139
- '14.##1.92.92':139
- '14.##1.62.132':139
- '14.##1.7.251':139
- '14.##1.255.43':445
- '14.##1.22.11':445
- '14.##1.28.86':445
- '14.##1.33.97':445
- '14.##1.173.144':445
- '14.##1.213.185':445
- '14.##1.210.195':445
- '14.##1.134.148':445
- '14.##1.234.109':445
- '14.##1.249.113':445
- '14.##1.157.136':445
- '14.##1.86.34':445
- '14.##1.183.135':445
- '14.##1.136.186':445
- '14.##1.20.84':139
- '14.##1.55.140':139
- '14.##1.90.67':139
- '14.##1.83.240':139
- '14.##1.103.50':139
- '14.##1.63.101':139
- '14.##1.239.204':139
- '14.##1.68.149':139
- '14.##1.48.156':139
- '14.##1.91.164':139
- '14.##1.98.219':139
- '14.##1.195.53':139
- '14.##1.51.208':139
- '14.##1.52.237':139
- '14.##1.123.232':139
- '14.##1.155.142':139
- '14.##1.214.191':139
- '14.##1.232.124':139
- '14.##1.149.212':139
- '14.##1.236.23':139
- '14.##1.37.217':139
- '14.##1.126.223':139
- '14.##1.33.238':139
- '14.##1.156.78':139
- '14.##1.86.86':139
- '14.##1.61.169':139
- '14.##1.229.31':139
- '14.##1.71.42':139
- '14.##1.134.148':139
- '14.##1.234.109':139
- '14.##1.249.113':139
- '14.##1.157.136':139
- '14.##1.28.86':139
- '14.##1.183.135':139
- '14.##1.136.186':139
- '14.##1.29.150':445
- '14.##1.132.166':445
- '14.##1.204.14':445
- '14.##1.114.66':445
- '14.##1.80.192':445
- '14.##1.213.107':445
- '14.##1.238.87':445
- '14.##1.214.170':139
- '14.##1.96.43':139
- '14.##1.164.135':139
- '14.##1.163.164':139
- '14.##1.55.37':139
- '14.##1.202.54':139
- '14.##1.186.201':139
- '14.##1.255.43':139
- '14.##1.22.11':139
- '14.##1.86.34':139
- '14.##1.33.97':139
- '14.##1.173.144':139
- '14.##1.213.185':139
- '14.##1.210.195':139
- '14.##1.198.208':445
- '14.##1.110.76':445
- '14.##1.37.130':445
- '14.##1.112.250':445
- '14.##1.80.72':445
- '14.#41.3.80':445
- '14.##1.188.86':445
- '14.##1.214.170':445
- '14.##1.164.135':445
- '14.##1.96.43':445
- '14.##1.163.164':445
- '14.##1.55.37':445
- '14.##1.202.54':445
- '14.##1.186.201':445
- '14.#41.44.1':445
- '14.##1.91.134':445
- '14.##1.138.176':445
- '14.##1.63.32':445
- '14.##1.66.130':445
- '14.##1.40.52':445
- '14.##1.248.119':445
- '14.##1.145.251':445
- '14.#41.19.6':445
- '14.##1.58.149':445
- '14.##1.54.238':445
- '14.##1.157.227':445
- '14.##1.57.157':445
- '14.##1.180.199':445
- '14.##1.206.6':139
- '14.##1.27.165':139
- '14.##1.33.231':139
- '14.##1.0.221':139
- '14.##1.177.39':139
- '14.##1.28.81':139
- '14.##1.71.195':139
- '14.##1.35.228':139
- '14.##1.237.21':139
- '14.##1.22.12':139
- '14.##1.130.1':139
- '14.#41.66.8':139
- '14.##1.191.127':139
- '14.##1.88.64':139
- '14.##1.50.226':139
- '14.##1.212.10':139
- '14.##1.143.156':445
- '14.##1.212.10':445
- '14.##1.143.156':139
- '14.##1.186.21':445
- '14.##1.109.102':445
- '14.##1.45.10':445
- '14.##1.172.16':139
- '14.##1.244.184':139
- '14.##1.59.162':139
- '14.##1.219.59':139
- '14.##1.12.151':139
- '14.##1.23.149':139
- '14.##1.59.228':139
- '14.##1.117.82':139
- '14.##1.105.166':139
- '14.##1.3.106':139
- '14.##1.157.50':139
- '14.##1.58.56':139
- '14.##1.41.162':139
- '14.##1.47.68':139
- '14.##1.15.240':139
- '14.##1.210.38':139
- '14.##1.75.151':139
- '14.#41.0.46':139
- '14.##1.41.75':139
- '14.##1.136.5':139
- '14.##1.66.119':139
- '14.##1.155.87':139
- '14.##1.141.82':139
- '14.##1.215.36':139
- '14.#41.0.72':139
- '14.##1.193.8':139
- '14.##1.227.138':139
- '14.##1.19.103':139
- '14.##1.58.213':139
- '14.##1.191.195':139
- '14.##1.12.117':139
- '14.##1.212.229':139
- '14.##1.6.150':139
- '14.##1.180.54':139
- '14.##1.136.200':139
- '14.##1.10.19':445
- '14.##1.212.122':445
- '14.##1.149.212':445
- '14.##1.126.200':445
- '14.##1.62.132':445
- '14.##1.7.251':445
- '14.##1.251.229':445
- '14.##1.155.142':445
- '14.##1.214.191':445
- '14.##1.61.169':445
- '14.##1.123.232':445
- '14.##1.236.23':445
- '14.##1.37.217':445
- '14.##1.232.124':445
- '14.##1.116.8':139
- '14.##1.102.116':139
- '14.##1.21.102':139
- '14.##1.78.202':139
- '14.##1.83.126':139
- '14.##1.122.12':139
- '14.##1.219.80':139
- '14.##1.114.121':445
- '14.##1.103.16':445
- '14.##1.92.92':445
- '14.##1.74.141':445
- '14.##1.186.21':139
- '14.##1.109.102':139
- '14.##1.45.10':139
- '14.##1.48.156':445
- '14.##1.91.164':445
- '14.##1.206.6':445
- '14.##1.68.149':445
- '14.##1.51.208':445
- '14.##1.52.237':445
- '14.##1.98.219':445
- '14.##1.116.8':445
- '14.##1.102.116':445
- '14.##1.21.102':445
- '14.##1.78.202':445
- '14.##1.83.126':445
- '14.##1.122.12':445
- '14.##1.219.80':445
- '14.##1.33.238':445
- '14.##1.156.78':445
- '14.##1.103.50':445
- '14.##1.126.223':445
- '14.##1.229.31':445
- '14.##1.71.42':445
- '14.##1.86.86':445
- '14.##1.55.140':445
- '14.##1.90.67':445
- '14.##1.195.53':445
- '14.##1.20.84':445
- '14.##1.63.101':445
- '14.##1.239.204':445
- '14.##1.83.240':445
- '14.##1.37.130':139
- '14.##1.249.53':445
- '14.##1.59.225':445
- '14.##1.150.35':445
- '14.##1.136.112':445
- '14.##1.151.35':445
- '14.##1.213.241':445
- '14.#41.84.6':445
- '14.##1.237.143':445
- '14.##1.84.53':445
- '14.##1.158.146':445
- '14.##1.68.241':445
- '14.##1.87.188':445
- '14.##1.204.103':445
- '14.##1.19.98':445
- '14.##1.128.196':445
- '14.##1.71.239':445
- '14.##1.222.129':445
- '14.##1.81.90':445
- '14.##1.236.105':445
- '14.##1.74.164':445
- '14.##1.228.48':445
- '14.##1.186.112':445
- '14.##1.32.206':445
- '14.##1.19.92':445
- '14.##1.232.188':445
- '14.##1.108.199':445
- '14.#41.5.86':445
- '14.##1.31.116':445
- '14.##1.203.141':9988
- '14.##1.8.231':9988
- '14.##1.243.173':139
- '14.##1.56.233':445
- '14.##1.249.49':445
- '14.##1.44.29':445
- '14.##1.88.216':445
- '14.##1.11.26':139
- '14.##1.247.116':139
- '14.##1.104.247':139
- '14.#41.2.61':139
- '14.##1.218.27':139
- '14.##1.51.226':139
- '14.##1.3.131':139
- '14.##1.35.114':445
- '14.##1.188.170':445
- '14.##1.244.161':445
- '14.##1.70.69':445
- '14.##1.196.118':445
- '14.##1.14.70':445
- '14.##1.167.142':445
- '14.##1.156.188':445
- '14.##1.45.249':445
- '14.##1.8.251':445
- '14.##1.144.176':445
- '14.##1.240.24':445
- '14.##1.224.160':445
- '14.##1.11.161':445
- '14.##1.19.92':139
- '14.##1.151.35':139
- '14.##1.213.241':139
- '14.##1.32.206':139
- '14.##1.31.116':139
- '14.##1.232.188':139
- '14.##1.186.112':139
- '14.##1.150.35':139
- '14.##1.87.188':139
- '14.##1.204.103':139
- '14.##1.59.225':139
- '14.#41.84.6':139
- '14.##1.136.112':139
- '14.##1.249.53':139
- '14.##1.81.90':139
- '14.##1.71.239':139
- '14.##1.195.196':139
- '14.##1.53.212':139
- '14.##1.8.231':139
- '14.##1.203.141':139
- '14.##1.80.29':139
- '14.##1.108.199':139
- '14.##1.236.105':139
- '14.#41.5.86':139
- '14.##1.128.196':139
- '14.##1.74.164':139
- '14.##1.222.129':139
- '14.##1.228.48':139
- '14.##1.8.251':139
- '14.##1.249.49':139
- '14.##1.88.216':139
- '14.##1.45.249':139
- '14.##1.11.161':139
- '14.##1.144.176':139
- '14.##1.156.188':139
- '14.##1.80.29':445
- '14.##1.53.212':445
- '14.##1.195.196':445
- '14.##1.8.231':445
- '14.##1.44.29':139
- '14.##1.56.233':139
- '14.##1.203.141':445
- '14.##1.158.146':139
- '14.##1.196.118':139
- '14.##1.14.70':139
- '14.##1.84.53':139
- '14.##1.19.98':139
- '14.##1.68.241':139
- '14.##1.237.143':139
- '14.##1.244.161':139
- '14.##1.240.24':139
- '14.##1.224.160':139
- '14.##1.188.170':139
- '14.##1.167.142':139
- '14.##1.70.69':139
- '14.##1.35.114':139
- '14.##1.239.55':139
- '14.##1.53.19':445
- '14.##1.189.13':445
- '14.##1.212.158':445
- '14.##1.13.92':445
- '14.##1.192.138':445
- '14.##1.40.196':445
- '14.##1.44.142':445
- '14.##1.238.128':139
- '14.##1.192.238':139
- '14.##1.238.128':445
- '14.##1.128.0':445
- '14.##1.64.212':445
- '14.##1.18.33':445
- '14.##1.0.226':445
- '14.##1.51.73':445
- '14.##1.104.51':445
- '14.##1.138.104':445
- '14.#41.35.5':445
- '14.##1.252.145':445
- '14.##1.33.15':445
- '14.##1.175.252':445
- '14.##1.101.208':445
- '14.##1.47.211':445
- '14.##1.69.186':445
- '14.##1.0.237':445
- '14.##1.57.95':445
- '14.##1.39.133':445
- '14.##1.246.39':445
- '14.##1.54.238':139
- '14.##1.145.251':139
- '14.#41.19.6':139
- '14.##1.180.199':139
- '14.##1.138.176':139
- '14.##1.157.227':139
- '14.##1.57.157':139
- '14.##1.112.250':139
- '14.##1.198.208':139
- '14.##1.110.76':139
- '14.##1.188.86':139
- '14.##1.58.149':139
- '14.##1.80.72':139
- '14.#41.3.80':139
- '14.##1.114.66':139
- '14.##1.29.150':139
- '14.##1.132.166':139
- '14.##1.238.87':139
- '14.##1.192.238':445
- '14.##1.80.192':139
- '14.##1.213.107':139
- '14.##1.63.32':139
- '14.#41.44.1':139
- '14.##1.91.134':139
- '14.##1.248.119':139
- '14.##1.204.14':139
- '14.##1.66.130':139
- '14.##1.40.52':139
- '14.##1.57.95':139
- '14.##1.39.133':139
- '14.##1.246.39':139
- '14.##1.138.104':139
- '14.#41.35.5':139
- '14.##1.51.73':139
- '14.##1.104.51':139
- '14.##1.192.138':139
- '14.##1.40.196':139
- '14.##1.44.142':139
- '14.##1.69.186':139
- '14.##1.0.237':139
- '14.##1.101.208':139
- '14.##1.47.211':139
- '14.##1.84.253':139
- '14.##1.57.68':139
- '14.##1.34.225':139
- '14.##1.93.198':139
- '14.#41.85.4':139
- '14.##1.65.69':139
- '14.##1.180.10':139
- '14.##1.252.145':139
- '14.##1.33.15':139
- '14.##1.175.252':139
- '14.##1.210.143':139
- '14.##1.59.181':139
- '14.##1.12.57':139
- '14.##1.193.47':139
- '14.##1.65.69':445
- '14.##1.180.10':445
- '14.##1.93.198':445
- '14.#41.85.4':445
- '14.##1.247.116':445
- '14.##1.104.247':445
- '14.##1.239.55':445
- '14.##1.12.57':445
- '14.##1.193.47':445
- '14.##1.210.143':445
- '14.##1.59.181':445
- '14.##1.84.253':445
- '14.##1.57.68':445
- '14.##1.34.225':445
- '14.##1.64.212':139
- '14.##1.18.33':139
- '14.##1.0.226':139
- '14.##1.212.158':139
- '14.##1.13.92':139
- '14.##1.53.19':139
- '14.##1.189.13':139
- '14.##1.3.131':445
- '14.#41.2.61':445
- '14.##1.11.26':445
- '14.##1.51.226':445
- '14.##1.128.0':139
- '14.##1.243.173':445
- '14.##1.218.27':445