Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
Executes the following:
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WERde83.dir00\svchost.exe.hdmp 16325836412030668
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WERde83.dir00\svchost.exe.mdmp 16325836412032004
Modifies file system :
Creates the following files:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %TEMP%\WERde83.dir00\appcompat.txt
- %TEMP%\WERde83.dir00\manifest.txt
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WERde83.dir00\svchost.exe.mdmp
- %TEMP%\WERde83.dir00\svchost.exe.hdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
Deletes itself.
Network activity:
Connects to:
- '82.##7.125.70':445
- '82.##7.213.70':445
- '82.##7.160.242':445
- '82.##7.58.77':445
- '82.##7.95.65':445
- '82.##7.64.130':445
- '82.##7.16.73':445
- '82.##7.180.234':445
- '82.##7.47.252':445
- '82.#07.9.32':445
- '82.##7.16.126':445
- '82.##7.60.52':445
- '82.##7.120.60':445
- '82.##7.121.219':445
- '82.##7.4.181':445
- '82.##7.235.75':445
- '82.##7.53.135':445
- '82.##7.239.232':445
- '82.##7.16.109':445
- '82.##7.70.209':445
- '82.##7.216.241':445
- '82.##7.25.57':445
- '82.##7.20.58':445
- '82.##7.207.83':445
- '82.##7.140.111':445
- '82.##7.109.20':445
- '82.##7.240.219':445
- '82.##7.225.26':445
- '82.##7.122.30':445
- '82.##7.121.22':445
- '82.##7.97.243':445
- '82.##7.84.203':445
- '82.##7.133.121':445
- '82.##7.23.56':445
- '82.##7.58.61':445
- '82.##7.130.119':445
- '82.##7.166.56':445
- '82.##7.5.253':445
- '82.##7.98.71':445
- '82.##7.219.233':445
- '82.##7.26.83':445
- '82.##7.40.230':445
- '82.##7.56.224':445
- '82.##7.35.139':445
- '82.##7.163.115':445
- '82.##7.94.251':445
- '82.##7.89.122':445
- '82.##7.158.113':445
- '82.##7.65.117':445
- '82.##7.181.133':445
- '82.##7.240.4':445
- '82.##7.181.133':9988
- '82.##7.65.117':9988
- '82.##7.163.115':9988
- '82.##7.95.65':9988
- '82.##7.158.113':9988
- '82.##7.213.70':9988
- '82.##7.63.141':9988
- '82.##7.35.139':9988
- '82.##7.84.203':9988
- '82.##7.120.122':9988
- '82.##7.133.121':9988
- '82.##7.125.70':9988
- '82.##7.216.241':9988
- '82.##7.40.230':9988
- '82.##7.255.109':9988
- '82.##7.140.111':9988
- '82.##7.46.55':9988
- '82.##7.89.122':9988
- '82.##7.23.56':9988
- '82.##7.219.233':9988
- '82.##7.227.38':9988
- '82.##7.94.251':9988
- '82.##7.60.52':9988
- '82.##7.33.51':9988
- '82.##7.58.61':9988
- '82.##7.144.90':445
- '82.##7.115.118':445
- '82.##7.83.237':445
- '82.##7.38.59':445
- '82.##7.118.143':445
- '82.##7.66.64':445
- '82.##7.120.122':445
- '82.##7.229.231':445
- '82.##7.227.124':445
- '82.##7.181.235':445
- '82.##7.198.65':445
- '82.##7.251.110':445
- '82.##7.33.243':445
- '82.##7.236.115':9988
- '82.##7.130.119':9988
- '82.##7.180.234':9988
- '82.##7.5.253':9988
- '82.##7.120.60':9988
- '82.##7.225.26':9988
- '82.##7.226.166':9988
- '82.##7.111.18':9988
- '82.##7.203.209':445
- '82.##7.51.60':9988
- '82.##7.56.224':9988
- '82.##7.164.140':9988
- '82.##7.95.65':139
- '82.##7.23.56':139
- '82.##7.235.75':139
- '82.##7.5.253':139
- '82.#07.9.32':139
- '82.##7.219.233':139
- '82.##7.97.243':139
- '82.##7.60.52':139
- '82.##7.33.243':139
- '82.##7.84.203':139
- '82.##7.53.135':139
- '82.##7.125.70':139
- '82.##7.120.60':139
- '82.##7.26.83':139
- '82.##7.122.30':139
- '82.##7.100.193':139
- '82.##7.198.65':139
- '82.##7.98.71':139
- '82.##7.251.110':139
- '82.##7.227.124':139
- '82.##7.66.64':139
- '82.##7.240.4':139
- '82.##7.33.51':139
- '82.##7.83.237':139
- '82.##7.115.118':139
- '82.##7.236.115':139
- '82.##7.131.217':139
- '82.##7.181.133':139
- '82.##7.133.121':139
- '82.##7.226.153':139
- '82.##7.63.141':139
- '82.##7.164.140':139
- '82.##7.46.55':139
- '82.##7.51.60':139
- '82.##7.226.166':139
- '82.##7.227.38':139
- '82.##7.255.109':139
- '82.##7.61.60':139
- '82.##7.144.90':139
- '82.##7.240.219':139
- '82.##7.216.241':139
- '82.##7.58.61':139
- '82.##7.225.26':139
- '82.##7.109.20':139
- '82.##7.65.117':139
- '82.##7.121.22':139
- '82.##7.163.115':139
- '82.##7.166.56':139
- '82.##7.203.209':139
- '82.##7.140.111':139
- '82.##7.229.231':139
- '82.##7.51.60':445
- '82.##7.111.18':445
- '82.##7.158.113':139
- '82.##7.255.109':445
- '82.##7.46.55':445
- '82.##7.164.140':445
- '82.##7.207.83':139
- '82.##7.130.119':139
- '82.##7.62.54':139
- '82.##7.94.251':139
- '82.##7.38.59':139
- '82.##7.111.18':139
- '82.##7.226.166':445
- '82.##7.236.115':445
- '82.##7.8.252':445
- '82.##7.100.193':445
- '82.##7.121.165':445
- '82.##7.226.153':445
- '82.##7.86.158':445
- '82.##7.131.217':445
- '82.##7.227.38':445
- '82.##7.63.141':445
- '82.##7.33.51':445
- '82.##7.61.60':445
- '82.##7.62.54':445
- '82.##7.180.234':139
- '82.##7.181.235':139
- '82.##7.56.224':139
- '82.##7.121.165':139
- '82.##7.16.73':139
- '82.##7.120.122':139
- '82.##7.40.230':139
- '82.##7.239.232':139
- '82.##7.35.139':139
- '82.##7.121.219':139
- '82.##7.47.252':139
- '82.##7.118.143':139
- '82.##7.160.242':139
- '82.##7.89.122':139
- '82.##7.20.58':139
- '82.##7.58.77':139
- '82.##7.16.109':139
- '82.##7.4.181':139
- '82.##7.86.158':139
- '82.##7.25.57':139
- '82.##7.213.70':139
- '82.##7.16.126':139
- '82.##7.8.252':139
- '82.##7.70.209':139
- '82.##7.64.130':139
