Техническая информация
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1124 -dm 7 7 %TEMP%\WER0ee3.dir00\svchost.exe.mdmp 16325836412033344
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER0ee3.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- '72.##2.115.157':445
- '72.##2.67.64':445
- '72.##2.216.212':445
- '72.##2.27.152':445
- '72.##2.74.87':445
- '72.##2.131.5':445
- '72.#72.2.3':445
- '72.##2.218.148':445
- '72.##2.189.66':445
- '72.##2.130.88':445
- '72.##2.77.249':445
- '72.##2.2.131':445
- '72.##2.200.18':445
- '72.##2.30.174':445
- '72.##2.155.141':445
- '72.##2.211.71':445
- '72.##2.225.220':445
- '72.##2.163.81':445
- '72.##2.209.62':445
- '72.##2.85.173':445
- '72.##2.248.191':445
- '72.##2.148.252':445
- '72.##2.47.98':445
- '72.##2.191.205':445
- '72.##2.185.55':445
- '72.##2.117.115':445
- '72.##2.136.86':445
- '72.##2.97.175':445
- '72.##2.156.181':445
- '72.##2.26.50':445
- '72.##2.61.77':445
- '72.##2.123.90':445
- '72.##2.71.150':445
- '72.##2.38.134':445
- '72.##2.17.13':445
- '72.##2.235.252':445
- '72.##2.163.29':445
- '72.##2.11.160':445
- '72.##2.178.30':445
- '72.##2.52.139':445
- '72.##2.48.108':445
- '72.##2.195.152':445
- '72.##2.55.242':445
- '72.##2.41.250':445
- '72.##2.86.192':445
- '72.##2.88.217':445
- '72.##2.167.61':445
- '72.##2.34.149':445
- '72.##2.43.31':445
- '72.##2.54.189':445
- '72.##2.253.53':445
- '72.##2.98.175':445
- '72.##2.239.171':445
- '72.##2.226.188':445
- '72.##2.112.102':445
- '72.##2.16.16':445
- '72.#72.90.0':445
- '72.##2.116.165':445
- '72.##2.54.189':139
- '72.##2.61.77':139
- '72.##2.61.56':445
- '72.##2.67.64':139
- '72.##2.226.188':139
- '72.##2.29.26':139
- '72.##2.98.175':139
- '72.##2.24.86':445
- '72.##2.207.10':445
- '72.#72.42.3':445
- '72.##2.121.230':445
- '72.##2.50.23':445
- '72.##2.175.148':445
- '72.##2.208.207':445
- '72.##2.38.134':139
- '72.##2.116.165':139
- '72.##2.43.31':139
- '72.##2.88.217':139
- '72.##2.130.88':139
- '72.##2.253.53':139
- '72.##2.115.157':139
- '72.##2.131.5':139
- '72.#72.90.0':139
- '72.##2.163.29':139
- '72.##2.239.171':139
- '72.##2.16.16':139
- '72.##2.112.102':139
- '72.##2.167.61':139
- '72.##2.41.250':139
- '72.#72.1.25':445
- '72.#72.8.6':445
- '72.##2.48.36':445
- '72.##2.71.241':445
- '72.##2.166.6':445
- '72.##2.59.72':445
- '72.##2.49.34':445
- '72.##2.195.242':445
- '72.##2.58.36':445
- '72.##2.10.148':445
- '72.##2.35.191':445
- '72.##2.148.54':445
- '72.##2.60.49':445
- '72.##2.190.135':445
- '72.##2.231.247':445
- '72.##2.38.154':445
- '72.##2.200.12':445
- '72.##2.138.103':445
- '72.##2.114.92':445
- '72.##2.39.224':445
- '72.##2.230.87':445
- '72.##2.48.231':445
- '72.##2.86.234':445
- '72.##2.92.130':445
- '72.##2.76.160':445
- '72.##2.252.102':445
- '72.##2.35.162':445
- '72.##2.184.161':445
- '72.##2.103.49':445
- '72.##2.76.240':445
- '72.##2.211.97':445
- '72.#72.35.8':445
- '72.##2.25.10':445
- '72.##2.173.248':139
- '72.##2.61.33':445
- '72.##2.10.96':445
- '72.##2.49.80':445
- '72.##2.23.204':445
- '72.##2.47.63':445
- '72.##2.40.21':445
- '72.##2.41.59':445
- '72.##2.231.207':445
- '72.##2.126.101':445
- '72.##2.67.162':139
- '72.##2.224.0':445
- '72.##2.31.159':445
- '72.##2.25.171':445
- '72.##2.31.175':445
- '72.##2.159.83':445
- '72.##2.247.34':445
- '72.##2.95.98':445
- '72.##2.33.60':445
- '72.##2.209.91':445
- '72.##2.41.51':139
- '72.##2.129.40':445
- '72.##2.206.179':445
- '72.##2.85.128':445
- '72.##2.108.239':445
- '72.##2.97.39':139
- '72.##2.28.251':139
- '72.##2.94.73':139
- '72.##2.100.79':445
- '72.##2.80.235':445
- '72.##2.121.166':445
- '72.##2.249.34':445
- '72.##2.173.248':445
- '72.##2.41.51':445
- '72.##2.67.162':445
- '72.##2.163.129':139
- '72.##2.97.39':445
- '72.##2.64.94':139
- '72.##2.39.64':139
- '72.##2.25.24':445
- '72.##2.47.112':445
- '72.##2.255.197':445
- '72.#72.3.24':445
- '72.##2.14.179':445
- '72.##2.36.238':445
- '72.##2.102.129':445
- '72.##2.5.108':445
- '72.##2.166.148':445
- '72.##2.104.52':445
- '72.##2.184.92':445
- '72.##2.66.128':445
- '72.##2.175.137':445
- '72.##2.158.195':445
- '72.##2.118.61':445
- '72.##2.85.128':139
- '72.##2.47.63':139
- '72.##2.126.101':139
- '72.##2.94.99':139
- '72.##2.31.159':139
- '72.##2.206.179':139
- '72.##2.102.129':139
- '72.##2.129.40':139
- '72.##2.41.59':139
- '72.##2.108.239':139
- '72.##2.174.129':139
- '72.##2.224.0':139
- '72.##2.211.97':139
- '72.##2.76.240':139
- '72.##2.25.10':139
- '72.##2.112.45':445
- '72.##2.95.98':139
- '72.##2.25.171':139
- '72.##2.52.217':445
- '72.##2.33.40':445
- '72.##2.252.242':445
- '72.##2.29.26':445
- '72.##2.61.33':139
- '72.##2.10.96':139
- '72.##2.225.162':139
- '72.##2.51.149':139
- '72.##2.31.175':139
- '72.##2.5.108':139
- '72.##2.33.60':139
- '72.##2.14.179':139
- '72.##2.118.61':139
- '72.##2.100.79':139
- '72.##2.104.52':139
- '72.##2.175.137':139
- '72.##2.66.128':139
- '72.##2.158.195':139
- '72.##2.184.92':139
- '72.##2.138.3':445
- '72.##2.174.129':445
- '72.##2.121.166':139
- '72.##2.249.34':139
- '72.##2.25.24':139
- '72.##2.80.235':139
- '72.#72.3.24':139
- '72.##2.49.80':139
- '72.##2.231.207':139
- '72.##2.209.91':139
- '72.#72.35.8':139
- '72.##2.40.21':139
- '72.##2.159.83':139
- '72.##2.247.34':139
- '72.##2.255.197':139
- '72.##2.138.3':139
- '72.##2.166.148':139
- '72.##2.47.112':139
- '72.##2.36.238':139
- '72.##2.23.204':139
- '72.##2.51.149':445
- '72.##2.106.234':445
- '72.##2.148.126':445
- '72.##2.20.104':445
- '72.##2.36.139':445
- '72.##2.70.220':445
- '72.##2.218.229':445
- '72.##2.143.36':445
- '72.##2.145.51':445
- '72.##2.201.15':445
- '72.##2.74.117':445
- '72.##2.230.210':445
- '72.##2.22.149':445
- '72.##2.69.36':445
- '72.##2.210.57':445
- '72.##2.244.92':445
- '72.##2.60.210':445
- '72.##2.248.156':445
- '72.##2.75.84':445
- '72.##2.110.39':445
- '72.##2.255.184':445
- '72.##2.4.206':445
- '72.##2.0.124':445
- '72.##2.188.95':445
- '72.##2.145.72':445
- '72.##2.143.109':445
- '72.##2.58.203':445
- '72.##2.94.176':445
- '72.##2.21.40':445
- '72.##2.129.86':445
- '72.##2.195.36':9988
- '72.##2.145.51':9988
- '72.##2.70.220':9988
- '72.##2.110.39':9988
- '72.##2.0.124':9988
- '72.##2.75.84':9988
- '72.##2.62.220':9988
- '72.##2.184.190':9988
- '72.##2.85.216':9988
- '72.##2.248.156':9988
- '72.##2.109.94':9988
- '72.##2.73.52':9988
- '72.##2.188.95':9988
- '72.##2.255.184':9988
- '72.##2.171.31':445
- '72.##2.195.36':445
- '72.##2.12.148':445
- '72.##2.208.80':445
- '72.##2.82.166':445
- '72.##2.245.240':445
- '72.##2.137.40':445
- '72.##2.66.41':445
- '72.##2.80.191':445
- '72.##2.207.112':445
- '72.##2.109.94':445
- '72.##2.73.52':445
- '72.##2.97.130':445
- '72.##2.134.56':445
- '72.##2.62.220':445
- '72.##2.21.40':139
- '72.##2.143.109':139
- '72.##2.70.220':139
- '72.##2.58.203':139
- '72.##2.94.176':139
- '72.##2.248.156':139
- '72.##2.145.72':139
- '72.##2.106.234':139
- '72.##2.20.104':139
- '72.##2.148.126':139
- '72.##2.36.139':139
- '72.##2.244.92':139
- '72.##2.218.229':139
- '72.##2.143.36':139
- '72.##2.129.86':139
- '72.##2.186.75':139
- '72.##2.184.190':139
- '72.##2.45.182':139
- '72.##2.75.84':139
- '72.##2.255.184':139
- '72.##2.84.218':139
- '72.##2.60.210':139
- '72.##2.110.39':139
- '72.##2.188.95':139
- '72.##2.0.124':139
- '72.##2.4.206':139
- '72.##2.85.216':139
- '72.##2.36.159':139
- '72.##2.205.129':139
- '72.##2.73.52':139
- '72.##2.171.31':139
- '72.##2.207.112':139
- '72.##2.109.94':139
- '72.##2.134.56':139
- '72.##2.62.220':139
- '72.##2.80.191':139
- '72.##2.84.218':445
- '72.##2.45.182':445
- '72.##2.186.75':445
- '72.##2.205.129':445
- '72.##2.184.190':445
- '72.##2.36.159':445
- '72.##2.85.216':445
- '72.##2.97.130':139
- '72.##2.201.15':139
- '72.##2.145.51':139
- '72.##2.74.117':139
- '72.##2.230.210':139
- '72.##2.22.149':139
- '72.##2.69.36':139
- '72.##2.210.57':139
- '72.##2.12.148':139
- '72.##2.195.36':139
- '72.##2.208.80':139
- '72.##2.82.166':139
- '72.##2.245.240':139
- '72.##2.137.40':139
- '72.##2.66.41':139
- '72.##2.235.252':139
- '72.##2.55.242':139
- '72.##2.26.50':139
- '72.##2.27.152':139
- '72.##2.58.36':139
- '72.#72.42.3':139
- '72.##2.10.148':139
- '72.##2.148.252':139
- '72.##2.48.108':139
- '72.##2.209.62':139
- '72.##2.85.173':139
- '72.##2.71.150':139
- '72.##2.123.90':139
- '72.##2.248.191':139
- '72.##2.252.242':139
- '72.##2.71.241':139
- '72.##2.59.72':139
- '72.#72.1.25':139
- '72.##2.49.34':139
- '72.##2.231.247':139
- '72.##2.166.6':139
- '72.#72.8.6':139
- '72.##2.60.49':139
- '72.##2.148.54':139
- '72.##2.17.13':139
- '72.##2.195.242':139
- '72.##2.190.135':139
- '72.##2.35.191':139
- '72.##2.48.36':139
- '72.##2.218.148':139
- '72.##2.86.192':139
- '72.##2.156.181':139
- '72.##2.30.174':139
- '72.##2.97.175':139
- '72.##2.155.141':139
- '72.##2.200.18':139
- '72.##2.74.87':139
- '72.##2.47.98':139
- '72.##2.52.217':139
- '72.##2.117.115':139
- '72.##2.191.205':139
- '72.##2.77.249':139
- '72.##2.189.66':139
- '72.##2.163.81':139
- '72.##2.112.45':139
- '72.##2.178.30':139
- '72.##2.136.86':139
- '72.##2.52.139':139
- '72.##2.216.212':139
- '72.##2.211.71':139
- '72.##2.33.40':139
- '72.##2.34.149':139
- '72.##2.11.160':139
- '72.##2.225.220':139
- '72.#72.2.3':139
- '72.##2.195.152':139
- '72.##2.2.131':139
- '72.##2.185.55':139
- '72.##2.210.57':9988
- '72.##2.36.139':9988
- '72.##2.205.129':9988
- '72.##2.21.40':9988
- '72.##2.245.240':9988
- '72.##2.208.80':9988
- '72.##2.148.126':9988
- '72.##2.244.92':9988
- '72.##2.143.36':9988
- '72.##2.69.36':9988
- '72.##2.145.72':9988
- '72.##2.60.210':9988
- '72.##2.45.182':9988
- '72.##2.66.41':9988
- '72.##2.4.206':9988
- '72.##2.20.104':9988
- '72.##2.97.130':9988
- '72.##2.134.56':9988
- '72.##2.12.148':9988
- '72.##2.137.40':9988
- '72.##2.207.112':9988
- '72.##2.74.117':9988
- '72.##2.129.86':9988
- '72.##2.143.109':9988
- '72.##2.94.176':9988
- '72.##2.106.234':9988
- '72.##2.82.166':9988
- '72.##2.186.75':9988
- '72.##2.218.229':9988
- '72.##2.114.92':139
- '72.##2.138.103':139
- '72.##2.200.12':139
- '72.##2.35.162':139
- '72.##2.39.224':139
- '72.##2.230.87':139
- '72.##2.48.231':139
- '72.##2.252.102':139
- '72.##2.86.234':139
- '72.##2.76.160':139
- '72.##2.103.49':139
- '72.##2.38.154':139
- '72.##2.184.161':139
- '72.##2.92.130':139
- '72.##2.207.10':139
- '72.##2.171.31':9988
- '72.##2.201.15':9988
- '72.##2.230.210':9988
- '72.##2.22.149':9988
- '72.##2.84.218':9988
- '72.##2.58.203':9988
- '72.##2.80.191':9988
- '72.##2.175.148':139
- '72.##2.24.86':139
- '72.##2.121.230':139
- '72.##2.50.23':139
- '72.##2.36.159':9988
- '72.##2.61.56':139
- '72.##2.208.207':139