VirusHunter предупреждает всех пользователей ПК о распространении в сети Интернет нескольких модификаций троянского семейства Trojan.SiteRunner.urlGen, пытающихся в бесконечном цикле открывать поисковые окна вэб-броузера с целью загрузки различных сайтов...


Попадание в машину и общий принцип работы.

В принципе, данное троянское семейство представляет собой многочисленные вариации одной и той же программы Trojan.SiteRunner.urlGen. После изучения кода файлов, представляющих собой вариации на тему "Trojan-Clicker", я пришел к выводу, что все они являются детищами того же автора, что и вредоносные программы Trojan.Web-guide.zolker011, а также Trojan.Web-guide. Performent011,217.

Трояны-кликеры (Trojan-Clicker) - это примитивные пакостные программы, назначением которых является неконтролируемый пользователем запуск поисковых окон установленного в системе вэб-броузера (в данном случае - Internet Explorer) с целью вызова в этих окнах различных сайтов рекламного и порнографического характера. Такие программы, как правило, управляются др. вредоносными программами, заразившими компьютер. В частности, семейство Trojan.SiteRunner.urlGen имеет строго определенные признаки и свои повадки, по причине чего и были выделены мной из прочих программ такого рода как отдельное семейство.
Все представители Trojan.SiteRunner.urlGen являются однокомпонентными программами-приложениями ОС Windows (PE EXE-файлы), написанными на языке Microsoft Visual C. Файлы имеют средний размер от 6 до 8 кб; сжаты утилитой компрессии "FSG" версии 2.0; в декомпрессированном виде средний размер может достигать порядка 65-70 кб.
В систему данные троянцы попадают под различными именами, посредством их загрузки в машину какими-либо др. вредоносными программами - например, Trojan.Web-guide. Performent217.
После загрузки троянцы обычно копируются либо в системный подкаталог C:\WINDOWS\SYSTEM\, если на машине установлена ОС Windows 9X/ME, либо в C:\WINDOWS\System32\, если на машине установлена ОС Windows 2K/XP. В большинстве случаев, файлы называются либо 001.exe, либо имеют имя, состоящее из 5-6 произвольных цифр, например: 55843.exe, 873093.exe, 874921.exe или что-то в этом роде.
Троянцы неспособны самостоятельно запускаться при старте системы, т.к. не создают в реестре никаких соответствующих ключей; их запуск производится какой-либо др. троянской программой, как правило, той, которая и загрузила последних из Интернета.
После своего запуска троянский процесс остается активным в системной памяти вплоть до завершения работы системы. Любой из представителей Trojan.SiteRunner.urlGen в непрерывном цикле открывает в фоновом режиме дополнительные окна вэб-броузера Internet Explorer (не более 2-х одновременно; окно нельзя увидеть на экране, т.к. для его сокрытия используется специальная процедура вызова), в которых пытается случайным образом вызывать одну из огромного множества URL-ссылок на рекламные и порно-сервера. С промежутками от 20 до 40 секунд (зависит от версии Windows-системы и версии троянской программы), скрытое от глаз пользователя окно с загруженным сайтом разворачивается на весь экран. Если же машина не подключена к Интернету, то в развернутом окне можно увидеть стандартное системное сообщение об ошибке загрузки искомой страницы; если количество развернутых на экран окон достигает 2 штук, то они поочередно могут быть захлопнуты, а через несколько секунд весь процесс поиска начинается сначала. Опыты по выявлению промежутков времени, через которые произойдет захлопывание развернутых окон и последующий поиск по новым ссылкам, на тест-машине не проводились.
Для соединения с искомыми серверами троянцы пытаются открыть 1026-й машинный порт; если же порт занят или неактивен, то значение порта увеличивается на 1 и т.д. Интересен тот факт, что вышеописанные приемы также имели место в троянской программе Trojan-PSW.InvisibleThief.23019, используемой для хищения конфиденциальных пользовательских данных и различных паролей.
Теперь подробнее о каждой из обнаруженных модификаций семейства Trojan.SiteRunner.urlGen.


Trojan.SiteRunner.urlGen_7141

Имеет размер 7141 байт. В декомпрессированном виде размер составил примерно 94208 байт.
Пытается загружать сайты, ссылки на которые выбираются случайным образом из следующего списка:

3d-roulette.there-all.com
backgammon-gambling.there-all.com
basic-black-jack.there-all.com
beat-roulette.there-all.com
best-gambling-site.there-all.com
best-gambling-web-site.there-all.com
best-online-casino-gambling.there-all.com
best-online-gambling.there-all.com
best-roulette.there-all.com
blackjack.there-all.com
black-jack-basic-strategy-chart.there-all.com
black-jack-casino.there-all.com
black-jack-casino-directory.there-all.com
black-jack-dealer.there-all.com
black-jack-forum.there-all.com
black-jack-free-ware.there-all.com
black-jack-gambling.there-all.com
black-jack-guide.there-all.com
black-jack-header.there-all.com
black-jack-mountain-oklahoma.there-all.com
black-jack-practice.there-all.com
black-jack-simulator.there-all.com
black-jack-strategy-chart.there-all.com
buckaroo-black-jack.there-all.com
casino-gambling.there-all.com
casino-gambling-online.there-all.com
casino-grand-online.there-all.com
casino-international-online.there-all.com
casino-neteller-online.there-all.com
casino-newest-online.there-all.com
casino-online-gambling-guide.there-all.com
casino-online-own.there-all.com
casino-online-payouts.there-all.com
casino-roulette.there-all.com
casino-secure-online-gambling.there-all.com
classic-online-poker-video.there-all.com
college-football-gambling.there-all.com
computer-roulette.there-all.com
craps-roulette.there-all.com
craps-roulette-wager.there-all.com
cyber-gambling.there-all.com
cyber-roulette.there-all.com
directory-roulette.there-all.com
discount-phentermine.there-all.com
entertainment-gambling.there-all.com
european-roulette-online.there-all.com
european-roulette-vip.there-all.com
football-gambling.there-all.com
football-online-gambling.there-all.com
free-gambling.there-all.com
free-gambling-tip.there-all.com
free-online-gambling.there-all.com
free-online-poker-game.there-all.com
free-roulette.there-all.com
gamble-gambling.there-all.com
gambling-addiction.there-all.com
gambling-advice.there-all.com
gambling-affiliate-program.there-all.com
gambling-bet.there-all.com
gambling-betting.there-all.com
gambling-card.there-all.com
gambling-casino-online.there-all.com
gambling-casino-online-bonus.there-all.com
gambling-craps.there-all.com
gambling-directory.there-all.com
gambling-forum.there-all.com
gambling-game.there-all.com
gambling-hueyspicks-sports.there-all.com
gambling-internet.there-all.com
gambling-links.there-all.com
gambling-machine.there-all.com
gambling-money.there-all.com
gambling-odds.there-all.com
gambling-poker.there-all.com
gambling-problem.there-all.com
gambling-roulette-roulette-roulette-syst.there-all.com
gambling-software.there-all.com
gambling-strategy.there-all.com
gambling-system.there-all.com
gambling-uk.there-all.com
gambling-web-site.there-all.com
gambling-zone.there-all.com
general-gambling.there-all.com
green-bay-gambling.there-all.com
history-of-gambling.there-all.com
holdem-poker-online.there-all.com
internet-casino-gambling.there-all.com
internet-casino-gambling-online.there-all.com
internet-casion-gambling.there-all.com
internet-gambling.there-all.com
internet-gambling-site.there-all.com
jack-black-movie.there-all.com
keyword-roulette.there-all.com
las-vegas-gambling.there-all.com
links-to-gambling.there-all.com
multiplayer-poker-online.there-all.com
nasonex-online-pharmacy.there-all.com
nfl-gambling.there-all.com
number-1-online-video-poker.there-all.com
offshore-gambling.there-all.com
online-american-roulette.there-all.com
online-betting-poker.there-all.com
online-betting-sports-gambling.there-all.com
online-casino.there-all.com
online-casino-gambling.there-all.com
online-casino-gambling-site.there-all.com
online-casino-game.there-all.com
online-casino-poker.there-all.com
online-casino-roulette.there-all.com
online-casino-slot-gambling.there-all.com
online-gambling-addiction.there-all.com
online-gambling-bonus.there-all.com
online-gambling-casino.there-all.com
online-gambling-directory.there-all.com
online-gambling-law.there-all.com
online-gambling-portal.there-all.com
online-gambling-site.there-all.com
online-gambling-special.there-all.com
online-game-gambling-casino.there-all.com
online-poker.there-all.com
online-poker-bonus.there-all.com
online-poker-for-fun.there-all.com
online-poker-gambling.there-all.com
online-poker-game-card.there-all.com
online-poker-pay-pal.there-all.com
online-poker-poker.there-all.com
online-poker-rooms.there-all.com
online-poker-site.there-all.com
online-poker-strategy.there-all.com
online-roulette-gambling.there-all.com
online-roulette-poker.there-all.com
online-roulette-strategy.there-all.com
online-sport-book-gambling.there-all.com
online-sports-gambling.there-all.com
online-video-poker.there-all.com
online-video-poker-game.there-all.com
online-virtual-gambling.there-all.com
play-free-poker-online.there-all.com
playing-poker-online.there-all.com
play-online-poker.there-all.com
play-roulette.there-all.com
poker-bet-online.there-all.com
poker-gambling-game.there-all.com
poker-roulette.there-all.com
real-gambling.there-all.com
roulette.there-all.com
roulette-antique.there-all.com
roulette-armstead.there-all.com
roulette-a-vendre.there-all.com
roulette-bet.there-all.com
roulette-bonaire.there-all.com
roulette-dare.there-all.com
roulette-gambling.there-all.com
roulette-gambling-system.there-all.com
roulette-game.there-all.com
roulette-game-free-online.there-all.com
roulette-history.there-all.com
roulette-on-line-rvs.there-all.com
roulette-payouts.there-all.com
roulette-record.there-all.com
roulette-rule.there-all.com
roulette-slot-machine.there-all.com
roulette-strategy.there-all.com
roulette-supply.there-all.com
roulette-system.there-all.com
roulette-table-for-sale.there-all.com
roulette-wheel.there-all.com
roulette-wheel-diagram.there-all.com
roulette-wheel-layout.there-all.com
roulette-winning-strategy.there-all.com
slot-gambling.there-all.com
slot-roulette.there-all.com
sport-gambling.there-all.com
sports-gambling.there-all.com
sports-gambling-affiliate.there-all.com
sports-hueyspicks-gambling-football.there-all.com
texas-hold-em-poker-online.there-all.com
video-poker-online-for-fun.there-all.com
web-gambling.there-all.com
winning-roulette-system.there-all.com
2005-gamble-procter.about-all.org
3d-roulette.about-all.org
backgammon-gambling.about-all.org
basic-black-jack.about-all.org
beat-roulette.about-all.org
best-gambling-site.about-all.org
best-gambling-web-site.about-all.org
best-online-casino-gambling.about-all.org
best-online-gambling.about-all.org
best-roulette.about-all.org
blackjack.about-all.org
black-jack-basic-strategy-chart.about-all.org
black-jack-casino.about-all.org
black-jack-casino-directory.about-all.org
black-jack-dealer.about-all.org
black-jack-forum.about-all.org
black-jack-free-ware.about-all.org
black-jack-gambling.about-all.org
black-jack-guide.about-all.org
black-jack-header.about-all.org
black-jack-mountain-oklahoma.about-all.org
black-jack-practice.about-all.org
black-jack-simulator.about-all.org
black-jack-strategy-chart.about-all.org
buckaroo-black-jack.about-all.org
casino-gambling.about-all.org
casino-gambling-online.about-all.org
casino-grand-online.about-all.org
casino-international-online.about-all.org
casino-neteller-online.about-all.org
casino-newest-online.about-all.org
casino-online-gambling-guide.about-all.org
casino-online-own.about-all.org
casino-online-payouts.about-all.org
casino-roulette.about-all.org
casino-secure-online-gambling.about-all.org
charles-gamble.about-all.org
classic-online-poker-video.about-all.org
college-football-gambling.about-all.org
computer-roulette.about-all.org
craps-roulette.about-all.org
craps-roulette-wager.about-all.org
cyber-gambling.about-all.org
cyber-roulette.about-all.org
directory-roulette.about-all.org
download.us-partypoker.about-all.org
do-you-tax-on-partypoker.about-all.org
edge.net
-partypoker.about-all.org
edge-partypoker.about-all.org
entertainment-gambling.about-all.org
european-roulette-online.about-all.org
european-roulette-vip.about-all.org
football-gambling.about-all.org
football-online-gambling.about-all.org
free-gambling.about-all.org
free-gambling-tip.about-all.org
free-online-gambling.about-all.org
free-online-poker-game.about-all.org
free-roulette.about-all.org
gamble.about-all.org
gamble-gambling.about-all.org
gamble-house.about-all.org
gamble-oscar.about-all.org
gamble-skogmo.about-all.org
gamble-wide-world.about-all.org
gambling-addiction.about-all.org
gambling-advice.about-all.org
gambling-affiliate-program.about-all.org
gambling-bet.about-all.org
gambling-betting.about-all.org
gambling-card.about-all.org
gambling-casino-online.about-all.org
gambling-casino-online-bonus.about-all.org
gambling-craps.about-all.org
gambling-directory.about-all.org
gambling-forum.about-all.org
gambling-game.about-all.org
gambling-hueyspicks-sports.about-all.org
gambling-internet.about-all.org
gambling-links.about-all.org
gambling-machine.about-all.org
gambling-money.about-all.org
gambling-odds.about-all.org
gambling-poker.about-all.org
gambling-problem.about-all.org
gambling-roulette-roulette-roulette-syst.about-all.org
gambling-software.about-all.org
gambling-strategy.about-all.org
gambling-system.about-all.org
gambling-uk.about-all.org
gambling-web-site.about-all.org
gambling-zone.about-all.org
general-gambling.about-all.org
green-bay-gambling.about-all.org
history-of-gambling.about-all.org
holdem-poker-online.about-all.org
internet-casino-gambling.about-all.org
internet-casino-gambling-online.about-all.org
internet-casion-gambling.about-all.org
internet-gambling.about-all.org
internet-gambling-site.about-all.org
jack-black-movie.about-all.org
keyword-roulette.about-all.org
las-vegas-gambling.about-all.org
links-to-gambling.about-all.org
multiplayer-poker-online.about-all.org
nfl-gambling.about-all.org
number-1-online-video-poker.about-all.org
offshore-gambling.about-all.org
online-american-roulette.about-all.org
online-betting-poker.about-all.org
online-betting-sports-gambling.about-all.org
online-casino.about-all.org
online-casino-gambling.about-all.org
online-casino-gambling-site.about-all.org
online-casino-game.about-all.org
online-casino-poker.about-all.org
online-casino-roulette.about-all.org
online-casino-slot-gambling.about-all.org
online-gambling-addiction.about-all.org
online-gambling-bonus.about-all.org
online-gambling-casino.about-all.org
online-gambling-directory.about-all.org
online-gambling-law.about-all.org
online-gambling-portal.about-all.org
online-gambling-site.about-all.org
online-gambling-special.about-all.org
online-game-gambling-casino.about-all.org
online-poker.about-all.org
online-poker-bonus.about-all.org
online-poker-for-fun.about-all.org
online-poker-gambling.about-all.org
online-poker-game-card.about-all.org
online-poker-pay-pal.about-all.org
online-poker-poker.about-all.org
online-poker-rooms.about-all.org
online-poker-site.about-all.org
online-poker-strategy.about-all.org
online-roulette-gambling.about-all.org
online-roulette-poker.about-all.org
online-roulette-strategy.about-all.org
online-sport-book-gambling.about-all.org
online-sports-gambling.about-all.org
online-video-poker.about-all.org
online-video-poker-game.about-all.org
online-virtual-gambling.about-all.org
partypoker.about-all.org
partypoker-net.about-all.org
play-free-poker-online.about-all.org
playing-poker-online.about-all.org
play-online-poker.about-all.org
play-partypoker.about-all.org
play-roulette.about-all.org
poker-bet-online.about-all.org
poker-gambling-game.about-all.org
poker-roulette.about-all.org
real-gambling.about-all.org
roulette.about-all.org
roulette-antique.about-all.org
roulette-armstead.about-all.org
roulette-a-vendre.about-all.org
roulette-bet.about-all.org
roulette-bonaire.about-all.org
roulette-dare.about-all.org
roulette-gambling.about-all.org
roulette-gambling-system.about-all.org
roulette-game.about-all.org
roulette-game-free-online.about-all.org
roulette-history.about-all.org
roulette-on-line-rvs.about-all.org
roulette-payouts.about-all.org
roulette-record.about-all.org
roulette-rule.about-all.org
roulette-slot-machine.about-all.org
roulette-strategy.about-all.org
roulette-supply.about-all.org
roulette-system.about-all.org
roulette-table-for-sale.about-all.org
roulette-wheel.about-all.org
roulette-wheel-diagram.about-all.org
roulette-wheel-layout.about-all.org
roulette-winning-strategy.about-all.org
slot-gambling.about-all.org
slot-roulette.about-all.org
sport-gambling.about-all.org
sports-gambling.about-all.org
sports-gambling-affiliate.about-all.org
sports-hueyspicks-gambling-football.about-all.org
texas-hold-em-poker-online.about-all.org
video-poker-online-for-fun.about-all.org
web-gambling.about-all.org
winning-roulette-system.about-all.org
2005-gamble-procter.necessariness.com
3d-roulette.necessariness.com
backgammon-gambling.necessariness.com
basic-black-jack.necessariness.com
beat-roulette.necessariness.com
best-gambling-site.necessariness.com
best-gambling-web-site.necessariness.com
best-online-casino-gambling.necessariness.com
best-online-gambling.necessariness.com
best-roulette.necessariness.com
blackjack.necessariness.com
black-jack-basic-strategy-chart.necessariness.com
black-jack-casino.necessariness.com
black-jack-casino-directory.necessariness.com
black-jack-dealer.necessariness.com
black-jack-forum.necessariness.com
black-jack-free-ware.necessariness.com
black-jack-gambling.necessariness.com
black-jack-guide.necessariness.com
black-jack-header.necessariness.com
black-jack-mountain-oklahoma.necessariness.com
black-jack-practice.necessariness.com
black-jack-simulator.necessariness.com
black-jack-strategy-chart.necessariness.com
buckaroo-black-jack.necessariness.com
casino-gambling.necessariness.com
casino-gambling-online.necessariness.com
casino-grand-online.necessariness.com
casino-international-online.necessariness.com
casino-neteller-online.necessariness.com
casino-newest-online.necessariness.com
casino-online-gambling-guide.necessariness.com
casino-online-own.necessariness.com
casino-online-payouts.necessariness.com
casino-roulette.necessariness.com
casino-secure-online-gambling.necessariness.com
charles-gamble.necessariness.com
classic-online-poker-video.necessariness.com
college-football-gambling.necessariness.com
computer-roulette.necessariness.com
craps-roulette.necessariness.com
craps-roulette-wager.necessariness.com
cyber-gambling.necessariness.com
cyber-roulette.necessariness.com
directory-roulette.necessariness.com
download.us-partypoker.necessariness.com
do-you-tax-on-partypoker.necessariness.com
edge.net
-partypoker.necessariness.com
edge-partypoker.necessariness.com
entertainment-gambling.necessariness.com
european-roulette-online.necessariness.com
european-roulette-vip.necessariness.com
football-gambling.necessariness.com
football-online-gambling.necessariness.com
free-gambling.necessariness.com
free-gambling-tip.necessariness.com
free-online-gambling.necessariness.com
free-online-poker-game.necessariness.com
free-roulette.necessariness.com
gamble.necessariness.com
gamble-gambling.necessariness.com
gamble-house.necessariness.com
gamble-oscar.necessariness.com
gamble-skogmo.necessariness.com
gamble-wide-world.necessariness.com
gambling-addiction.necessariness.com
gambling-advice.necessariness.com
gambling-affiliate-program.necessariness.com
gambling-bet.necessariness.com
gambling-betting.necessariness.com
gambling-card.necessariness.com
gambling-casino-online.necessariness.com
gambling-casino-online-bonus.necessariness.com
gambling-craps.necessariness.com
gambling-directory.necessariness.com
gambling-forum.necessariness.com
gambling-game.necessariness.com
gambling-hueyspicks-sports.necessariness.com
gambling-internet.necessariness.com
gambling-links.necessariness.com
gambling-machine.necessariness.com
gambling-money.necessariness.com
gambling-odds.necessariness.com
gambling-poker.necessariness.com
gambling-problem.necessariness.com
gambling-roulette-roulette-roulette-syst.necessariness.com
gambling-software.necessariness.com
gambling-strategy.necessariness.com
gambling-system.necessariness.com
gambling-uk.necessariness.com
gambling-web-site.necessariness.com
gambling-zone.necessariness.com
general-gambling.necessariness.com
green-bay-gambling.necessariness.com
history-of-gambling.necessariness.com
holdem-poker-online.necessariness.com
internet-casino-gambling.necessariness.com
internet-casino-gambling-online.necessariness.com
internet-casion-gambling.necessariness.com
internet-gambling.necessariness.com
internet-gambling-site.necessariness.com
jack-black-movie.necessariness.com
keyword-roulette.necessariness.com
las-vegas-gambling.necessariness.com
links-to-gambling.necessariness.com
multiplayer-poker-online.necessariness.com
nfl-gambling.necessariness.com
number-1-online-video-poker.necessariness.com
offshore-gambling.necessariness.com
online-american-roulette.necessariness.com
online-betting-poker.necessariness.com
online-betting-sports-gambling.necessariness.com
online-casino.necessariness.com
online-casino-gambling.necessariness.com
online-casino-gambling-site.necessariness.com
online-casino-game.necessariness.com
online-casino-poker.necessariness.com
online-casino-roulette.necessariness.com
online-casino-slot-gambling.necessariness.com
online-gambling-addiction.necessariness.com
online-gambling-bonus.necessariness.com
online-gambling-casino.necessariness.com
online-gambling-directory.necessariness.com
online-gambling-law.necessariness.com
online-gambling-portal.necessariness.com
online-gambling-site.necessariness.com
online-gambling-special.necessariness.com
online-game-gambling-casino.necessariness.com
online-poker.necessariness.com
online-poker-bonus.necessariness.com
online-poker-for-fun.necessariness.com
online-poker-gambling.necessariness.com
online-poker-game-card.necessariness.com
online-poker-pay-pal.necessariness.com
online-poker-poker.necessariness.com
online-poker-rooms.necessariness.com
online-poker-site.necessariness.com
online-poker-strategy.necessariness.com
online-roulette-gambling.necessariness.com
online-roulette-poker.necessariness.com
online-roulette-strategy.necessariness.com
online-sport-book-gambling.necessariness.com
online-sports-gambling.necessariness.com
online-video-poker.necessariness.com
online-video-poker-game.necessariness.com
online-virtual-gambling.necessariness.com
partypoker.necessariness.com
partypoker-net.necessariness.com
play-free-poker-online.necessariness.com
playing-poker-online.necessariness.com
play-online-poker.necessariness.com
play-partypoker.necessariness.com
play-roulette.necessariness.com
poker-bet-online.necessariness.com
poker-gambling-game.necessariness.com
poker-roulette.necessariness.com
real-gambling.necessariness.com
roulette.necessariness.com
roulette-antique.necessariness.com
roulette-armstead.necessariness.com
roulette-a-vendre.necessariness.com
roulette-bet.necessariness.com
roulette-bonaire.necessariness.com
roulette-dare.necessariness.com
roulette-gambling.necessariness.com
roulette-gambling-system.necessariness.com
roulette-game.necessariness.com
roulette-game-free-online.necessariness.com
roulette-history.necessariness.com
roulette-on-line-rvs.necessariness.com
roulette-payouts.necessariness.com
roulette-record.necessariness.com
roulette-rule.necessariness.com
roulette-slot-machine.necessariness.com
roulette-strategy.necessariness.com
roulette-supply.necessariness.com
roulette-system.necessariness.com
roulette-table-for-sale.necessariness.com
roulette-wheel.necessariness.com
roulette-wheel-diagram.necessariness.com
roulette-wheel-layout.necessariness.com
roulette-winning-strategy.necessariness.com
slot-gambling.necessariness.com
slot-roulette.necessariness.com
sport-gambling.necessariness.com
sports-gambling.necessariness.com
sports-gambling-affiliate.necessariness.com
sports-hueyspicks-gambling-football.necessariness.com
texas-hold-em-poker-online.necessariness.com
video-poker-online-for-fun.necessariness.com
web-gambling.necessariness.com
winning-roulette-system.necessariness.com
ads-dating.select-search.net
adult-dating-online.select-search.net
adult-dating-personal.select-search.net
agency-dating-nz.select-search.net
airline-cheap-dirt-robot-ticket.select-search.net
arizona-wagering.select-search.net
asian-dating-site.select-search.net
bay-city-refinance.select-search.net
best-refinance-loan.select-search.net
betting-wagering.select-search.net
bingo-bonus-free-online-sign-up.select-search.net
bingo-cash-free-game-online.select-search.net
bingo-cash-free-game-online-prize.select-search.net
bingo-cash-free-online-play-real-time-win.select-search.net
bingo-casino-play-game-online-free.select-search.net
bingo-free-fun-online.select-search.net
bingo-online-free-signup-bonus.select-search.net
bingo-the-game-for-free-online-now.select-search.net
book-sports-wagering.select-search.net
bow-ciara-dating-wow.select-search.net
broker-cheap-ticket-trick.select-search.net
buy-fake-college-degree.select-search.net
chat-dating-room.select-search.net
cheap-air-fare-ticket.select-search.net
cheap-airline-ticket-canada.select-search.net
cheap-airline-ticket-to-london.select-search.net
cheap-baseball-ticket.select-search.net
cheap-business-class-ticket.select-search.net
cheap-cruise-ticket.select-search.net
cheap-disney-hopper-ticket.select-search.net
cheap-hotel-ticket.select-search.net
cheap-lion-king-ticket.select-search.net
cheap-sea-world-ticket.select-search.net
cheap-student-ticket.select-search.net
cheap-ticket-to-brazil.select-search.net
cheap-ticket-to-philippine.select-search.net
cheap-ticket-to-russia.select-search.net
cheap-ticket-to-vegas.select-search.net
cheap-train-ticket-manchester-london.select-search.net
cheap-trick-concert-ticket.select-search.net
cheap-yankee-ticket.select-search.net
college-degree-diploma-fake-novelty.select-search.net
college-degree-fake-free.select-search.net
college-diploma-fake-degree.select-search.net
dating-double.select-search.net
dating-francisco-san.select-search.net
dating-free-online-service.select-search.net
dating-free-online-services.select-search.net
dating-free-personals.select-search.net
dating-free-site-web.select-search.net
dating-game-sim.select-search.net
dating-herpes.select-search.net
dating-internet-service.select-search.net
dating-internet-services.select-search.net
dating-jewish-service.select-search.net
dating-man.select-search.net
dating-new-york.select-search.net
dating-nz.select-search.net
dating-parent-single.select-search.net
dating-servic.select-search.net
dating-services.select-search.net
dating-texas.select-search.net
debt-consolidation-refinance.select-search.net
fake-college-degree.select-search.net
fake-college-degree-and-transcript.select-search.net
fake-college-degree-for-cheap.select-search.net
fake-college-degree-online.select-search.net
football-nfl-online-wagering.select-search.net
free-bingo-card-online.select-search.net
free-bingo-online-no-deposit.select-search.net
free-bingo-online-uk.select-search.net
free-cash-to-play-prize-bingo-online.select-search.net
free-fake-college-degree.select-search.net
free-kid-bingo-game-online.select-search.net
free-online-baby-bingo.select-search.net
free-online-bingo-bonus.select-search.net
free-online-bingo-multiplayer.select-search.net
free-online-bingo-win-money.select-search.net
free-online-game-like-bingo.select-search.net
free-online-printable-baby-bingo-card.select-search.net
free-online-saints-and-sinner-bingo.select-search.net
free-prize-bingo-game-online.select-search.net
game-wagering.select-search.net
golf-wagering.select-search.net
house-michigan-refinance.select-search.net
house-mortgage-refinance.select-search.net
internet-sports-wagering.select-search.net
last-minute-cheap-ticket.select-search.net
low-refinance-rate.select-search.net
manufactured-home-refinance.select-search.net
miami-wagering.select-search.net
michigan-mortgage-refinance.select-search.net
michigan-refinance.select-search.net
new-racing-state-wagering-york.select-search.net
news-wagering.select-search.net
no-closing-cost-refinance.select-search.net
nys-racing-wagering.select-search.net
odds-sports-wagering.select-search.net
off-track-wagering.select-search.net
online-bingo-free.select-search.net
online-suggest-url-wagering.select-search.net
pick-wagering.select-search.net
really-really-cheap-plane-ticket.select-search.net
refinance.select-search.net
refinance-atlanta.select-search.net
refinance-cash-advance.select-search.net
refinance-credit-union.select-search.net
refinance-indianapolis.select-search.net
refinance-mortgage-lead.select-search.net
refinance-pittsburgh.select-search.net
refinance-properties.select-search.net
refinance-saginaw.select-search.net
roulette-wagering.select-search.net
technology-wagering.select-search.net
texas-refinance.select-search.net
va-home-loan-refinance.select-search.net
wagering.select-search.net
wagering-wireless.select-search.net
washington-refinance.select-search.net
10-march-pings-poker-trackback.about-all.org
21-black-free-jack-play.about-all.org
21-black-fun-jack-play.about-all.org
2-2-forum-plus-poker.about-all.org
2-2-forum-poker.about-all.org
24100-black-jack-vegas.about-all.org
absolute-forum-poker.about-all.org
add-black-jack-link.about-all.org
add-black-jack-link-new.about-all.org
add-black-jack-link-own.about-all.org
add-black-jack-link-suggest.about-all.org
american-black-jack-play.about-all.org
back-door-poker-yahoo.about-all.org
basic-black-engine-jack-strategy.about-all.org
basic-black-guide-jack-strategy.about-all.org
basic-black-jack.about-all.org
basic-black-jack-visual.about-all.org
basic-strategy-in-black-jack.about-all.org
betting-poker.about-all.org
black-casino-free-jack-play.about-all.org
black-casino-internet-jack.about-all.org
black-casino-jack-play.about-all.org
black-cheat-free-jack-sheet.about-all.org
black-en-jack-language-play.about-all.org
black-fact-fiction-jack-pershing.about-all.org
black-free-free-jack-keno-play-poker-ride.about-all.org
black-free-game-jack-play.about-all.org
black-free-game-jack-yahoo.about-all.org
black-free-jack-learn-play.about-all.org
black-free-jack-line-play.about-all.org
black-free-jack-online-play-strip.about-all.org
black-free-jack-play.about-all.org
black-free-jack-play-strip.about-all.org
black-free-jack-practice.about-all.org
black-fun-jack-online-play.about-all.org
black-fun-jack-play.about-all.org
black-gambling-jack-machine-slot.about-all.org
black-gambling-jack-poker-video.about-all.org
black-game-jack-play.about-all.org
black-game-jack-yahoo.about-all.org
black-jack.about-all.org
black-jack-21.about-all.org
black-jack-ballroom.about-all.org
black-jack-ballroom-casino.about-all.org
black-jack-basic-strategy.about-all.org
black-jack-basic-strategy-card.about-all.org
black-jack-basic-strategy-chart.about-all.org
black-jack-basic-strategy-table.about-all.org
black-jack-basic-strategy-trainer.about-all.org
black-jack-betting.about-all.org
black-jack-betting-strategy.about-all.org
black-jack-book.about-all.org
black-jack-boot.about-all.org
black-jack-card.about-all.org
black-jack-card-counting.about-all.org
black-jack-casino-game.about-all.org
black-jack-chart.about-all.org
black-jack-cheat-sheet.about-all.org
black-jack-download.about-all.org
black-jack-download-free-ware.about-all.org
black-jack-forum.about-all.org
black-jack-free-ware.about-all.org
black-jack-gambling.about-all.org
black-jack-game-download.about-all.org
black-jack-game-free-ware.about-all.org
black-jack-guide.about-all.org
black-jack-header.about-all.org
black-jack-in-las-vegas.about-all.org
black-jack-internet-casino.about-all.org
black-jack-knife.about-all.org
black-jack-learn-play.about-all.org
black-jack-line-play.about-all.org
black-jack-machine-slot.about-all.org
black-jack-mit-strategy.about-all.org
black-jack-mit-student.about-all.org
black-jack-mit-system.about-all.org
black-jack-money-online-play.about-all.org
black-jack-money-online-play-real.about-all.org
black-jack-money-play.about-all.org
black-jack-mountain-oklahoma.about-all.org
black-jack-muslim-pershing.about-all.org
black-jack-new-site-submit.about-all.org
black-jack-online.about-all.org
black-jack-online-play.about-all.org
black-jack-online-practice.about-all.org
black-jack-pershing.about-all.org
black-jack-picture.about-all.org
black-jack-pizza.about-all.org
black-jack-play-roulette.about-all.org
black-jack-play-rule.about-all.org
black-jack-play-tip.about-all.org
black-jack-play-tourneys.about-all.org
black-jack-poker.about-all.org
black-jack-practice.about-all.org
black-jack-practice-share-ware.about-all.org
black-jack-rule.about-all.org
black-jack-secret.about-all.org
black-jack-site-submit.about-all.org
black-jack-site-submit-web.about-all.org
black-jack-slot-machine.about-all.org
black-jack-slot-machine-gambling.about-all.org
black-jack-software.about-all.org
black-jack-strategy.about-all.org
black-jack-strategy-card.about-all.org
black-jack-strategy-chart.about-all.org
black-jack-supply.about-all.org
black-jack-system.about-all.org
black-jack-tip.about-all.org
black-jack-tip-underground-vegas.about-all.org
black-jack-tournament.about-all.org
black-jack-tournament-in-las-vegas.about-all.org
black-jack-tournament-las-vegas.about-all.org
black-jack-type.about-all.org
black-jack-video.about-all.org
bob-dancer-video-poker.


Также троянец периодически пытается посещать какой-то сайт

http://%/index.php

Вариант Trojan.SiteRunner.urlGen_7141 антивирусы детектируют так:

Антивирус Kaspersky AntiVirus: Trojan-Clicker.Win32.Small.hz
Антивирус DrWeb: Trojan.Click.688
Антивирус BitDefender Professional: Trojan.Clicker.Small.HZ


Trojan.SiteRunner.urlGen_6209

Имеет размер 6209 байт. В декомпрессированном виде размер составил примерно 65536 байт.
Троянец пытается загружать сайты по ссылкам, выбираемым случайным образом из следующего списка (некоторые фрагменты ссылок по соображениям безопасности я заменил символом "%"):

http://imgs.klik%.com/search.php?aff=%%&q=%%%
http://fet21%%.bond%.com/mwsfeed.php?qq=%%%
http://www.clicksearchclick.%/search.php?aff=%%&q=%%%
http://fet411.bond%.com/search.php?aff=%%%&q=%%%
http://ref00%%.real%.com/mwsfeed.php?q=%%%
http://www.ya%.com/search.php?said=%%&qq=%%%


Вместо переменных "%%" и "%%%" выбираются значения - фрагменты текста из нижеприведенного списка (приведена только небольшая часть):

spy
Wireless
Lighting
boy
Xenical
Buy+Xenical
Acyclovir
Valtrex
Didrex
Meridia
Moving
Acyclovir
Buy+Acyclovir
What+Is+Acyclovir
online
cheap
penis
escorts
for+woman
pussy
free
teens
teen
free+teens+fuck
sexy+teens+photo
sexy+teen+picture
sex
penis+enlargement
adult
free+remove+spyware
single+girls
big+cocks
latin+girl
porn
spyware
spyware+removal
removal+spyware
pop+up+blocker
pop+Up+killer
xxx
weight+loss
diet+s
Scheduling+Software
Personal
Radar+Detectors
Renova
Concert+s
Oxycontin
Pop+Ups
Photo+Album
Carnival+Cruises
Mcafee
Finances
Ged
Herpes
Web+Site+Design
Baseball+Betting
Home
Prozac
Growth+Hormone
Training
Windows
Tenuate
Honeymoon
Online+Betting
Credit+Report
Home+Equity
Didrex
Business+
Car+Rental
Internet+Businesses
Jobs
Lactating
Ladyboy
Latex
Latina
Leather
Legs
Lesbian
Librarian
Lingerie
Long+Hair
Machine+Fucking
work at home
diet
hair+loss
real+estate
personals
Maid
Mardi+Gras
Masturbating
Mature
Melons
Messy+Facials
Midget
MILF
Mistress
Blonde
order
Moving
Acyclovir
Buy+Acyclovir
What+Is+Acyclovir
order+
buy
penis
escorts
big+boobs
pussy
sex
free+porn
free
sex
sexy+teens+photo
sexy+teen+picture
sex+pictures
penis+enlargement
penis+enlargemen
adult
free+remove+spyware
single+girls
big+cocks
latin+girl
porn
anal
asian
spyware
spyware+removal
serial
Magna+Rx
Help+Desk+Software
Ford
Finance
Payday+Loans
Credit+
Business+Schools
Prices
Spyware+Killer
Gambling
Payday+Loan
Block+Popups
Cheap+Cruises
Testosterone
Fioricet
Alprazolam
Cheap+s
Mobile+Phones
Refinancing
sex+toydog+toy
like+soldier+toy
soldier+toy
adult+toy
baby+toy
beach+toy
toy
cat+toy
doll+toy
store+toy
castle+toy
sex+toy+woman
educational+toy
black+book
pussy+shaved

Также могут загружаться и такие сайты:

master-x.com
crutop.nu
gofuckyourself.com
netpond.com
pornojunkies.com
adultwebmasterinfo.com
pimpboard.com
oprano.com
justblowme.com
xnations.com


Вариант Trojan.SiteRunner.urlGen_6209 антивирусы детектируют так:

Антивирус Kaspersky AntiVirus: Trojan-Clicker.Win32.Small.hp
Антивирус DrWeb: Trojan.Click.622
Антивирус BitDefender Professional: Trojan.Clicker.Small.AQ


Trojan.SiteRunner.urlGen_8033

Имеет размер 8033 байта. В декомпрессированном виде размер составил примерно 77824 байта.
По своему функционалу данный вариант практически полностью идентичен Trojan.SiteRunner.urlGen_6209. Единственным отличием в Trojan.SiteRunner.urlGen_8033 является способность в зависимости от своих внутренних счетчиков изменять стартовую страницу Internet Explorer на произвольный URL-адрес, перезаписывая соответствующее значение "Start Page" в ключе реестра

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="[URL-адрес]"


Также аналогичным варианту Trojan.SiteRunner.urlGen_8033 является и Trojan.SiteRunner.urlGen_8029, который не отличается от первого вообще ничем кроме как незначительной деталью машинного кода - возможно, данный файл создавали с "исходника" при помощи др. версии компилятора.

Варианты Trojan.SiteRunner.urlGen_8029,8033 антивирусы детектируют так:

Антивирус Kaspersky AntiVirus: Trojan-Clicker.Win32.Agent.fv
Антивирус DrWeb: Trojan.Click.1230
Антивирус BitDefender Professional: Trojan.Clicker.Agent.FV


Прочее.

В коде троянцев содержится процедура создания некого файла ohpj.bat размером 44 байта, который должен удалить какой-то др. файл, а затем и себя. Однако данная процедура не работает и ее назначение неизвестно.


Исследование вредоносного кода и разработка описания: Бройде Герман (aka VirusHunter)
Дата создания: 10.11.2005
Дата внесения последних изменений: 07.06.2006
Автор описания: Бройде Герман (aka VirusHunter)


Rambler's Top100

0.00235605239868