Trojan.StartPage.37646

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\IEMaoSvc] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\IEMao\IEMaoSvc.exe INS "%TEMP%\SE205.exe" /regserver

Запускает на исполнение:

<SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\IEMao\IEMaoBar.dll"
%WINDIR%\explorer.exe "http://ne##y.com/cpm/10102/10194.jsp?s=##########"
<SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\IEMao\iemao.dll"
<SYSTEM32>\regsvr32.exe /s "<SYSTEM32>\midas.dll"

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\IEMao\Search\is-2662S.tmp
%PROGRAM_FILES%\IEMao\Search\is-1CPE8.tmp
%PROGRAM_FILES%\IEMao\Search\is-BR6UQ.tmp
%PROGRAM_FILES%\IEMao\Search\is-NH6CE.tmp
%PROGRAM_FILES%\IEMao\Search\is-3M7MT.tmp
%PROGRAM_FILES%\IEMao\Search\is-R5PPE.tmp
%PROGRAM_FILES%\IEMao\Search\is-J5AFC.tmp
%PROGRAM_FILES%\IEMao\Search\is-L5OU8.tmp
%PROGRAM_FILES%\IEMao\Search\is-UFQ33.tmp
%PROGRAM_FILES%\IEMao\Search\is-EL6HB.tmp
%PROGRAM_FILES%\IEMao\Search\is-CK51R.tmp
%PROGRAM_FILES%\IEMao\Search\is-LBGDM.tmp
%PROGRAM_FILES%\IEMao\Search\is-UFJ8R.tmp
%PROGRAM_FILES%\IEMao\Search\is-5LJL4.tmp
%PROGRAM_FILES%\IEMao\Search\is-VAP8S.tmp
%PROGRAM_FILES%\IEMao\Search\is-QK5FR.tmp
%PROGRAM_FILES%\IEMao\Search\is-UL5AA.tmp
%HOMEPATH%\Favorites\IEГЁµјєЅ.url
%PROGRAM_FILES%\IEMao\unins000.dat
%PROGRAM_FILES%\IEMao\Search\is-JFPAC.tmp
%PROGRAM_FILES%\IEMao\is-E1F4J.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\gg[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\10194[1].jsp
%PROGRAM_FILES%\IEMao\iemao.cg
%PROGRAM_FILES%\IEMao\Site.ini
%PROGRAM_FILES%\IEMao\Search\is-G7N7E.tmp
%PROGRAM_FILES%\IEMao\Search\is-VMS3D.tmp
%PROGRAM_FILES%\IEMao\Search\is-FLSK0.tmp
%PROGRAM_FILES%\IEMao\Search\is-9QDEM.tmp
%PROGRAM_FILES%\IEMao\Search\is-SHQT1.tmp
%PROGRAM_FILES%\IEMao\Search\is-S3KIC.tmp
%PROGRAM_FILES%\IEMao\Search\is-IA0GF.tmp
%PROGRAM_FILES%\IEMao\Search\is-ANQO1.tmp
%PROGRAM_FILES%\IEMao\Search\is-85AQ4.tmp
%PROGRAM_FILES%\IEMao\is-MABMC.tmp
%PROGRAM_FILES%\IEMao\is-1AOA9.tmp
%PROGRAM_FILES%\IEMao\is-NMQN7.tmp
<SYSTEM32>\is-VOD51.tmp
%PROGRAM_FILES%\IEMao\Search\is-IEVQQ.tmp
%PROGRAM_FILES%\IEMao\Search\is-9JPVF.tmp
%PROGRAM_FILES%\IEMao\Search\is-0J304.tmp
%PROGRAM_FILES%\IEMao\Search\is-7MQ8H.tmp
%TEMP%\is-91N4J.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-91N4J.tmp\_isetup\_shfoldr.dll
%TEMP%\SE205.exe
%TEMP%\is-MO07O.tmp\SE205.tmp
%PROGRAM_FILES%\IEMao\is-AC1UI.tmp
%PROGRAM_FILES%\IEMao\is-BAF4A.tmp
%TEMP%\is-91N4J.tmp\IEMaoSvc.exe
%PROGRAM_FILES%\IEMao\is-Q4G0S.tmp
%PROGRAM_FILES%\IEMao\Search\is-VOS51.tmp
%PROGRAM_FILES%\IEMao\Search\is-V3EHO.tmp
%PROGRAM_FILES%\IEMao\Search\is-QACHC.tmp
%PROGRAM_FILES%\IEMao\Search\is-UEBIF.tmp
%PROGRAM_FILES%\IEMao\Search\is-28T5F.tmp
%PROGRAM_FILES%\IEMao\Search\is-NU4V7.tmp
%PROGRAM_FILES%\IEMao\Search\is-UANFR.tmp
%PROGRAM_FILES%\IEMao\Search\is-72DQO.tmp
%PROGRAM_FILES%\IEMao\Search\is-8OL1V.tmp
%PROGRAM_FILES%\IEMao\Search\is-M6EIJ.tmp
%PROGRAM_FILES%\IEMao\Search\is-4J2FN.tmp
%PROGRAM_FILES%\IEMao\Search\is-C9C83.tmp
%PROGRAM_FILES%\IEMao\Search\is-VUURK.tmp
%PROGRAM_FILES%\IEMao\Search\is-6MG6E.tmp
%PROGRAM_FILES%\IEMao\Search\is-LVGDT.tmp
%PROGRAM_FILES%\IEMao\Search\is-S88KF.tmp
%PROGRAM_FILES%\IEMao\Search\is-ARSCJ.tmp