Trojan.StartPage.57938

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsz2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsz2.tmp\System.dll
%TEMP%\nsz2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsz2.tmp\System.dll
%TEMP%\nsz2.tmp\Math.dll
%TEMP%\nsz2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'nivaqffvbqyyrdot' WindowName: 'xqrfyuzudsexwwjmfeleq'
ClassName: 'mabdqdqlniziovvvxvqgcpcslenesa' WindowName: 'hwipbmpzmpyhopfsiqtxsteznxfdcjvgqnddwk'
ClassName: 'ivzykolrelmlxzktetgldqkepnklpl' WindowName: 'uhftpkmgadhskam'
ClassName: 'ulkdyrsjjkibntuuugxvyoitzg' WindowName: 'hmrpvwpjehgveqbapnumwfdhpwpamullmbd'
ClassName: 'nvlxvuvgxatlyrimpfoy' WindowName: 'nguekuxjgznlhdvpau'
ClassName: 'ifwbpfftarsgskmitfuyelmsh' WindowName: 'izdgtvpfgiyijjatxxsdpznsu'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'xcztfptyxuhyayhx' WindowName: 'wzlsojcbzuvrthecwplhrmcvlzpiwzqcwjbwq'
ClassName: 'wuobwijypmjpmrwyqthtttmxjlqjxdiae' WindowName: 'usuqzxaemdbfioijutp'
ClassName: 'guxyfrazdaonxhxqg' WindowName: 'opwuntacyxguwceiivdlimgn'
ClassName: 'yghyxybwcyvurkykimmmnfzgdbfcnl' WindowName: 'hbjkuweiekxhctbzkwdmjskcnhgmpx'
ClassName: 'icmeqsrcvkgakmymovco' WindowName: 'uvfxtjzekfivprnsthymznuirgzzyuutasyue'
ClassName: 'oigoffqnpsusikxybqyh' WindowName: 'vcutkxhjnltffvhw'
ClassName: 'hzlvmxdtmbjkuvaraikgvhnywvklfpscgmwcxp' WindowName: 'jdjruvfmpeonlvhw'
ClassName: 'wmnztpkywcpgqjtokgzddzecupejs' WindowName: 'fdypandluewohtyric'
ClassName: 'olmubvjfkbuglmbie' WindowName: 'khpzodvgnxbtjhexcbdehosryycwadodyzzj'
ClassName: 'atkazyokleutnmvoeebwishjsxblbkpjkgrarp' WindowName: 'mnzhdmgpxqwwbkoaxiqwnpzjddjblesvguqbsq'
ClassName: 'coblntlztghmeqafiubrsjgi' WindowName: 'dqqaundgoietrxnzwyzmns'
ClassName: 'jftrwtttuirfxokqtytbsnwesjirlatpeffhyc' WindowName: 'elozphvrdupchbhbtbmigdfsu'
ClassName: 'kieksuwegrbjidujkscw' WindowName: 'epnbqbxkwtwpnpc'
ClassName: 'npxbjwsywkxojirtjhyrksr' WindowName: 'vdqzafjgeyswlswsjsqkxtvfbck'
ClassName: 'llnezsrrpctmxrmksifpqobtdgjgn' WindowName: 'liiluwvhstxbyoudmzlydqnlufzf'
ClassName: 'ugphnjpgbquxdlbzidw' WindowName: 'rwqgtdglgdphgqzbqwytgfkleq'
ClassName: 'ckoevaphgkqvzlzuenvtzlbjyykgjhhtybupy' WindowName: 'dzcgzkjfvbjmffkgiaihnmwfxftjixpfhebce'
ClassName: 'aewidpbcnamaiiphexgwkqrdtudllkozt' WindowName: 'xbkgicppnxjovka'
ClassName: 'avojgscpqdxhefqceniwlapaddoqradro' WindowName: 'ajaruvkiawdfgivxryhamnpbz'
ClassName: 'rwynqrvzkajvaawkammya' WindowName: 'arfafshkgefptadbiuidorkicrauddhnnylech'
ClassName: 'rdmfgpuvbsgonwisuictmoth' WindowName: 'hjdqwouhsyxbbqzilpgipcetlqhypoww'
ClassName: 'iyfalpmmtjbfnwwyrberagwnhuz' WindowName: 'qerxogjrzupxckvewmzjjguhsjyxnazewoekb'
ClassName: 'qhpskpwamrbvzlmicygsaxlzkjqwgtmiyabhvsb' WindowName: 'xswlxvsxqwqcsgbxzgisfmfirobajmvcxn'
ClassName: 'yxrkkomypotudkboyrapgncpcoctjsmmb' WindowName: 'ghmvxsgcjbjuetam'
ClassName: 'jjgodpnmajtllpfoboxxbjse' WindowName: 'foogpstgmtbcyitm'
ClassName: 'flecfrjcwujzykglipgombvyjisdkd' WindowName: 'mkvvpweyxqacolvylzueiberw'
ClassName: 'thjsozjtzowtbtpso' WindowName: 'zltkfqqfruiqecdybrtptdxsmuygagdogodqm'
ClassName: 'pioedfryxuwosylokxevjwlerapqdmvpqcbn' WindowName: 'vrddpzwigohloeythtdcd'
ClassName: 'xcrplpetzqidyfgohjvhxga' WindowName: 'moifqnuqyhljqxjsthcvyllobbhgzlzksyiep'
ClassName: 'mdpvmorhfvuecxsuta' WindowName: 'eihnpsbgekcdpjduvcrqvr'
ClassName: 'pbldlppdixcqdadwtbirvtfcvbjxynxuywxklne' WindowName: 'aunnmkyvnjtylxwjt'
ClassName: 'yqgemeisuwrlxjeuxei' WindowName: 'piwmjkuwniuasfqvdyepeglfx'
ClassName: 'ngytjhxrwhtqhhnqyxiylbswuskjypz' WindowName: 'lgjpyiukmpqmnhwjmigfnoanutkuntnohlg'
ClassName: 'thrmdcoakjsdhwqqvmsfgpxdmcpy' WindowName: 'ajroqxzudnaudmcxuqbkbcgbziiralph'
ClassName: 'riaybqlmezzhfsy' WindowName: 'hfhderciswvylxfdainhbsgvl'
ClassName: 'rshnbwdikjujblgpwfllgdqspan' WindowName: 'qlrlevlwbkqzlcaofpejwexy'
ClassName: 'tbtmewdsvbwpmsevfyklahhlgugomcrbpuuftnd' WindowName: 'mlbiaqciehzpbfyvl'
ClassName: 'cgveuomptekelyouuxqfhgtokbypruafxs' WindowName: 'ezxvcurijwcmexxsrgdtysmnez'
ClassName: 'vxjhalkhmobnlokbnz' WindowName: 'vddcsxkpugiebsvszbcoqsso'
ClassName: 'ircgdidnmgbjaztakerfsmomvchlkgbvggtdyd' WindowName: 'mlqjdcahaeuknlvcausarxlvnalai'
ClassName: 'yqwxeooaqifpodabbwczlabhhid' WindowName: 'aazccbspjilfukofrksakauefy'
ClassName: 'vndqtermcfxxohywc' WindowName: 'injullsqqlcskvztzey'
ClassName: 'wsiuiiiapyybhqmlsc' WindowName: 'laspwpjvqskxsplzjyjcyglstqojhv'
ClassName: 'trkhvmtksrdsxbzadaclftsznnrhek' WindowName: 'rtbsghlbruyzkflmjifcnkejbpwxjqztfhu'
ClassName: 'hrjomqkflhnxtvuru' WindowName: 'aagqopxyjwicvctaloreawqwptrxcap'
ClassName: 'pyskxxemqxgjghonwdwuia' WindowName: 'fcrgrtdxqhxiwqbktvbpvgae'
ClassName: 'cajhzmfyyefrihjvauggzrskgxvj' WindowName: 'byzzmvsxweigkrfqntg'
ClassName: 'ttenpxfazfjemyxqoxmdpzhptteanwpg' WindowName: 'rmydqmuxcihjxtugqzdlmmcnfmo'
ClassName: 'copqzqyrfmmjwlgkgycsxnoiynlntd' WindowName: 'cqpktxeldpnfrrcqolgq'
ClassName: 'duqsypjpxnjojsexljcngycbnfifhgk' WindowName: 'hwetfseriwlahvrsggutjzonotp'
ClassName: 'zeifomqpxzjfsgwnnprahdyn' WindowName: 'ftwbqjsbumzpcjpzxkipaorcymoy'