Trojan.StartPage.57940

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsv2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll
%TEMP%\nsv2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'wyepcsaimoeslpnwrebypmjno' WindowName: 'nutszqzodydsrdfuyxolxyar'
ClassName: 'jshlqvcfarhhkqzmvmjwbnviqhm' WindowName: 'znobpugbszzsuaulhfx'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'ljimttjdjoefbixpibyasnqargvzueekxfutye' WindowName: 'sfyuhupjklbnuyllekelow'
ClassName: 'shhkpqynxgkzgfpstjyfvwdecba' WindowName: 'jonuiphvprcfjxvqmuunqmklqerb'
ClassName: 'pyeouelhdjkjyhadtslcmboyuokujkabvuo' WindowName: 'vfrmhzqctsydorwdcbjljiancnnbggaiwgbayhu'
ClassName: 'xfcnniebcktjecjbmlyjyu' WindowName: 'fagacusgcigwqmikzztxjbdzfx'
ClassName: 'mcqxqdjvvellwmfiwzxuuff' WindowName: 'seflzgdxgcowvawxlm'
ClassName: 'sfnyowfuuvmwpwo' WindowName: 'kdrvlroiqmkgbkb'
ClassName: 'wouibqwiixppcxopagvwgbe' WindowName: 'zyumdlwlnwdermwitpatyxsswq'
ClassName: 'mmnxtqgiqdwhynca' WindowName: 'xhrjiotzctfsqhqdg'
ClassName: 'amjflafcefdwmuwtozprpcbblerzsmuvv' WindowName: 'mlhokfyboherhalisxlcxfumlwclqq'
ClassName: 'htuqrswlaxijgfbaudtkyulaeaahxjaqtbbnh' WindowName: 'ccdgpvfaxxmweknsue'
ClassName: 'wypqrxoplcattwsalgi' WindowName: 'ifcifvbzmouslttrmcfqsvdwn'
ClassName: 'ptgynrjldlvegzjwrpkduhnpkfvdw' WindowName: 'kcnvtirjoruftgramyoppuiiggcd'
ClassName: 'nhacrlxyhonzxwxielrgfv' WindowName: 'mijhhgnpctzeziwtmgnsexbx'
ClassName: 'ixokwklcszhfzxfjatcvnihvjgpqdbqj' WindowName: 'rwnikcncfjcatca'
ClassName: 'nlutjtoevmtciagngkmrmpeejydbmikico' WindowName: 'hntcnbbxpjwchrertabhrdhkymh'
ClassName: 'ffozggzafqvyezlqqsr' WindowName: 'yrorpflqlaosstxboyczickjgzmn'
ClassName: 'ruyydecdqamevwbunza' WindowName: 'ugyejpyecfnpzumxluigutlw'
ClassName: 'fmqlhwrjvrdazexjbgaqhcuzjpymlxfhdkrhafn' WindowName: 'fuionbqvunptwhnvgmkzpxxgxxtgdopt'
ClassName: 'spuezfxgzmvnvqoybv' WindowName: 'sckqhhkfndkjnjinaiwsxwjk'
ClassName: 'vznrzexasyezxqkucdwvy' WindowName: 'ieltytjzhwxunflqlggp'
ClassName: 'hybbwztpskbrtnkbqouuxrtwazjkzfota' WindowName: 'pnvgewiehtamdorlyv'
ClassName: 'vzugpsysqhikebgrcvaokrvnagrdeqnqjqupt' WindowName: 'llkebpsjgsnsyitwehbnxph'
ClassName: 'hduqptixtrirgultzbjbdypojtcthz' WindowName: 'evkfqveiiihgcylnqtrhvlibfay'
ClassName: 'boqssiqfpneicpsbjrnebwnke' WindowName: 'ulebzoesijgduefpluunwuweuiugiqtezjjjjb'
ClassName: 'cffqvbbjsbwopwijveyjbreymzgkdbllittxme' WindowName: 'nfrdlzyhpywfwxgbnacuggskqqfbmbl'
ClassName: 'eycltmxrfnhlwpaphlipudgxjobaalqp' WindowName: 'egfaecpbkvkwxivmhhxnxwubbcyph'
ClassName: 'jtckwfwzbazifthulilkxujaj' WindowName: 'vbckkzxfhxefbayldjiptsknguxaqdqzj'
ClassName: 'xhbkzeoyjlaveycilthzqnfrtbns' WindowName: 'vdrpciuyodjnlxn'
ClassName: 'viyhlcgqwvznrjlhlmaqzzuzslwgdqdj' WindowName: 'iqolpuisyvsmikcllhxnpfztbtvzltu'
ClassName: 'fajimgoarucajkp' WindowName: 'fkfkwxsjuiozdjgwbhgrvwdb'
ClassName: 'ssaduthrsdcagosemquknaoimbwaomifssogtw' WindowName: 'vqkdnrymljeavqdmhuzwwijhgwyhgu'
ClassName: 'serylwslsozuezfwhyvtciazmnffiyeqqptj' WindowName: 'vdkhvreenxbojqtjorj'
ClassName: 'akqxynjiojcdprfneveswypnr' WindowName: 'hzbslxvxblfhrximtdmovomxwdwfjnfipahwz'
ClassName: 'kjlwmvswxtibjelvnssfcphzhhhvizhguwyx' WindowName: 'tkfgqmgsjikhzoncavczqgzkx'
ClassName: 'kbulpjpijwosdchkrywomzuqid' WindowName: 'bbdxdsyxmkwiqrckahywkkz'
ClassName: 'vjsjmfrwznruepotudpimharjolvmtkglpxe' WindowName: 'nwfhlazvznygfydjdkwudax'
ClassName: 'fxuwzrzsctzztoydqybdbq' WindowName: 'jbqchlglkcsskcfvtrf'
ClassName: 'gvoruqoxcrogbykqkbtsqgjsyjb' WindowName: 'spobxkpqoexsxkpcmflp'
ClassName: 'cdsernxvokqbmfcogahayuoi' WindowName: 'ytbyacmklennnceentqi'
ClassName: 'ryteryrrivezwuwxaty' WindowName: 'wpvsstekqipwtkpsxhxyztsrylox'
ClassName: 'hzzyysbearumhmswhhshjmdjhfe' WindowName: 'qcbdrhnsaduorlogslfdoiqe'