Trojan.StartPage.58307

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsv2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll
%TEMP%\nsv2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'uugoaiafjxuhkigpnuzqpauxk' WindowName: 'befdjsrxfkugsxadsgupmlgneltlqu'
ClassName: 'qkdhefigqnahauexjcnoeoteosetbwzuhhc' WindowName: 'mvgjnewgnzmnqqglpbukpzrsadjcjfqgogzfff'
ClassName: 'dlolvhhrmoaujdcrifotvlzvhoblhxfvvklf' WindowName: 'oznawdqmrzdndgk'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'mrmwafbhzstsuoifxrqnqklfclctewnusqigxzk' WindowName: 'lxrcgokkeevmtmlnwxouropgvpgsvttibbmhy'
ClassName: 'hrtoplqegxdrslnnavrcbpylbbxjpfdtkbgrz' WindowName: 'honsjlifvzoylfnpnsfvwufnqecxlta'
ClassName: 'cnmndddwdpuzefbcylvv' WindowName: 'gtjivqmzisoioekbfwyvd'
ClassName: 'ppfzehqmugudkrnmbeuqtdyczwsnhn' WindowName: 'mqjmrsqedatefqzbjenhuuzaehigdxatpor'
ClassName: 'ygaxvgktpedgvhjzwzzhus' WindowName: 'oklnsnusvlfekjxoeqhkbl'
ClassName: 'gwczbnijquelqryrjyvdqfaxqzvbo' WindowName: 'ptbthoetjfvhmaczfkjbsfjuzzbbqeuntzrwuo'
ClassName: 'axmwpkeughudffzuhbgnzoos' WindowName: 'vzcdxmcrmqclbhlgbvrajryv'
ClassName: 'wqekbgqpxvaezdmyzyv' WindowName: 'fltdjrzcoazpwsmkusmynvfbnyvgc'
ClassName: 'gwugaidcjuwxxpsyjujakimrbtfvlur' WindowName: 'wakwdcyavmyphbhziurdfsdnq'
ClassName: 'lccyznzopywghjparpgvylzui' WindowName: 'pbmcyepielcgwcohkxymnhtnldgd'
ClassName: 'ayqoyftkiqzskvngvb' WindowName: 'nrvhjbibsecrvkpmebwzlso'
ClassName: 'idpbmododhwwmoipl' WindowName: 'hxhtettsnldtfrxfxpetiinxxo'
ClassName: 'dhstfdaamgnvccbzyvvv' WindowName: 'isrhdumlsvsnbuarnhjfkssecxmvz'
ClassName: 'uikoftazxkztgtyvwgoktlaqmfxlrmuf' WindowName: 'dtlqmdxzujpruvoofeilkhguwo'
ClassName: 'tshmmoujnlzqctxintfv' WindowName: 'wcwffxzaqhypgva'
ClassName: 'zegzvjmwiixkhvfiropuwpynqxjatywhzicbym' WindowName: 'vroqgvcrurzcgewwcnn'
ClassName: 'xgvxoeijnlrqxkgetjayzweqtmzklb' WindowName: 'ajerflghvkmjnbsihny'
ClassName: 'ycnwevbquikwppdvcnyugzjtzxxrb' WindowName: 'nmutincpfzvvdusfkbtpruzrejae'
ClassName: 'ggrqpomgpjtdsdxrgotptkcrpoyukycb' WindowName: 'dqijlqbctacyfsxjnd'
ClassName: 'hjfpfqpzjalvwcgjqlcpuuns' WindowName: 'dmgznljnohknmzeatrsvmwplmzrsxj'
ClassName: 'akcbzxtzyfzxqanrt' WindowName: 'msqamncudflayhjattkbvrqwxytfwwgisvemgtv'
ClassName: 'yzorepnqqmugbsl' WindowName: 'ejtabiqbxlwojunnrjdrpmgzlrysneltoohikbi'
ClassName: 'anmmqjjqxjwblxqrwoxgqszbjnvwc' WindowName: 'xbedxhjsrjmeahjdezodlflruvt'
ClassName: 'rglcrapyyguwgmf' WindowName: 'wdrbtpkvykryfcpqayamqqghtsssq'
ClassName: 'bbwulokoqihrlfnioufl' WindowName: 'vwvsiosveiobozom'
ClassName: 'fadbciolfbxrytsjwynjlsjykqqtwux' WindowName: 'refflyqhuvfdulwwodjmtiwlm'
ClassName: 'wcoqnesfaaytypsqcxvndcfffsybl' WindowName: 'xqkxumcsubkbbddsgxxurpyxjdespvukmiunwjy'
ClassName: 'wppxkijnrvwqdyjfuvlxxopou' WindowName: 'pzekimlfzupcteme'
ClassName: 'mqbtsigowqpstewzkprryfy' WindowName: 'toclitvobjorcmrustxuaosgwwnnknxhlhln'
ClassName: 'xbagivfrlrqcrrybzs' WindowName: 'hcpruviqcxlwyzgpliteczzazgolmxjwguckhc'
ClassName: 'xudipvqybriecwz' WindowName: 'zdlfffcemxdvhfaysrtvi'
ClassName: 'tbnagcwukaukwctbshfnlty' WindowName: 'qtsflbxtnjtzknckmjcgrsnuv'
ClassName: 'kmblvhqkmcibkhttdqqwqihgqsgrrhydfb' WindowName: 'fqtxauiqeseeciyxhxlknpjtdzfjaytvpoesx'
ClassName: 'fqkehrthvfkuckk' WindowName: 'dnffjfgpfogbhsszqwaawglcczvoclxyk'
ClassName: 'ijstvmqhrjyjaqkmso' WindowName: 'ojgzjpitkjwctnbeksuhycyuzarzylpyb'
ClassName: 'xxsfepoqxxipcvczyegjw' WindowName: 'pihplkioolctqkxf'
ClassName: 'xinnbmiekacgdwhkgbxanjywaxhdsldnmiihksm' WindowName: 'kkqyqflntlcknfcxbbgl'
ClassName: 'drnfbwmifofxvcaniblgtbf' WindowName: 'wewinlphjuixplojhqkbzmzcctwteldevha'
ClassName: 'pyfrjahrqpgpmgcawfchoteeytuovs' WindowName: 'dorxclbzgfwaerdtbrmkxuaktedgatcumttwl'
ClassName: 'emhswkiwydqugxsvqmeaowpkf' WindowName: 'yevctockuwmkevidgyaeayezba'
ClassName: 'uegifipyflosermhtswgwtkny' WindowName: 'qlvmlmuvrnuzsrnzqizvvcvecmqk'
ClassName: 'qojstfzcyrkfqcyamublmisgbozfuqmzv' WindowName: 'hjmwakeahtcgpdvygrhctbhvtfujy'
ClassName: 'loofgqaerrccltfnipttqym' WindowName: 'qlgkirjfzegnjcxefjesbleybukjduakn'