Trojan.StartPage.58326

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsc2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\Math.dll
%TEMP%\nsc2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'zzmmotdjpzdwvdwotpq' WindowName: 'ysruetqsflenihyu'
ClassName: 'iwhvdibxlzouqwcalkdbmqtyqjmrm' WindowName: 'svlccptmwfziwrdcidtslampvgbkbzqspjgsqvj'
ClassName: 'iypbjahtkprcfvnquoeev' WindowName: 'gnzxcjlgggaymxvfuwlmubfxoflzggf'
ClassName: 'evpylrjvvtspyzitsfmiealqiluvynqfpnr' WindowName: 'anhijpelfkqqivoarwtgmoyfrfqj'
ClassName: 'fyxmggnozkrbrbuiabubdlrnlrriidcq' WindowName: 'aimvvekujbjnhnb'
ClassName: 'iveuovonwkesnnnxsclzvxjqidmdasaiwwzu' WindowName: 'hpmguvzhdiojgpwisvfolaigapeliarrkd'
ClassName: 'nogwljdmxmazhpsptzsct' WindowName: 'pcyzteoxxjapjitzodcvnzjglrpwjnscfmsnul'
ClassName: 'fooleijkqwkzvoumppbjjrqvrqrcfzecptaz' WindowName: 'taddxnldcbnwhssxrqgffbxcffahrt'
ClassName: 'xkiqczkmaalwdytjxjtuzeairesrpyfarrkgi' WindowName: 'zwlssfrqxbjrruprpumtijy'
ClassName: 'fstffcdpxahmadbn' WindowName: 'tovdxlqhekzcdmynxcfzmplngiqcacytrqq'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'vopodgreqngnkmgnp' WindowName: 'oetpmxkavcayeecnobrgfxltojsenydyf'
ClassName: 'hwaymthyxnnsnbqylvppqjwmzxk' WindowName: 'ruqeknewsmfotmfjacg'
ClassName: 'uoubupxaylawvnroxuxqvfmvxenazn' WindowName: 'qklqykszsmxbircfgticeimrsbc'
ClassName: 'cwqrnxdmpptmddvceulepspwuodv' WindowName: 'vhmtjnwecfsfvsdmjlosisoyvssn'
ClassName: 'tbdwjyyvqvxxqajlxxnbwv' WindowName: 'jxaqoiveujypnhlmi'
ClassName: 'hpvmqbinsfunimyucdtwuxljscw' WindowName: 'uqewdmyhsavfnzjkxblgpeascblmlftnujkvgo'
ClassName: 'cnhjuyaecdakjtphr' WindowName: 'jydniwjlzpravhsvaoljtobyrdh'
ClassName: 'utwpeifgrkxjolanlemlutkpzsxtqccydmuanvu' WindowName: 'uvbuqodzuulzqinopjbdhptkyitv'
ClassName: 'qhrypagfnurptzfiwordpzyoacyzrpii' WindowName: 'qdiibnezovyncks'
ClassName: 'lsjkkowljnreoidtmioxvuwdk' WindowName: 'kprrwiwxkducjsfljfcozoceinfea'
ClassName: 'wqxsicgmwmarnkrkjktcfzwbopdzvwftdpygmn' WindowName: 'jkjltakkrzvlkkatnvtzyrfxyjzm'
ClassName: 'bjsmbyifmlcensqzx' WindowName: 'mayxpquetscazyhptxfdcwiadgvnovyzba'
ClassName: 'ahmxcubqvfwtwncwoefurpmxpbirach' WindowName: 'qnsysmyuuucghkzbexwuxvuikrqsmdxgb'
ClassName: 'bfyneoplwglyiihyammvnmvqcxuiuxbufwowf' WindowName: 'mjmzexwtuewwysgglwruzo'
ClassName: 'vzjeuwkenyvegsrgake' WindowName: 'ibsdgvxpjvnrnlslzrxtvfcrgdiyozkjpuk'
ClassName: 'jqigrhbuxizptvjaurvajxhkexlyngnn' WindowName: 'yezvqncmdqaiosjpcgfe'
ClassName: 'qwfsjvltwgcixbihefcvgmrnncedzvf' WindowName: 'zketuhbhbzummqqycnomyrrqnnbvo'
ClassName: 'tonbeakryshnthosbfafwzbnzumwthlg' WindowName: 'mstrpatexgrskkthfmxmyfpsddhcxqwcmpg'
ClassName: 'zlgelothjxjhwboigeczbeewmtdceakh' WindowName: 'iztoiwjbtelagkzqeuvdkikgjnnabzbg'
ClassName: 'notjlvuokicqorxaykpaxzsllww' WindowName: 'pbrdihpwejzruljhqgwn'
ClassName: 'hrdjajatrmxhmzvroq' WindowName: 'ecdklglunsnyqqxhvputytmbk'
ClassName: 'nppuvbiagjnjszmttswfarebtflmwiactfswa' WindowName: 'plajyjvvvxbvlzguyjmmucwhxlyb'
ClassName: 'xkmjepgksqjvbvhkcyhxnnicysvle' WindowName: 'bnwkrthrxjzamzwolgvdocnydxqjikgtpn'
ClassName: 'npzdhzpuychuantjqivcfunfwwispbeqhgsbq' WindowName: 'zmqkvheurjhzfhighpnwhvqzgommyznvqsi'
ClassName: 'jorijijgnhioqfnce' WindowName: 'bfeifcklmllzbceemyevz'
ClassName: 'rakiwhujyeyytoqv' WindowName: 'pmbsnkqoeyqxxhrfqcoprmgoismlxqjgopac'
ClassName: 'kwbgbpddgpnqwxdlnnuoctkg' WindowName: 'amahydeywxwekyqtdqcqpkedvuwmdynh'
ClassName: 'ebaoimvyracewcekgeqxq' WindowName: 'pzirjmhatgoihfpispeufhvhypztayrjux'
ClassName: 'nmgdplfdgkrurheetwvskutr' WindowName: 'snyusauoifudpiltfqvkjdxjcm'
ClassName: 'mjidzcexqvueqtacwiqslkpf' WindowName: 'nmnookzsdkuzuoagudbsobmbzaic'
ClassName: 'qzlvbwpkuvfryxxsrmyqi' WindowName: 'iruqpzjiqltgzqbxgqyysqjydp'
ClassName: 'fjowvtsozpiusrkffmnbehaeyzg' WindowName: 'tntzzjbjmduxlqfpcfoirzgvsizvfmrtkwhpm'
ClassName: 'zvmaqkloqkpbsfchyfmirojmznoedgrzhf' WindowName: 'afbjyjbhcbpxfompcdvigc'
ClassName: 'pdewypjbdlrpnzaidcyxz' WindowName: 'afxjaslmrabfbyciutqlgmaihoyxjkyziwyat'