Trojan.StartPage.59134

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsx2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsx2.tmp\System.dll
%TEMP%\nsx2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsx2.tmp\System.dll
%TEMP%\nsx2.tmp\Math.dll
%TEMP%\nsx2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'sxvxeaagtmsckek' WindowName: 'ddicikhbzsgdnufhtlznoprkrlpkxvlidj'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'qkepvsdazcxycnydetacdhrwodffovpdr' WindowName: 'ttysjybyrvcmyxakzgleqivktwlazzjypwfia'
ClassName: 'xuzyzfjosiglyzxvjktdezjlctjjmayqspdzriy' WindowName: 'mwctikvslzdbeeokigbsbumvympomxjzmdqvpja'
ClassName: 'dygfbohlkcjyvvhyzkgcfdhrztjsgehfjsurs' WindowName: 'awyuimtnenzlvfifstltnsb'
ClassName: 'kbojwrubqinwjhvgr' WindowName: 'nfvgvemhuhbsnsj'
ClassName: 'veezenqqnmnriiwazlawxkrnzlissk' WindowName: 'tdzibatuwhswrsjwwwtv'
ClassName: 'tumbzisimoetvhef' WindowName: 'jzgedgltvyexrufzlomz'
ClassName: 'hszuehcqrgbmdmbxgyxy' WindowName: 'hpytvdiuminftlpufdwrwvzbdqxmsjozqtmf'
ClassName: 'nuihwtkfgfsixonzxrqargnx' WindowName: 'dbcppwepeofvlnityco'
ClassName: 'towrtadvaynxgrgcuhuaulypt' WindowName: 'cjsrexqrqoythykfmmreshbsphshtoptqnuo'
ClassName: 'hnelacpnzzxhhiekxgtdvetyxqchdrgcrv' WindowName: 'ghpyhwtuojpxesjbgorxstspagp'
ClassName: 'eiutxgfrqffekklnotdxlchakwgzldi' WindowName: 'ubsgwubedzzajvqgmmlmqurahskyrsbfjq'
ClassName: 'nxnyhrodjcujeys' WindowName: 'gusgquypjjuauaufzgufg'
ClassName: 'dftleggfglqnwxxyshuaqqy' WindowName: 'hirslvrndzggvmvpzmteqgwydbzuvwq'
ClassName: 'utfmnhbjlnfxedtndg' WindowName: 'riihtxpfxhejgbkyizpkkz'
ClassName: 'jhktihjhrskrwsjrpexcnrlvzvqrvwdljdpskd' WindowName: 'qxnwuycobgfqyprduqhxc'
ClassName: 'tdgozjbfqjbdzemxfskldifhvjqsdt' WindowName: 'ulizyoxrczoczqjpyxujwybehugrtl'
ClassName: 'xjsfqnfamnwaozggk' WindowName: 'qfejxmcqrmdesukvburdrczqfdbiqmgnj'
ClassName: 'afzaxlchmqgwhlocuvaen' WindowName: 'ltxvcfdenqntiiwuwwhctqjsqggqiwnzy'
ClassName: 'tcapovcknzeyswy' WindowName: 'kotanbglulqgrumncgwaeiqhzbauezw'
ClassName: 'nimjsvvolhplwjndebfafgibwlckdjw' WindowName: 'nnnpsefnyfhsnisdockbkidkvdsst'
ClassName: 'xpzngiqxkkfhamqvmqziwqhcg' WindowName: 'wijxngzsbkkubdhkznhb'
ClassName: 'gmiucfifprmucae' WindowName: 'mfsggrxjfonblldayvpyjqofujflzgdra'
ClassName: 'lqapjmaxpjeigxgakifjxurzalzamkvfmpzloa' WindowName: 'sdbifjqcjuswseehhgangrthx'
ClassName: 'wyhvivggothyksxakvulopdqbn' WindowName: 'mydalapncurvkdheqvtg'
ClassName: 'wmxecftkankstftdxmxzmjuxjj' WindowName: 'hjnyctmjwfkspfqnid'
ClassName: 'msyeymauxzxvtbonxqmqfkktocfkccdesamd' WindowName: 'ypteuwxqhzrqsoadvdeedwp'
ClassName: 'mriujtkgmiiwrggigrsatbrrcybiziz' WindowName: 'sdjwmrszkkjluafdlpx'
ClassName: 'gzzjdqrzpndrshmsvnvryjeqgriiktppzyhxmee' WindowName: 'bvcyylaskpqjmyoxegzinmsxregwpqz'
ClassName: 'oyqvffvpiimkjnqljyjvzwuaguopeholmz' WindowName: 'ksjhuqzhdduvakyenhbbppbucyzzpudm'
ClassName: 'ysmzmendmpdelwr' WindowName: 'atcplyvdkobabfgajrbssbaewqgw'
ClassName: 'uyhquvaziyumshdgqzz' WindowName: 'avwjwarbnagtrxvtwyqfegddp'
ClassName: 'mdpihmtluddjvygtfcswnqmlfimrtvwrqlssx' WindowName: 'tzvxopwekzegclkzkrizh'
ClassName: 'rlrdfvjdrttjocivh' WindowName: 'pyrnsexaxzkihxgjodjbqodz'
ClassName: 'xjnmhfjokgxrlzaimtswaxvxc' WindowName: 'wzcvvecyxbmtipppajwampepadv'
ClassName: 'awurskfjggraoxmwowkxvlueser' WindowName: 'kgoiyahziisxbjqreooryaqi'
ClassName: 'ffbemeotcssnpnhcxbueyorvj' WindowName: 'onirqnnbifckhcjdrfnjlgspsfu'
ClassName: 'ktetbzsajfwnsztybrrvtupe' WindowName: 'qkljemqxzsfqpxxjagbmgbqrhrp'
ClassName: 'vmcpusugxawwdjuuazmp' WindowName: 'gwgbhegipfpekdpluckt'
ClassName: 'ujcsnkctsuumooazjlqrxepeboqvuheszcstq' WindowName: 'elivqhyfnagipyvnnfabjchyqwfwsjvf'
ClassName: 'vkghtjsazlziswpikgxjwilzhiwdpbyu' WindowName: 'qkoafdcsjazwfork'
ClassName: 'siavrzigsvpvfetphahpbxkx' WindowName: 'bujioarrfaqtawauitrfkgfah'
ClassName: 'krkmiiwrnkowytwzpwwfzyoktk' WindowName: 'sjjiwoiizrbzosdbzkjodgsbbcen'