Trojan.StartPage.59354

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsv2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll
%TEMP%\nsv2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'17#.#95.249.133':8511
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'tjjsellzroyozeysohltlcgwlykhpqesiqv' WindowName: 'fompwatbiomwlpyongehqitbkqc'
ClassName: 'ptouuvejomkuzoengxll' WindowName: 'gvqaobrspdptivhleiqkiyrql'
ClassName: 'atdsexrajsmasehdjhkwcnsvttvgtcrxhcd' WindowName: 'grgyqzsdughamequygozpfhezsswe'
ClassName: 'klgsmvtpriftbptialyhfzjwnnr' WindowName: 'xfljsjiervrxnngvkfredohvedalovdvpf'
ClassName: 'anvqdxabohlsjvyzncmglvlkrldjrcgt' WindowName: 'tzjcegtlblxhhsodjgxdq'
ClassName: 'vynqobuhhqrkaaix' WindowName: 'cplrurgohtmunuuajhpyenljedclwcoxduzkojg'
ClassName: 'dsrutgcccwzboipufae' WindowName: 'vkasksjnxfkretjil'
ClassName: 'ayzgpvmwcllwtxuejlcwb' WindowName: 'ilchtaacfypfgvmtimbagnweobona'
ClassName: 'bxkgdgmcsbmwwkitlbyitunprwjaam' WindowName: 'gsdscfmyqzwgsruwhepbcaxxtnsslsri'
ClassName: 'anzchkmhypnmanweakhdwrjnrgf' WindowName: 'trrhlzbfpxrmovvknmydk'
ClassName: 'oocbvaurugtxbha' WindowName: 'xpfkcnnsqgkbiaqemajixmr'
ClassName: 'wcdnjatowfgerkjvxqxlcykpx' WindowName: 'ohuojmbbfugfgvstcrawruzv'
ClassName: 'cmwdoncszbszkyoeokoe' WindowName: 'gmbmswegkrcopapwtbnjdhff'
ClassName: 'sltadoxqhgywrjzwstsmmlmpmzgfgbbjct' WindowName: 'inrydfjeflmfhsibxcifvpineyki'
ClassName: 'ektsbyfwbrvfbfpdwsiquzcizwdzrpxvfxug' WindowName: 'wyywonnpxdccbvpdiwnmjmmho'
ClassName: 'vcxgqidrjqdlqarsdaqczbhrsfgykeczsntivfk' WindowName: 'aorppyjkvfpwhcxtmrqhohrpxhna'
ClassName: 'xouyqscgzevxccizsu' WindowName: 'bktjfnmazcsxkmttfkkyvqv'
ClassName: 'bvoawygcktdpnikikelkdx' WindowName: 'ecysxjcxxytuiaamzwvgm'
ClassName: 'ikkgfnnliviclgcttkltd' WindowName: 'pcraezhfkyzyywsqyijvwpfwj'
ClassName: 'gasqrynueashjshtecbsaiw' WindowName: 'apmtrgguuzzjglhymaxqr'
ClassName: 'aawvwroudjxczhjxpvyhslwuroljruwfd' WindowName: 'wpwkaumqxckjjknb'
ClassName: 'cdkbdaxcmjrivillxhpugjwkmzblceyzyfef' WindowName: 'tqbxpgnqztxqtjau'
ClassName: 'jcitvuzmwtggyxtdzawwmllttj' WindowName: 'mculhnuauvlllqm'
ClassName: 'jppoebhhttihtwotkbkq' WindowName: 'aiinulhgwsiwuqgnsmhafmoub'
ClassName: 'vxgevoqskmmspkyplqmnqhcfsr' WindowName: 'jbxoxdwoiwfnskrvowpiaxnljbwpebelyioai'
ClassName: 'exizgqvtxbnlxoggyaxut' WindowName: 'btqbdcxgjpthqfqjvzzmacytddlu'
ClassName: 'pvljkxsyqpawbgqaqjlodymuasnpqq' WindowName: 'ufklhjpjvwfjdvlamdrevakpibra'
ClassName: 'szuxkwnzwvzeycudyflthcjmzljqgf' WindowName: 'vzrbkabfznqyfhthxbpkjicxghmhrwsjmz'
ClassName: 'ankiffobyrpgpbkcjffigrqzia' WindowName: 'qvhghbibdmrijhiiq'
ClassName: 'mqzeccxlclgtgelevxtqsemk' WindowName: 'zbereronzusbnogl'
ClassName: 'xmjmaiiwpqhoxzmklnyfatdpklwcl' WindowName: 'wfkkesanlljptrvdkrosn'
ClassName: 'xqdazlorhqjoaprj' WindowName: 'kisiboyfmcqzvsjgfxeknypwq'
ClassName: 'freweitzevxjzqhrvfmtcuqdzcnjhkkpxfv' WindowName: 'fhcvwxfxcaawmzounfkbnn'
ClassName: 'aynubhrlldkokvgnccozsiwhxmz' WindowName: 'ycwmiyuzizqcmvmyvgdqxp'
ClassName: 'oquzaiodkaxpgsoafzp' WindowName: 'csrajtofeysakqr'
ClassName: 'lakiukzjpacotlbynwbctg' WindowName: 'nmavufuhgbdiaoqrkjtqtexfzjyltchu'
ClassName: 'tnykdjjlrcbjfqwqkshjtbfzhsgloeq' WindowName: 'sqgkifemdxsctgncsjqsmrwlwdvctqmfqdsk'
ClassName: 'hesxzqlfjvyvvxtniceowgrssggdyh' WindowName: 'dpskljhguoumgromfzuxdacaelroukvyttq'
ClassName: 'oojinitpviilsrjizoatlehxuxdcewv' WindowName: 'jduxzpmivqfynltj'
ClassName: 'dbbkkhvkgouwbinvmikpav' WindowName: 'wdrftokutocslppthciunssllfmyg'
ClassName: 'ifwhgjmtuyjstswktl' WindowName: 'fyntoglafyimbzglxgljiswmkyam'
ClassName: 'niwsrnjauhfalwpvgnxxfazbv' WindowName: 'placwcvjjonyfagvubqmhlqbfstfkeztgegrm'
ClassName: 'uuddlpqmyzxilwpfxpumtxuqwhnc' WindowName: 'lavawmcjmrzkhfqfojrmef'
ClassName: 'detnphvhebscarpxl' WindowName: 'pcsrvpdegehujkalvthjc'
ClassName: 'hnvzvzzswcucdatjiazfecx' WindowName: 'fofnxrpkaebxbeutgqoqgqslzczfawbovrr'
ClassName: 'fawvfrehrzimqigetxwszaugqznj' WindowName: 'rvtmijlvnlaiyjpumutlgjrvajs'
ClassName: 'mullnajfbamwknidpeyruiuzaeaibltyhmjh' WindowName: 'bagaauaaburgfagnoxyqeda'
ClassName: 'oxzbjcmuutslakndu' WindowName: 'cjyespurwkwmuznriidsslauywfgovixisqmk'
ClassName: 'lrmuompiikrdaucwhky' WindowName: 'nlrxmustiiomeotsrqhcmjzyvhgsuauqxqiu'
ClassName: 'kyxegtbckhaqsmtztodcppxdfptfaiz' WindowName: 'bumojghrqhpdmdglkzabaxfbjmzp'
ClassName: 'pleowwhnaakitds' WindowName: 'jopsziphotlmazfxdvkyocwdnfzxtwczy'