Trojan.StartPage.59385

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsy2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsy2.tmp\System.dll
%TEMP%\nsy2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsy2.tmp\System.dll
%TEMP%\nsy2.tmp\Math.dll
%TEMP%\nsy2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'gqlhdzcvbhdiomadqphkfjycblajtousink' WindowName: 'bwkwyrfgoopreeosjnteaedljxhngflnzlezbu'
ClassName: 'uswsczuijoruvdronqnuydov' WindowName: 'mokazkdhinowwlpcspetotebvcgzolex'
ClassName: 'nawhygzigwxkgdjsttkfwhjsyczoit' WindowName: 'tmqtrzbkjvgefnsgtoktnugmjq'
ClassName: 'wkdwzcuhjzhhqsuvhjocrem' WindowName: 'tiyivxezibfkgokudlqcctubv'
ClassName: 'hikzhkhbhlojnagnfpkcifpeiuf' WindowName: 'pvwejrpzzcbbrwuecmyrixnqcyvnlgjrc'
ClassName: 'mwcuxfmxbzlnobbpsb' WindowName: 'msxcldpanvgwjhhnlhvcgxzjkwaifktevwzkkno'
ClassName: 'aaebjnyezamtocaorpvhvhwdbwnokhfiqv' WindowName: 'cdnzunqacbqezmrockkjjvwzfrtddezf'
ClassName: 'umgodhliidnctmpmlfaixyrbryrazt' WindowName: 'hdeldiffwtrypvkcnkpsvlny'
ClassName: 'vdccohxwlvfjafaktrajpvmqusomfozwsfxgnv' WindowName: 'jbgsoxgctemhwark'
ClassName: 'fakgiurhysuadzmctgdons' WindowName: 'rdqsxzrngwwvqzvpmdgoysuuweydlxkbumgbdim'
ClassName: 'yttuwtxuqrgqcyxboopkvpvoyzrlspe' WindowName: 'xwjhijhksjhntugunlpgwrwdmyrstbj'
ClassName: 'efgykfvbgtqtueglprajgywtshjejogj' WindowName: 'kbkmuxupkssqitunodadbrmcfrjwdrivcwuwu'
ClassName: 'osvuflrjdcdmerdoyj' WindowName: 'yygenkrnspavoulsptolihmhmcicwsnlties'
ClassName: 'gyzcrelnpbjsfbecmnjladmd' WindowName: 'utjddqukzthzygqbgzlaritkncupsufqbyw'
ClassName: 'ciqamnxlximoxkmrgkpwqlwnhqroodkowbhzw' WindowName: 'cciuvqbpkesqilutiqhqtalh'
ClassName: 'vdpjfhgjoxsbyveugemydym' WindowName: 'ebhwvfqpgjautfmajjldllnomelreirebdz'
ClassName: 'ndavjoxotykmxioobqztfbxwze' WindowName: 'dbzrovyskfrdffjamywmrcjca'
ClassName: 'asujiltqalfbgokkpvmzjtnet' WindowName: 'xnoesseeqymciyxrjwbnvhsarutzceqguficr'
ClassName: 'gmqvcehrrhbsedqgdpwsahprixc' WindowName: 'opmupyscloeexnhzhez'
ClassName: 'kjamjiupuxhogwvamagckd' WindowName: 'ysvdigcixupkotptiyleujbpszrdjessg'
ClassName: 'oalvjhxwsvmdrvpyglwddfmcgjjii' WindowName: 'mhtdwnknotgmkkpj'
ClassName: 'iacucesyqiwzdzzathxnnav' WindowName: 'fazsbxuxbllmbzw'
ClassName: 'rfnrucctxhzwvnscy' WindowName: 'xzvihncofrvtkorutgdvfghe'
ClassName: 'kjhpygpxrshlsuozcdicdxdkjtefaa' WindowName: 'ooaeiuuumuvagoetmvb'
ClassName: 'qsewerbljuhivlklzybmazqzynsgkmyxpr' WindowName: 'hviuodgbhwuyxuqetspormqajirajmmyda'
ClassName: 'avbgfcnlkezwhozl' WindowName: 'mgbxkbmmnjllvjsqrmbkonixhojezcbvazayc'
ClassName: 'oivntixwskelkcyagbjxcqna' WindowName: 'htfgzrmhbojfrwh'
ClassName: 'fkjoyeqrrbxowhevkpekrqh' WindowName: 'vxxpgfrdaabaupwqyfdtaanvrq'
ClassName: 'jxvbgrzbmtgfogdoawortprybmqraic' WindowName: 'jfrfigtpcuucljxlpiraavfgredw'
ClassName: 'eqztlyofipkjpqiy' WindowName: 'wdpyicwnzxvrklurnrevvmbgxlbaeazoac'
ClassName: 'lifmgofqknyjlyknrjzdyahbuzckiph' WindowName: 'ywrgpdwapzlezsbchlb'
ClassName: 'ajycemsdcwkavkgvcxabhupueztbagy' WindowName: 'zhkfxczpsriofmzofokkowjigssrqzyvrm'
ClassName: 'skitakrltvlutqbnydklaiwmy' WindowName: 'zxxnfjhieyduegfwuaijcpacoziibsepxjc'
ClassName: 'dhandgpvwqwulglipnsrsehprsnubbmgmjh' WindowName: 'tuypfqwijdeevdtbiwmvpyeaeqivlvexg'
ClassName: 'axjoinfkggrkxwwil' WindowName: 'vrsonpbrqcxcayw'
ClassName: 'nigkxyvumbmlffqerxkkpqikam' WindowName: 'zpljauzxthosptizfiyqi'
ClassName: 'acnblcioxxfuqlodauhtpvaldtudtowtce' WindowName: 'ikggxmmnyjzkjoeqgji'
ClassName: 'srjfapwcgjffmqewubdjhven' WindowName: 'ggywfxenioomuxc'
ClassName: 'ikujbsamwolbocknsohtrinedepoibyygbe' WindowName: 'upjynpgkbiaphhgjvebjzyoqjgg'
ClassName: 'pohdiidusbhcwgatrwpvdfyhaucy' WindowName: 'fzumglmxtdxlgxkwrfouddnvhxelaz'
ClassName: 'cvsrwpubhscsjalgvkysdajpqzyozzgcegyg' WindowName: 'ophzfcrsofiuxliulucvaqfmivfi'
ClassName: 'astdraqfhmtapdbrfxcckbfcl' WindowName: 'eaewxscxcmhbyrepfzshmgzyzgotr'
ClassName: 'yjsqdwgkwahjvgavwbqbxgo' WindowName: 'yyylilmhxojjhbgdrfxjbjywkja'
ClassName: 'ckmvrgovplvlkyfjtooqhjsicwhjfhmyaulhtup' WindowName: 'ljlnrundohkdiuieqpkpkooxxjfqm'
ClassName: 'akoulqbzmalmpfklbsrmgtimdy' WindowName: 'hwxvwqfdbfyimsky'