Trojan.StartPage.57873

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsv2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll
%TEMP%\nsv2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'pqiciwwhioajotcrmdivnb' WindowName: 'oqmekmuaxapzgtldhenfjmdwmjgoyzp'
ClassName: 'tdbzfhpxmqxtpluvrqaazifkgwju' WindowName: 'veyinavxkocziervpscvxjidprqsgoavhirqpi'
ClassName: 'dkxqbdhscbnpzyfclqrmtib' WindowName: 'vyukzzykhoqleddljduode'
ClassName: 'xdmkqdapczueelqzuddhs' WindowName: 'hqxefidygetvgqeuvvvyliobeswzhlsdxtlrix'
ClassName: 'kezucvylygjczlpwslwthglddrcqlaxx' WindowName: 'hlriuciwhrgvjvawxujdyof'
ClassName: 'oknlhdppxdsslponxonlrzsurzbctlte' WindowName: 'smgonugkmjqzkvyt'
ClassName: 'fafzjkxfgsfszcicgoomdlpffgmszoemm' WindowName: 'frjvxnxgkyphrjou'
ClassName: 'rjdgwfvvacygicpcmmtpctsnwmsllslota' WindowName: 'yufacyqasgnhonomkvruqyhvgtzvvtsirfxgf'
ClassName: 'qjynhmxuqridyctgghstcp' WindowName: 'iqgnztgqplfgebmtzttmmjfe'
ClassName: 'ckfrgmfznwkytywylqramvzn' WindowName: 'jkijwiwekyvxfeiauapnmmqygksszd'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'fqxhpgmatupqnxyquvbdjr' WindowName: 'tixldyluhvdwyyphovtreuhtlna'
ClassName: 'johctksmhdfrgvsqoqv' WindowName: 'vfqglqjefshewtihvykns'
ClassName: 'kdwnoesiwcpdipbnrdwvzgomwfevnjgxoz' WindowName: 'bqlzzxcsktkrpavdytnagojzn'
ClassName: 'crtnvrgndqkhvcpkhxzuqrgzztaegw' WindowName: 'wfcfhhypaoolqgmjbcemsumfohzfqskgbzmexn'
ClassName: 'mnccilycxuospyjhnhvukrsmypottlrc' WindowName: 'zdwminzxbkwdfxnmhrdcrius'
ClassName: 'qzhddfzevfgbdgpdrhrovdsbokjvwyru' WindowName: 'diegdrzsmsydefaoaciqvsgtoladoil'
ClassName: 'bsnxvseyeyzpvjuorfzndnca' WindowName: 'khymbpsccpcbtxzwcnmismlqosytvkmrqrdhfu'
ClassName: 'ixfjgvperkqduiwpvecufbbjvfx' WindowName: 'hhpkxlnglvozlnahvvghanowukqkrqevkyf'
ClassName: 'dqioinemfcftigjrghmsckodoocfhps' WindowName: 'qtombgoofuxfkqaditg'
ClassName: 'bnwsisnhmhsmbooxspztbhezyou' WindowName: 'gdobwyzwzokzgdzowqwxqmydxsulbswmel'
ClassName: 'hetqppbgvfcyjliotmqfoqdbjx' WindowName: 'jiwzwsvcviizpvyokwxmqnme'
ClassName: 'kpffflvvnajhnnuqkxwjvrvetrw' WindowName: 'ftulnsteyxenwsnajkivgfxztmvbtpchhv'
ClassName: 'jpjxtbomtfglbjkucovfmwwnjmznpjpkvgsyry' WindowName: 'ffbidqhtfhkhwgehwwzklfyryoxvg'
ClassName: 'lchwoiiiaiplorfal' WindowName: 'yqkjzgsytuubpliurosygazsivpsfdkspwraf'
ClassName: 'kxdvoduqpmdbocannvjcojleufxqxumaiyl' WindowName: 'thbrmtojtknyiynqvcrmhdffuch'
ClassName: 'ccgjupqxddpnjioekqwnjutaecgojf' WindowName: 'mbltkxttvtbliyheawotyulcuix'
ClassName: 'msyictdndqzeeleuoqyxhfjkbxrnogshlfodolt' WindowName: 'xgmjohmoybnctmeseweoim'
ClassName: 'xsbqqziplzrsvnjcdnwkfwvpbdbgtxroxyhen' WindowName: 'pqfzvpqbbtyoehoxvbnggpoui'
ClassName: 'jbpyvrewfofkoqhtmxgmofv' WindowName: 'aqoarhkuttyvjcnhbi'
ClassName: 'wgpnayepyidpilq' WindowName: 'dlfhhmqzikpaqsfflkwwwsakzhav'
ClassName: 'uzcwyjeeaiostiptddjjtc' WindowName: 'sccshstotjlhcjxtbzmdrrcz'
ClassName: 'skjpjlliwnqkpshgb' WindowName: 'sowqrhmbvjwlvwyprpxagojxhil'
ClassName: 'iqrsgixbvaqelgvetlg' WindowName: 'zgzrfcxzqypmrlirmaf'
ClassName: 'wkmsvffwymaqmjbksmswreg' WindowName: 'anplrbwuqnabqzyxlwhfa'
ClassName: 'duvkjvowqfvcgbuhovqqpzeyhjcnbdawuofdbmk' WindowName: 'darfkxiilgksyfbmlldyp'
ClassName: 'xhsiaqfvhbvqdrvfiwadsiwcrmbqhw' WindowName: 'wwvkanwaccbsiwpupvqntwlhnjsnxhhspxgua'
ClassName: 'znurzxfznyeoucvkmkigvcqpznprtrqxibalsq' WindowName: 'bzqvzcfezmganogzrnqttdaiuwhiffeoetpo'
ClassName: 'xocdjdlltqurwccbikxbxheealsxbvfdsk' WindowName: 'rsyakvndwfgnulwezsjl'
ClassName: 'ubqnchmxevykebbrzapymxpxokwxekuj' WindowName: 'zqzkvpeqtcqujzgamv'
ClassName: 'qzmuiifbgfwzpjitncl' WindowName: 'crghrdsaqgkvjeh'
ClassName: 'qvmpfrzzwadggcp' WindowName: 'ifhqzcmmukcsoaxgforheuym'
ClassName: 'xbzkbglaklktnnqzhhkh' WindowName: 'vkukyfiapdardatbmvkfbkcruhlwrn'
ClassName: 'byfconckxuyyxqlcvcoifuvoxnkykvxfhwpkq' WindowName: 'yctlwzfjkdkjfdetoe'
ClassName: 'heyhnbapmxbfbpmkdaxntvakmmtvb' WindowName: 'vpygnrrzpfzdcowxqhmfyxf'
ClassName: 'oqjdbamdigcmnggrpepsgkof' WindowName: 'nwxyfvlswhgvwsciatyfuphlxjhudsiajbotkf'
ClassName: 'nqmlamooeqloncwcnxwmjcmywrfhzmbehu' WindowName: 'zyfmlhgzjdgurmddjptrq'