Trojan.StartPage.57942

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsd2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsd2.tmp\System.dll
%TEMP%\nsd2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsd2.tmp\System.dll
%TEMP%\nsd2.tmp\Math.dll
%TEMP%\nsd2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'yavtrhduhazfajqzgdzagfgqdbz' WindowName: 'xqtvwvlwgbqbrynhqrwnrxijboxqvw'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'fjzjvwlbvkemqywrncsizqnnmu' WindowName: 'obftjxlxthvtwrb'
ClassName: 'rjslnplwhffitjyugc' WindowName: 'rorrjereyfxinnhgjakflhanabhfqszzjoick'
ClassName: 'hythfjujwyzwrxkoiq' WindowName: 'tpbqdfnnsbjbtnoyuiggjvphucqiolelmdhtgpo'
ClassName: 'wiqruglszgdoolnnkcrephteyowrm' WindowName: 'zrrmflbxnheyiioihvsedr'
ClassName: 'dthryivfuluumnnci' WindowName: 'mrttkqphrqzzkjwyumgwkaw'
ClassName: 'agbcdxxpvofcqih' WindowName: 'lsgjsdugnjyvevfzt'
ClassName: 'yyailsrtgayaxvkjtirvcuxeosoobjogydgo' WindowName: 'usqehroszovbbud'
ClassName: 'gpwhrtgrlyjvkewivgljhyffuleepenaawremqw' WindowName: 'msdvewhabbdlskgtkashjmrhxgcvqv'
ClassName: 'qrjbzjtwpxavcslqexgaemkonmbydpswmwmrbzz' WindowName: 'vjhcxljossstwufpzllagcaxqxjvfsipkgspna'
ClassName: 'jhnraagxvgkitjoxl' WindowName: 'drkklrmwvxbbuzq'
ClassName: 'tmjqkgejgqgzleldqucvbtnxocoqbhbzzoxgq' WindowName: 'gvzptyysppndkcavtjfsyfobofmhnce'
ClassName: 'ewxfpapfareuwzhzmejbt' WindowName: 'xpogrkqtxjszncjqkdwnnf'
ClassName: 'rgcbiapizeevpqzbnvwdvkbrjsyzzfqy' WindowName: 'mmlwehhfgubvbdei'
ClassName: 'lahrcsfjbpvonlbnsly' WindowName: 'ngdciowaravmnpscijybkrsypktwhaolggjep'
ClassName: 'nicdzpgyfhzbjzi' WindowName: 'yaohlmjyhbyfsqnno'
ClassName: 'blrevcnutjrexxi' WindowName: 'ctrnimdzxoydzyeeywirbtwlbyy'
ClassName: 'zzhqgoidlsmsfnjruzkqqbe' WindowName: 'kfwtxsvgjygfinhmdungdydzfksb'
ClassName: 'ghpynudhdojexmwbmrd' WindowName: 'cuondmubdwuqtrbotkoyrdepx'
ClassName: 'ktqkaamjjtxqzdwcwvmpfdertqrodhgq' WindowName: 'heaorboblxkyndglvkzpnlnfcbezl'
ClassName: 'pxeoyoopvmzcxhkfbggxsghsi' WindowName: 'tlbagbfghgpdpnupkxs'
ClassName: 'fqspysxrdbikgahescrsnoah' WindowName: 'inotdmocjjdicff'
ClassName: 'tkacoecyppaamizmsno' WindowName: 'nvccdfrgytkuptelzznuqcpp'
ClassName: 'lxwjpthltbtgrvardnt' WindowName: 'ngnrrsgolglhxojajlcefytexzjgcuxsrqwb'
ClassName: 'gjlwwwhmgqufrxlr' WindowName: 'iqjnuglycnuwlqpdlfyzfpjnlpg'
ClassName: 'kmvkkznsbmmnbthxlrqlkxlnfmkkutfsjyjwbnj' WindowName: 'katosxfnazvsfydkdiitafcoxxacb'
ClassName: 'gcisigttmpsvktilegvyeoejjpzmvggs' WindowName: 'agdharrijzfqemfsnlfpdnbvrgw'
ClassName: 'ftmufumrrptppliystdnycmcv' WindowName: 'hlphqzdbeyitcbayobpjmgmdidpnqwhckycerp'
ClassName: 'keddwuujmehoivknxtveotorhvvivrmmiy' WindowName: 'biltragxjhwxvafuwxdwqaltlsrulbvutodjehz'
ClassName: 'eqirunroangfdakkpd' WindowName: 'qwcuueyzhvaauenptoqibebrhtpkus'
ClassName: 'toyupjpoaulhbydeezhsxdzdaggp' WindowName: 'uazotzgprgysqcnxxbigaxeuvqmk'
ClassName: 'jwumotcxjilwdlsfsfhsdpkljwvkt' WindowName: 'rqkxbhmqmtanalyps'
ClassName: 'eaarhszaywypkwj' WindowName: 'uohqzllkhwuejthxijfjvoqeld'
ClassName: 'ncwongpvqjooccapdpdrgv' WindowName: 'usgbhkcxemxujdyjwdtc'
ClassName: 'ckvqnegbimczmtivtebeynmlakynhpdj' WindowName: 'sgfbzgostzdafxyfqwmxmjzeujsyqnm'
ClassName: 'hojoximvjrhxihwyakl' WindowName: 'qrlotlaqoowulrhkliaissxqwjq'
ClassName: 'iqrlkroalpqxdwgsqaewakypgc' WindowName: 'fkkqyvqzzkqipbdnnyjiovvgsnweevbdhvk'
ClassName: 'fdhlktuuyfytpcmfjxbuwuiqalyqoqzwcrqqun' WindowName: 'wpdzhjnytgjuictxpzgmnkpssoftyawdmsya'
ClassName: 'rtanxsobgotvywfriqqqyk' WindowName: 'szuwsnzduiequssbgnt'
ClassName: 'pbmablcolfmtovrvcqgmewadw' WindowName: 'zvvggfeqcljxnkfhy'
ClassName: 'iuwakmqvohbdwsryndhosqaxluorzomlielmp' WindowName: 'ftszkkvrkwifejrqsdfffbhahqlygqfylqjj'
ClassName: 'kngjnkwbwgjjqdnfruouiwkkaajw' WindowName: 'blzqdcxtrrhymvpkvrixltj'
ClassName: 'ylbxpgurkwfohxcgfzyarhm' WindowName: 'mswmazmtamjzkpxysed'
ClassName: 'hgtrajnktfrodapraeidglicjlpvscznjg' WindowName: 'zgiagoslnakaslysenwannxzce'
ClassName: 'wfeqftfszuacodizubw' WindowName: 'kikrwtxhqakuqgclddck'
ClassName: 'etnwisqhhrnuctcfixmget' WindowName: 'nmswfavvnusnvdcdbbbsfiiuw'
ClassName: 'waurwkfqqnhjavnrgganboxdjdjzut' WindowName: 'pqqnzdndztjhcmlyqqozzida'
ClassName: 'qgnwyvdgbqbtokrecpx' WindowName: 'mnxlyygbrdsvthiha'