Trojan.StartPage.57941

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsb2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsb2.tmp\System.dll
%TEMP%\nsb2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsb2.tmp\System.dll
%TEMP%\nsb2.tmp\Math.dll
%TEMP%\nsb2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'papmsephpaaqimzyxtfavsvbpkspm' WindowName: 'nyhkwhloegpssvpdoqjyfk'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'cicqgqrobzrzhetzqzgkltpefwn' WindowName: 'zgawdjzgquunbnljnchkciqpuk'
ClassName: 'mepeivgkilcqfjpnpboiazcjwhmxnbclvb' WindowName: 'ftsiexxwkfyhoxouhmyplumadst'
ClassName: 'jrdmmatevvotaxtpfbbpfzwbqjfjqujd' WindowName: 'dlhdomofzvadrvsuvlhkmtjnsptybjjzyym'
ClassName: 'xgijmkbufercdgatjjetooswkhesqhwziuvrtyv' WindowName: 'atmoieyjpuhqkolghzdkzlibjzdegzgulpy'
ClassName: 'ekqgmmexuractliwxmiopzpkioiu' WindowName: 'xolxtzcfmnaxgdutwffmw'
ClassName: 'hwqfiggswdwdshppdilihwhptvl' WindowName: 'voelnqbjlsiavrozt'
ClassName: 'bwrzcktwwplvtkaooapfuvjbhhuxrltchhabbr' WindowName: 'voaddvshhtfptrmybotgnoysdesbdvc'
ClassName: 'rrogtsslqwunopjdaclxtlfzbxocxlo' WindowName: 'pkzjytlgbodpxsdwkumfkjtjbdjcqkdu'
ClassName: 'tjzntzxlnudjinusbfymsusldqptxppm' WindowName: 'xkemrzetotpndexbdjsdbo'
ClassName: 'khpzcwusshnekcoigdrgpcbskgrjsm' WindowName: 'unkiifndlcrekbnvxtlpllkhrmymgxjvncuind'
ClassName: 'tqfxzjtlmqnpicngqwmpox' WindowName: 'wmhkqljxkxnwkoheczmojprxteqfrkapasqbb'
ClassName: 'oidaskdigyzrthjuuothwhtqdc' WindowName: 'ogzbygkbbytnbiywvgzpokttz'
ClassName: 'ulmlooopaaiaazdeawuehzquy' WindowName: 'zilqkvssonmvxhuiseyqoihfrkazyntlxph'
ClassName: 'mdxdzuygarpetesjiye' WindowName: 'xdkbhsodacykvnjdwxyt'
ClassName: 'unkkxcnzndrzapurftelhtoqnzrsjimblk' WindowName: 'krelmriqbwbawxsszyzrhekguwe'
ClassName: 'wqxdfzyemjqmoqtvbkvdetbjhlto' WindowName: 'tubpontbhyntlrzjkiniyvqannokygnvi'
ClassName: 'witojehoqbyglkbmrlfw' WindowName: 'qwonnlhtkzhmqhwwxrgqhwmzadueovoxf'
ClassName: 'bfhiblharevzauvcajrjdplqdx' WindowName: 'xwtuojoqqewlgzfroxyirbifdbi'
ClassName: 'zslrzfycfikvzxkedmprfzl' WindowName: 'steynqbxmculkayytjprpuslwbjhycxuy'
ClassName: 'lyduseruwxxgtkceomwhsaak' WindowName: 'nogcaezdqqhunrokiumntg'
ClassName: 'nsyocqexhpyrxvrrtwwexvoiofujctsb' WindowName: 'zxbnmpxxjwswkkdxweehluhlua'
ClassName: 'scujkxlfrudmbqbpiekbrjxqiupcwklhao' WindowName: 'puubbzanovoqteyjabuvc'
ClassName: 'dayegyqhdqpjfbwmhuwqovc' WindowName: 'kdiazwfuronjhawztdxgot'
ClassName: 'mstbcvrkgqwavexuqjkagz' WindowName: 'booojuqjmnvjvewuoutavvntgueyg'
ClassName: 'pgenilriviohlckssydjrkphqkqv' WindowName: 'tjfmieazjmtzrrrr'
ClassName: 'eyscktnlabqflbpkgeqjzodzchuvttqm' WindowName: 'mtzsuudvwrrteaivgxjwomhfmifbuc'
ClassName: 'tcjlrlscwlhonaodcw' WindowName: 'dinsuzdilenfqbjfglfgwwlllsapuwavcytfu'
ClassName: 'ewunfjrmyiqbggwembgofngafomqaccqxprofg' WindowName: 'lbzaewlcxovmkccysujuklmgj'
ClassName: 'jygnwmbinijurghojebiuekygaebabigs' WindowName: 'ebkidrkwvyxyxhcxchzyiejxravdhgbzmsqcdhq'
ClassName: 'tgaloxvjepplnpjlikhyowrsdtjehvui' WindowName: 'vgvikglpvgabqptbtf'
ClassName: 'rpaszftirmpkxczzcxyfsrdaynpmn' WindowName: 'npusycmtrdxokcwtfnv'
ClassName: 'qtssseoqgosiawjari' WindowName: 'zglpygqbiaabbolkt'
ClassName: 'nsagxzfmpwawxwkkygaeeenc' WindowName: 'qlemnwtsyjwfqsiltuyivqkjhbtfzwabqeltk'
ClassName: 'vftnfdqnnfrenyxfkubksifprlphqhisagsp' WindowName: 'pjjbgjmlkgtvqrottllknagxjlplavptxppup'
ClassName: 'ncrnogbqizfnhftxbbzhlyc' WindowName: 'oramclarldxdinungogsrust'
ClassName: 'xmljakaounqqycfsadkfane' WindowName: 'cqboatkzibvjcnzagyxgulrohpmmwefnwhmqbr'
ClassName: 'mwyesavzuwbshksvdaomxxurgikymfkgzembvs' WindowName: 'xbqldpzhpfiwzhuurwihhhjx'
ClassName: 'crumlvhdrbhfotjugsmovpmhywsczxhwsv' WindowName: 'vhfuglgbkkrjsafxnxefo'
ClassName: 'fiowfaxhzzgftmlsjqjoicoswujhfklqhpvalxu' WindowName: 'tzjpssyzofqnrwhpprswovsobibgaogxbw'
ClassName: 'ongxinablcoduppfeyzexdjpicyrbyvvurvrxa' WindowName: 'ixuatoyueknkyyrbgg'
ClassName: 'xsvoanmvkeywkwfnaopw' WindowName: 'znqhybbkahwssjungkvzpgxbntakvzay'