Trojan.StartPage.58227

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsl2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsl2.tmp\System.dll
%TEMP%\nsl2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsl2.tmp\System.dll
%TEMP%\nsl2.tmp\Math.dll
%TEMP%\nsl2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'fjdjyvkivrncbvmqjanezin' WindowName: 'vboaygupfvgslxujhltysieqpg'
ClassName: 'fnhtcfaqozwuzjvehxcobnbazeuyidhob' WindowName: 'mawitmiyhamiekhvacwqfnli'
ClassName: 'qifvxijagwjelzmh' WindowName: 'pnwkfneektzdablxtpmhwxvzhneqrxghn'
ClassName: 'lcqmjtgskbwwoufqxbbafxxwmzaw' WindowName: 'mztnhxrutdtdfpkqnyzlohk'
ClassName: 'kgbskfdtxcvkrxh' WindowName: 'uoesynoigedmvmwggjtufzfznq'
ClassName: 'wrkevthmltncvesvufuglxboasi' WindowName: 'uazunvperaausdkncsngjzc'
ClassName: 'lxvhrngbdtxffwiyexpqfupdsbxwn' WindowName: 'qbdtgrknkugrgsuurjtflevu'
ClassName: 'ckqpeeofiimqcoxljewstxlixs' WindowName: 'vdchsqzpipwivdwbybvshxxdoeqhbnjvxvmdkk'
ClassName: 'urufxswroofbdoinasvjziqmkfybnnq' WindowName: 'xwylwdwjwvnkghjqsrabiy'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'htzvgrtncdijkcwdzfuavzpldfofeufgmsmip' WindowName: 'wzbxauoafileibdxsysovbizwbmgafdtz'
ClassName: 'nqyolgjqkkzziaxy' WindowName: 'kwoyajlmegssaaysqtjfrwwboxt'
ClassName: 'ummcnkjmvtrvudrhwtzakq' WindowName: 'spwjdvytflrhgdehmgwhlhlwkglkausfrixecrw'
ClassName: 'rgvbzymcquwyzytguo' WindowName: 'xdzuqpmupipvpcqibrtbzosdopqrcntbqp'
ClassName: 'agwrvybkmcdblnhsbdzzfwxyxhvdeyxsqqsiin' WindowName: 'ovexbweplmixaebnoznrpozfnccexxebquxkyap'
ClassName: 'mzkzrqfnebaysqsiwgwuoto' WindowName: 'hwmqnveylfrohle'
ClassName: 'vazwtbdhhflgqepnpcbbfsxkgg' WindowName: 'zvgpxmmuagyyujfysmhipfjogr'
ClassName: 'extieuoekqfphvixnryhy' WindowName: 'rbcyuzgftvrtoygsu'
ClassName: 'vayzomizsoayzrrmefnkwmiuqpb' WindowName: 'uroticczmgtqrilqgujtzxgegbplvmnf'
ClassName: 'slevdbjnrqcdrpbffaxmwevmzrlwgogatqesmmr' WindowName: 'secwyhetxlhfkfewmrbjqqpphipxdyn'
ClassName: 'idwskmejtjglwyihtoxrzswrccentqr' WindowName: 'xflmqofsiwftxetrqdhszoscvg'
ClassName: 'tqjaotolyirzyocnihydiadntpoj' WindowName: 'ftdrnztqduyxawbjzlfebntexsic'
ClassName: 'axborfhuubvxnaangkvlfihqwtmuftk' WindowName: 'fydjmmkmljoyiphcf'
ClassName: 'boffhffbtdinngnchzzpuypjjwckpqeitobtrjp' WindowName: 'xytyaockgyqdwqdgupusuqtvrmbzonypueijt'
ClassName: 'oxatalsizainfvxybtbdtipgiqump' WindowName: 'qajfpnbwpphtstygnecobkmjyxpzzmoz'
ClassName: 'szsmrnqxejqbgnfygfboqultfzllgqrhis' WindowName: 'kotmglmtolcwqtjxxuqsgxfkotgolklujw'
ClassName: 'rxcgncocugcckoxsjzlfwpmcxthnorl' WindowName: 'cufhwdekpwdkdpkknccnqijewabhhvnfyq'
ClassName: 'daqqkzdrzkkkbbwmdaxsecegznfiy' WindowName: 'dwacsmvbprxejvsv'
ClassName: 'tpvrsdckcfjcrvmadnlabuiiiwqcpwqhzl' WindowName: 'uwypzcezeisgtmbxlabkqxuejlliieutkqv'
ClassName: 'hmyzelkobrursyupbzsttceldd' WindowName: 'uvfzqzlyokxzswyrwblmwkimi'
ClassName: 'zlmomuqxefdnhtyrattxwmkftwbfwhngcb' WindowName: 'xrhuvljaxtfzxayhxeoabbcnkzam'
ClassName: 'hqovodjogowsccgbtncyflridepobylnl' WindowName: 'uqbdhwvqzzvllirstiaohxuzobboleaaw'
ClassName: 'sswwckolnalploblklwnawmkh' WindowName: 'fwdfateqsrnvqamqjcigsg'
ClassName: 'gxbbgrlkvaarhoputoqtxdiswfeocnxht' WindowName: 'pdkgcgeufrwakhnoutkkvzlmsrs'
ClassName: 'xhbhopizjfmahqw' WindowName: 'yfhqivxrmvnnvdginounz'
ClassName: 'cdrxaxtvyixdipuwixlscysvcqvls' WindowName: 'uctogenmhhfxeguigqqhdpvbikiepwhvnf'
ClassName: 'ykszlhaxddthysgycupbdaxjwzrpyntpoxylt' WindowName: 'ghazzeoylywxevklqhzihwc'
ClassName: 'eshrlwiqgqnscrvcaoedotwdmtezqczfdmqghgm' WindowName: 'wwafpvkkvqsocmjjnw'
ClassName: 'yzleubsowhlnrowqcm' WindowName: 'cczmwtxialxvvpw'
ClassName: 'djggtbdhzypxissuwdrlghawuqmbxobdbs' WindowName: 'jpfrdbnszyepkrxmkaoycyricbjlrv'
ClassName: 'jaobylyqyodhycfanyscvpsfm' WindowName: 'deceynbejybexvwvrymc'
ClassName: 'sffpenpmsfmpgwx' WindowName: 'btyrbchspkjlecnkzqoqggqpuznfdhutex'
ClassName: 'ryvrzqqcdzonstiwaxn' WindowName: 'hesmaukvoqlbyopkxwpdoojea'
ClassName: 'ictsyhhxwgngasbhxcmhzgmenjdzohsfcy' WindowName: 'xfaelztxntmoofozsymgiz'
ClassName: 'eohxiugifjrakouyxzlmvnucuodgl' WindowName: 'fkpjwqmbkzoajvnurdnpombtcomnw'
ClassName: 'jlohpxlgxfkfvoga' WindowName: 'lwwkqobeqtyewepzectwznn'
ClassName: 'jbjxhprwtyexjvyxmhxpsmdgmpkwtmzi' WindowName: 'pqgeteertisynzjpxgkdsjzqzmsukgfl'
ClassName: 'shydgqqthwvdjmelvrrpatggbqzier' WindowName: 'cznrfkyxiyidbdb'
ClassName: 'xbwejxxjlhjgmlzl' WindowName: 'vtikduefcebjpgmhuzcskayeckyzhpsnba'
ClassName: 'jownztttyndssryzjmwfox' WindowName: 'kynvsbugzyqwaejqhusloah'