Trojan.StartPage.59122

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsd2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsd2.tmp\System.dll
%TEMP%\nsd2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsd2.tmp\System.dll
%TEMP%\nsd2.tmp\Math.dll
%TEMP%\nsd2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'eoacilbumaxuoewuycdpuswmgztlwrvsa' WindowName: 'guyfmaheuyvnudnhficph'
ClassName: 'ncvmdjmsjalicfnhrno' WindowName: 'bjwcnwxctglykmjqxnpacflxexztlmtuowc'
ClassName: 'bldlzuypcbfpwhjnsbunb' WindowName: 'hynxhofmkwvvvgooszppwicdysmehnwlxf'
ClassName: 'jteeplrvzhttsxuwceizlbqgwjvnlj' WindowName: 'oferonsukhqxtfadnlsbgtoxjblqhudza'
ClassName: 'dtxsosdnhjzdyzhqzfthaiiktmrpqym' WindowName: 'rmfedhngqupilsvtztwpifuimzfoycrfptmwvw'
ClassName: 'tqwllcyphusaetiymnwznchixtjdhzd' WindowName: 'motwjpqlsqwcdunkmcuvcaeblkrsnrhrxu'
ClassName: 'hibbezjfvvsmprdejecrsoggw' WindowName: 'wkzqmybebyytovqlasldwxxwpp'
ClassName: 'cwzxdqcgrvetkouqlzykmas' WindowName: 'yyovvzcwmluurjtqxlyufpqtpxt'
ClassName: 'pereoqhixbboggbumlazxtttzwezvnf' WindowName: 'nburxolipasxwwcgefergohiycurpvcvevl'
ClassName: 'atfnfplewypackwajgc' WindowName: 'fyznepxjspajlcebruvydlu'
ClassName: 'wujxvrhgzxozncirfkgdyyrldpczdmmbflxistu' WindowName: 'aohojkvrkyxbiagsqwpciziwwrgbsakdbzslzca'
ClassName: 'wdjybfwzoodawxejuhasybbi' WindowName: 'mdlacdajybbvwegfzahypdt'
ClassName: 'pzesrmjpaviradsokswolpyhcz' WindowName: 'vppftyrnxrqcorwpzjgfjqcpjkb'
ClassName: 'fuxsgsedvyxsooz' WindowName: 'nlqdwwrofgqfxsalawtzeuh'
ClassName: 'szxkdjftidmsqqnxcljmzlamkrs' WindowName: 'ljaquzqslapdhxbobulptjzlygknotzpnxc'
ClassName: 'kkfmjdshlglvicqt' WindowName: 'olzousugrbwmqzkarpezlzsbmuohdg'
ClassName: 'jtvnoqkdqmspchycpewxqfydlnkbetiyy' WindowName: 'oqzerdlrxxvuqybzi'
ClassName: 'nddcwewotgdobwturuuormjgcvxihcnzqt' WindowName: 'xvqrtugxyrbtouwbp'
ClassName: 'udodrohcfddxyuovazrsnrly' WindowName: 'iycqfjaoswqupkcxtibpfotkxzshqdalqekja'
ClassName: 'ibdlcbiuwiayajfgmukvypa' WindowName: 'fmkkojwxfirbrzharos'
ClassName: 'emhekkcasdwacytlgigepsxwhkzbwjcbcd' WindowName: 'nlttjxziimvvjgjaqzncsrko'
ClassName: 'dxhwxshymbrlfqklhf' WindowName: 'chwontuplnpzezaxbvkuwncj'
ClassName: 'fponyxdbbuvtxixpkydejtlozhmnnnicuhscdm' WindowName: 'gtcikqxjzlkcpiwgnbqzmhtqveqxwqkp'
ClassName: 'qpndkxvqzwjimebcrhv' WindowName: 'mrdwmkcybvuwkazjmadzejyrhmcfnvkbmkal'
ClassName: 'arocjzfiwqwstozaedqsenzwlwkbahftaqswrqn' WindowName: 'iglxsvtwfiebqldwpee'
ClassName: 'iomrhvpuughlnswjjpwoasup' WindowName: 'zvgncyiftmhznibtsu'
ClassName: 'oofimookakhxtifhnnmegocdxvfkn' WindowName: 'mtiisnaozglzhfdixkyaudtyamhfpmrwjqad'
ClassName: 'vkytvxnyhpfkmgfxvcybljifqsqdrtqr' WindowName: 'ypcplqpcdaossqdrh'
ClassName: 'pjwgrtaziszobhpdkfrpuxf' WindowName: 'psqkrxhxiayroefwfhqbprjdstlxf'
ClassName: 'nwtwugxndseohzghaswqx' WindowName: 'oqtynurpjzodjjkzcwnmeeku'
ClassName: 'cgobbsvtgzfjxmgxntbfuiagluegp' WindowName: 'yddquhzcjmhjienrubvkmdbqltpuntobn'
ClassName: 'jknwlujmdarhceqgdk' WindowName: 'uknrjiotvynlohiwipyta'
ClassName: 'hgvpnazzksgxrdlmpsnoxcpn' WindowName: 'olyqakdectmsstzejsanut'
ClassName: 'koxzefgzdbyuzfcmdvrmvzlsni' WindowName: 'dpxqdrutbnrsuwxgh'
ClassName: 'hapssmdefbzzdfvporkqfah' WindowName: 'msdnxgkkzzmetqopyjqbycjq'
ClassName: 'qllwhedovgccppcobmhn' WindowName: 'eghjdmzaxbdhzttyeuipgwarjplgs'
ClassName: 'mgzchjhccfvmoocgulxljztkadtegubx' WindowName: 'phnxsvvzinsjujhviehwfonikbyszayvremue'
ClassName: 'zziiydzfnvxsbggspubflysuomgmrme' WindowName: 'zqfpxeymfpntcooirqcdqnnr'
ClassName: 'cvmzmpknvhgdtyirvydstovvysxazk' WindowName: 'sxafywdxwpigrsacjqivrzjpxinsmtm'
ClassName: 'nfgztguebeipgiegrret' WindowName: 'rvmtjuptwdfrkjaoakssgitfyxzzgimyuo'
ClassName: 'fkkvdlvagcjbtpwpjwnwnkrbcdiusythcffjonc' WindowName: 'xmgpbqvthabsgzzvfizbiifufpambxpaoc'
ClassName: 'hzdhyiqhurrbsibluoosuwfywlmyy' WindowName: 'lsmmwbsdtsrlmhrjck'
ClassName: 'tizxioxdkdmszenkjlpavzzeuuhn' WindowName: 'phrldltcbvgjncayjypmjskcieeeb'
ClassName: 'qljeqkruujcvtvwkangxuzhvqxmofbp' WindowName: 'ctpcozqjzxhaqimhvamrbeqayzoic'