Trojan.StartPage.59137

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsl2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsl2.tmp\System.dll
%TEMP%\nsl2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsl2.tmp\System.dll
%TEMP%\nsl2.tmp\Math.dll
%TEMP%\nsl2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'vetmllehrniljjpfpwpxc' WindowName: 'joezvwrklobnyfp'
ClassName: 'hlbkfidinzndciohhjn' WindowName: 'tbnpnvjhkxzbnypzvlilcjjyhsywnlohkhdy'
ClassName: 'ndgvjwauvsnrutuhujsrwugx' WindowName: 'iywimheuyxctkndhlpqgpr'
ClassName: 'geynzljwpnvzkcmgpnpbblnzpryas' WindowName: 'zyxgtpyygzrxbghsffyjaxmoo'
ClassName: 'rbxklfesgzecwfqlbetmplswceamszjgsjo' WindowName: 'iawbrwseqiwdwlbaceayzmmbxyztycmo'
ClassName: 'bndhvjedkabeqeqtpmvtyc' WindowName: 'izkmogzkeahwebekcqzsivpns'
ClassName: 'qyujhaqudvaweil' WindowName: 'zlvuarxgtykpasdnlnojixp'
ClassName: 'vwmzlljbeasctqcekbognjmackqg' WindowName: 'mbwrfilhycrnvbywbac'
ClassName: 'dkmtpsblzdstnwlebeajybmdirctkfndskcfdw' WindowName: 'ppedpvlqihenkdhqozl'
ClassName: 'djiyyvjyzeatnkps' WindowName: 'aslkztwfpjskxdrxfnjhyjtynuf'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'whegncsqubcvyioavqtlgb' WindowName: 'mdiuwkcdeqzjdovjkvkqjhhz'
ClassName: 'mlbeykltontecmkuaiknszalkafrn' WindowName: 'kozswbjtxywxhphsb'
ClassName: 'wjobwmisfhdejvkaukikojb' WindowName: 'vtwaysyzgnelzbnktwkgrtf'
ClassName: 'mnnuxvpehutrmbnqmepmbxdoxym' WindowName: 'nnzvczhnxotdtecybrephzijjvebkm'
ClassName: 'agtanfiplphiusjywjbfwhmswkhehctf' WindowName: 'iuldiacuithzachiiuweljpfuscqg'
ClassName: 'eqtiwtewchgmxanqkkfvkzdslfbafg' WindowName: 'xujikkhcuztxperoopsnwnyrvqvuyryoqciisqo'
ClassName: 'xhenasshqjytisvoxah' WindowName: 'ugqfnunsewempgygvfmsoblznnchnhdm'
ClassName: 'vcrqwmfsrouwwwchmbits' WindowName: 'rjfwamwjazrkhgnziloylluqniwzrtxihpbl'
ClassName: 'ybjbjtiftpnyxiixxojgxcdcgrkfhr' WindowName: 'ilcnqfdlsajzmrhpklww'
ClassName: 'ynxsfwsdvtqditdgtrlnwza' WindowName: 'ukvymjdnvebogndmzqwmkuhmdjzdzsxtjc'
ClassName: 'praffirjueyhopexjvbvuuypqbacsjumqq' WindowName: 'rlvrnsvzwgvneavhpspipuw'
ClassName: 'gkrujnzexgflswsrmvmxdgyamcjfd' WindowName: 'zegmhdswxjcirdhkewpxhfuvqcizhhzdpr'
ClassName: 'vijkgfukxmtsyemtmilrwhqyqcwaxgbqa' WindowName: 'dfcfgsbcrqvqktckypnzsbtfhmdnlahwjivhqwy'
ClassName: 'gvukrtuonnmkpqnqvfnpwmuftymhtoam' WindowName: 'ovvxhfkhzxazhxtwdxpmabwuwnsc'
ClassName: 'ospaxmyrwkncwzrevqmxhyxjxpob' WindowName: 'penylbiqoyzqytninn'
ClassName: 'ofeixqdkopfswlcxkwqtmqqkhwswtxr' WindowName: 'vgmrjiyvdqlqydbrqoshwpyecictjeeivrhk'
ClassName: 'feubzmfqpmwlnljgojfctklzyolrkalb' WindowName: 'zwbkchoacjybasizhcxtiacjpuzpcstme'
ClassName: 'kyxyhdebuekbzrptvcniewv' WindowName: 'ryiawyxibtsmhbuvracv'
ClassName: 'lrzufbalqvwqrwgmlns' WindowName: 'gvqzqdirtbaooteehz'
ClassName: 'kdwuthzrvtqhrkuhttkgtlxqkll' WindowName: 'wvodktwtvxgnayabezwgoulfg'
ClassName: 'jlxqauzwwwwnsmsjhpzvtzzzmpearyjg' WindowName: 'ucmnfdtbwsyjmegm'
ClassName: 'wutdwpeimrjpurqqopdcupcckqhp' WindowName: 'hdgdvpimghiloldymekraljfdesnwm'
ClassName: 'ssjdjpakmjvnxuotl' WindowName: 'wovcsgbyymzrfbtszqlwlznkdyz'
ClassName: 'pmvdzoqwrlsjdwnrrxawlohhlbdahxdxskdu' WindowName: 'akuwauqbnmlarmaxhxmdcl'
ClassName: 'mptlhflrkkhkuuunhfsnoqqn' WindowName: 'krxiekmtgpcccxoapllulxkaitnptmksd'
ClassName: 'nhuqwvlteppoumry' WindowName: 'enbnjbwsvevcmoifyxpdsunnvnovxvshxax'
ClassName: 'jwgnijzijkpocijezfmzui' WindowName: 'tapyjckhmfdirbxofkdcakfrk'
ClassName: 'rhvjqijbfjthwyqsqojrqcptdzashbihottd' WindowName: 'wkzeblhxqbenvebivwaqvdtrcmwpq'
ClassName: 'zuhhegbpmwbaymszoiavjfsocgitlfb' WindowName: 'ednaeochsabmgpt'
ClassName: 'hpoafstlucpmfnomjse' WindowName: 'hlwsujiqtorszroi'
ClassName: 'qmyncbrxbnstxhrcrgqvrvgjfgobyhg' WindowName: 'uutgxvfpwrvlrwurzuqcknzhblbntabch'
ClassName: 'doyprgcyhubgiymxepqpnkxkd' WindowName: 'bwmfnxuurrbxaogu'
ClassName: 'adzqeopepcsdkcrmxxdgxudeeqkpp' WindowName: 'lvcvipsnigfrhehjuiqibonks'
ClassName: 'sjqwxyeztxyntetowrgqez' WindowName: 'baxzttjcanjoovjunlwtf'
ClassName: 'vdxuwdikmgiuplgimxzftyoxvewspwhxrvtpvlb' WindowName: 'ixbekaksrtohyqjzasvx'
ClassName: 'tmaxsvgabvjhdcdyigtfrubumsvnt' WindowName: 'ugvyphzjwaafrbnpsyuathryqmlrwhhuznjjuk'
ClassName: 'tyneeubtbyoenksghrioifzkkkvywnqp' WindowName: 'yvfjhlgcvmlusiabparcbtxpzbutkuhyovrmwt'
ClassName: 'ozsoyfwlnlssvxnfmmkrhzfqbkxscwdwylghru' WindowName: 'ashdkcqbgmetzoytinognwukjj'