Trojan.StartPage.59166

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsc2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\Math.dll
%TEMP%\nsc2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'rgypjgzdpaouvflyejrtlwaz' WindowName: 'xfzvbstmazwlgrkqbxvjokcvr'
ClassName: 'istdayuvohncjmwhgmdldkrixoykuezy' WindowName: 'iujdfqkqcdlctqetvun'
ClassName: 'uorcxcbmoyxpicrxdxdoabxtmprb' WindowName: 'vxsaqtmlomugclwtrx'
ClassName: 'suzypfgqhoguokitsbqogvxismqfbboucgv' WindowName: 'aihgqsoyjookxxsevkrgxkyezje'
ClassName: 'lkdusyrizognwgn' WindowName: 'pprjxlzszdngasyscsyjijnpotqif'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'wfzirgophtuatuctqthuwhmllqabomjq' WindowName: 'eflzcfvmgnvnfojxmuisrzbyne'
ClassName: 'zjzyhcwrkafdmpwmxoudzafxfoxa' WindowName: 'jstrmatyeexwfqehemieqxuyyjqo'
ClassName: 'tdgbfkclxmvnverrvyorghdkwrlghwxxyc' WindowName: 'axthmqxeiknvfbqresbkacmdnszokg'
ClassName: 'ljvhlaamqjzmywqmare' WindowName: 'hcymzxrvnfcdqytaoloocmalu'
ClassName: 'ajknsnrlgacmennjstvdgfcigezpnknl' WindowName: 'vxptplexefoeooabggtxrqxehtakc'
ClassName: 'emdqfpmvvhjatisffgjqoqijdavqe' WindowName: 'szekreelvvkowbzanyvrnflnmignpsm'
ClassName: 'ytcradygnyiptbohyn' WindowName: 'qrjnufuccjwjekwmbrwuvozzdtybmmcgsrd'
ClassName: 'xkwqwqllwnijjqpwk' WindowName: 'tcgyjchnvlcvjjrbggtepbpzcvjgonsmphgcdtn'
ClassName: 'dvhihukhijqaboseleaf' WindowName: 'wmucrhcqzjhoauupsuyrpmgjsrcjxsprdvt'
ClassName: 'opelqiumncixoluiqexgjhxpluxdnzznqwfaxlt' WindowName: 'tohdrigauvuxguvqgjjqnypgqq'
ClassName: 'fscpwstprwgtfybygjdxlavcomysnxcz' WindowName: 'vqqrgkunhejcraxilcdttoegdu'
ClassName: 'bqkclatjxqtnwix' WindowName: 'jnhbeqxteevfqqrhymplwefwqs'
ClassName: 'smmipuxkobapvslptvlpprfanmsyrxnsmhxvebs' WindowName: 'wnmhracgnjkscnrewpccsesvlrxolhcdpnv'
ClassName: 'dkkrihaxjovenvtikxuxnaqro' WindowName: 'paauofbmsbdmcbdkuclztnfyppmaoqmnnlhryv'
ClassName: 'qlcceasacskeolvfylzjiqnjltdkojrle' WindowName: 'jkbttssryuxhtrpswwyrptxucvwhtan'
ClassName: 'krlglvzxdjuaoolbybrgdigddkwko' WindowName: 'bognfcucrqktpayhrfxtnukvtcihtpgq'
ClassName: 'hsfnhvqdjboseeiqil' WindowName: 'xvhjnlawdqngnjvhpgozwjlizpyhcblkrchm'
ClassName: 'xndtqamqdaeoskddhmssphhddsucypznasqee' WindowName: 'fojutocoykbqqhotbryfzykjisppowikmvvgj'
ClassName: 'njxnxehwpehckrwacxrpqxadrczaxrt' WindowName: 'vvhrfrgpfyyntnyhwnupbqeltthfpvgq'
ClassName: 'awvtakzekjhmtuzlnqamffjhyelz' WindowName: 'ppdindjjxjkilldeqs'
ClassName: 'yjtfscsvvuwaxdeopygelwhwsfhbn' WindowName: 'xbtnxzymfwjnsrruyqqqzvpyn'
ClassName: 'htgnygcwbkurxdbatz' WindowName: 'jacwdwoohbwxyujylbecixssdaromyqjshorvkx'
ClassName: 'xfytmdbnvsaevkepzh' WindowName: 'oxwgsaiuqdercdvaqviikkxluxnkcnjz'
ClassName: 'xcysudjcgdkfdemxxtfjnbtukxvnjrqr' WindowName: 'rsjsegicmnevkosmxblabf'
ClassName: 'hqeestphqtruzmzniiflhsnvvopbecb' WindowName: 'ujutjimgwqzizoxqq'
ClassName: 'iccpyrrcslzrzsxtcwgeekxfjjjhwtmorv' WindowName: 'upfbsumfebtdytagkviv'
ClassName: 'inpychwxmujrnfsgrmoi' WindowName: 'dukttgyanzlphvqfnczxsfxhlrpcvycmf'
ClassName: 'rbysliaxyhamnhuwmnnqybilhnveasmpydulu' WindowName: 'zzzbsfioktntqnpfivkjcet'
ClassName: 'ohodteypwrfbojehdsrkntw' WindowName: 'moohlftkokexsoxeffmytzzpwjgl'
ClassName: 'zjijrcqdrwtpuxodhbicilgiqo' WindowName: 'qlyqbvnoscmcehmdrnjcbpjuxyckvzknvky'
ClassName: 'tujattzfqzdyxnfrelufefyw' WindowName: 'qvyoehaegtqkvuczfvlkxlmfgpnatwhgszds'
ClassName: 'zozagmgzaidrogyalt' WindowName: 'yfqajlvchoivvivbqpsyqmtlcknidpcsb'
ClassName: 'ddvhvgxkrodbnzmjpnxezk' WindowName: 'gpkvtuudsmsgpfq'
ClassName: 'hobsayhnvfftfgdsqzltinvt' WindowName: 'eborjacyguzopiy'
ClassName: 'fvffrryodpohpbhzrqr' WindowName: 'itlyjjuweaquhyocmsushczqfcdfxtfevyjxbvl'
ClassName: 'wtdwqmgutdygicyfhnkkjxaldndcvypcnnxp' WindowName: 'zvzxuwsdcuiklrivonfwqbnpss'
ClassName: 'ojgfjbkczqwfcynvghxiiiyzhabiytsbsvvs' WindowName: 'nakvezztbcyhdsuvuimyutjhwtorki'
ClassName: 'rxtniknjicgbfoinggzx' WindowName: 'xbfirsonggcwbmkuphdrrhumixrguuq'
ClassName: 'moajpldpjeseqdehteivfgguxh' WindowName: 'klyinwtwquqzuyqmmnptf'
ClassName: 'yhgpaoqberdzlatfmchp' WindowName: 'scyfyqsgzizdgwckwpzpzdxhuwrtywepzj'
ClassName: 'ossmnknitamvluq' WindowName: 'tvmvzhjstfkyxkuobynbdaxllvbmcyeskvvipkg'