Trojan.StartPage.59168

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsr2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\Math.dll
%TEMP%\nsr2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'sbfcbklwigecxlijzqgfvzhpfpzjtbg' WindowName: 'vvgatqczjjsduixekvzoiduiipujzfsgp'
ClassName: 'lnwcqekpebkryqjihriwxzzjmq' WindowName: 'feheepdrnlbvysk'
ClassName: 'reyrsbqtdjtgykwcz' WindowName: 'vtwservhccosclehcoeeanrscsuhto'
ClassName: 'cowymginmlghgnjiuqz' WindowName: 'ageusiqbyntmaoladdbagjpdguuilaiilosqocs'
ClassName: 'bywketbiyrhpskacfkcbbqxnid' WindowName: 'uaavptngrorslodumhmofrfgakrhr'
ClassName: 'grakkywozyunusiunnoitw' WindowName: 'qwfabbhftogqokyaupsfkjfhvaehkji'
ClassName: 'eifqnpcngltukoycwxkbm' WindowName: 'ygryifmhwjdkwayblkugwzretqfyeo'
ClassName: 'wbdjskqiohghmvar' WindowName: 'qaycdnifjjxknfsfnlyquidjwhrhpahnbw'
ClassName: 'nymvrqnzihtpuqjjermmvnfdvovqnngxthxhmjo' WindowName: 'igesbuorgraonbkfsofkazovrjimxcpzohse'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'lpjryvdfakfuzhehlfqgtwfkuycbptorlykt' WindowName: 'ktqfqkchfpilotusvhlltqwxnkcrgxdrzfpffv'
ClassName: 'lduxtqznhgoubpiahhevspoztd' WindowName: 'qsmydowmaudezjpckg'
ClassName: 'epxxzsnwhziwujxklc' WindowName: 'qdynzgdpqpahlexreth'
ClassName: 'rvgeydkykqmpsssbwbp' WindowName: 'lcqgkttalwbxympkxdqztnazqbrkdmzg'
ClassName: 'syouvhyvziyvhshwftptx' WindowName: 'imowcvqyfrrjdzsnyrmmybmpnkjb'
ClassName: 'utmtpwxhdnfoymmddgamcnyxabxoiukugvx' WindowName: 'xgcrpzndatzhdbbeezrgwotvusx'
ClassName: 'khmkvqpmzwhqzkntglltmxngrty' WindowName: 'cejgahvwtiirsgbpvqyu'
ClassName: 'ollwyobuddkiofotbcqnxjiefdzfvwxaodmv' WindowName: 'axeihbbyiikxsaf'
ClassName: 'szsfkfqfrugotvwfwwa' WindowName: 'doaupdwamefprugrkdnwihe'
ClassName: 'ddlznrngpwtcrnewoqhlocnuxgqnegst' WindowName: 'dyvrcmsrmsedjivcbajinc'
ClassName: 'zzivonijrbaozegyuaktvpeekpxdirnvlay' WindowName: 'ziwvwspimacobuqpmvmi'
ClassName: 'qszxxjfhfsjrvijxpbdu' WindowName: 'pqalpmnqedxbalxlosfpdhltxseavzkbc'
ClassName: 'yazoszfrqscvpbdadog' WindowName: 'osilvneuuatroplro'
ClassName: 'mkzwvtkmjqhdaevcvlwxfx' WindowName: 'zzwvrgugmekaztfd'
ClassName: 'qlzspbuhagndndvrzoqtipgmigpxsoqyr' WindowName: 'jxmqgnbnpmfstsfp'
ClassName: 'nmzvhikiecgmxwlxgsfo' WindowName: 'ymneoxmohcewueoej'
ClassName: 'ruyirxgpaisdujqibnlsaky' WindowName: 'nadygkjnmmrgxilxtdnltmjrhzuzpcjsp'
ClassName: 'yktpnftlcyrozvdt' WindowName: 'bmgmhhlvtwsxnggoqkxor'
ClassName: 'drshgedkyjrgzryeydxdvbapwtcgfebspcsz' WindowName: 'lfpanapdehnlpvkpaypbauer'
ClassName: 'bmgmkgwkefycheudt' WindowName: 'ycedbjfuqtqjrqnonbcpvjvjclfjufsgglch'
ClassName: 'svcuylpybnmjxojlwrmmuzcsbvyh' WindowName: 'yrwfxpncqigyndjxovyzs'
ClassName: 'muxtfplwygzeavnfyrrjaykjdqlkqepmbpcb' WindowName: 'zmewgwilagzdwvw'
ClassName: 'wfmjgidjiectqoovlkgebfxhyztqazg' WindowName: 'aqqsstkqjwfjewaog'
ClassName: 'xvnvyhexsgjjwowhadhrmytd' WindowName: 'jfaeinsgdlpypicw'
ClassName: 'zannbpciisfelqznnbffsbnmmc' WindowName: 'juuhofnddnipwqgoozp'
ClassName: 'cwiytvfpuoltyqaujtluouspjpofndfcmfpy' WindowName: 'qfteqcokwpsjxurg'
ClassName: 'plwfvwgosquesxhpkzcshitgya' WindowName: 'ejelxzvhdzzywpgdcypslwvvhsjsveqh'
ClassName: 'hsojskdzrqzcwcdtoxfbinin' WindowName: 'vfahsutrpxsiqtrjdbdsqhwrgbg'
ClassName: 'uuqdjekccnrfbynxmapvd' WindowName: 'lwmjdxzwcfjtdeqqeds'
ClassName: 'lrzkthhptncgazlknlbcv' WindowName: 'rwcepmypbtylexgdleykpmmbqezkqfbbypwqmso'
ClassName: 'idgwfedcmgutdxdvnqfvbpw' WindowName: 'ewfxcjvljklpkenxxjyhfxsgcnlnc'
ClassName: 'vorficbooaueieuofflvfdd' WindowName: 'mbhhqdtlistkqckftnqexdapngxgz'
ClassName: 'khfdjcpzvoacebnhsnxqhyvijtpdizdwewr' WindowName: 'zcscmhrdxsfuvrfigodphquocoanifmwm'
ClassName: 'yovbeihakyehqajqzcaglsl' WindowName: 'qrlbgosoccwwebzrlmslqcvtufj'
ClassName: 'kpspcfgnyacfweugwumgfvrovmb' WindowName: 'mefrjwouebzhjcfmtpp'
ClassName: 'lqhglwxmriensabrsajslktglngwqwrptr' WindowName: 'zzhtaczjcpymbaqjnxqttuqpgnldhgqw'