Trojan.StartPage.59294

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsc2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\Math.dll
%TEMP%\nsc2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'jbylwnrgkaetjqvepmfzje' WindowName: 'wctrvyvtczklywepin'
ClassName: 'zclmidzreisbltb' WindowName: 'usfcthhkithgznpvzgsxetibdmgkjdqcjcj'
ClassName: 'agtuisgqjaeubkyvzlmgrjv' WindowName: 'wjzhvdchplfrgzdinp'
ClassName: 'oaduepywjmcktfnrpurbxdbv' WindowName: 'uwvsfspcmoylkrjvcfrrlpi'
ClassName: 'toyjonagojdnjpnvvzimr' WindowName: 'soerxqdzcdheguiqfdhmej'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'cuordeorvsqqiwhsqqbxswxebisdhdo' WindowName: 'bhdrnagscycywsae'
ClassName: 'kmlvmxknnltlkqschz' WindowName: 'exksottybimeevqmupuglsapnmcnabxb'
ClassName: 'dpiwubxwvzkefoaxuwqqxlnkagtvlhenvcoiu' WindowName: 'amqnmotjknkwtfdqmhtgwgluayfsbjumopbprgj'
ClassName: 'afofsomgkrntiekkdumtlijsxzqtspohtyyej' WindowName: 'brnpfudqjflcisdgssc'
ClassName: 'krdixjxtnpskyjeblpnyzieq' WindowName: 'bbpqeofdlehgnrkakxxmiuiuaikq'
ClassName: 'tiirfnzavlacepuy' WindowName: 'xqpaotlbzbqiwoudzwciwpz'
ClassName: 'ifwnowcsdpwkucywtbbplndshqir' WindowName: 'okmqcclhpraajvimyajxlt'
ClassName: 'zgwrdbaivsbmutmlb' WindowName: 'qlooizkwaarjyzvzeztzoicvm'
ClassName: 'lmkdgzdkgdteahixfejtjvnrmrydlyv' WindowName: 'aznspqlslaiwwomowyopo'
ClassName: 'cviakopeaisgychcblz' WindowName: 'yihtndbrberbrtgrsdfzamabv'
ClassName: 'ergvgccwmetvxlyqsesrjhh' WindowName: 'kruxltjncoukwutrhksq'
ClassName: 'exmzcqhpbfuuejpikywjprugpqvauxm' WindowName: 'ropwrflaungvrtb'
ClassName: 'xknamkoucvhgpcvwnnztbm' WindowName: 'hxllyzuktksguqosoozbbhwlrvlftrwoehqfwb'
ClassName: 'hmrcqupsimwdveqr' WindowName: 'zjiikmvbikqebmvsoqyexspfwlzubgrz'
ClassName: 'igzkiuwghegijbjnuwascpfjd' WindowName: 'phageoliqqhecdqlbyb'
ClassName: 'sgotqjbsvweddbduuwtkk' WindowName: 'wgfcualimbypcpgbzxdbafyzofkrls'
ClassName: 'sivpwiggpaomkopbym' WindowName: 'egbwmtgmavlsscfsmp'
ClassName: 'lyyxzpwlwaefmqiq' WindowName: 'smrqsgcgyaytpcvhhajgaxzbbivdym'
ClassName: 'yfvnpftwkzqtneukjfhgo' WindowName: 'ctyrfjhkpzuwjkupnlsqqsvaplzbsmuctpkavw'
ClassName: 'fwrtlfrxowekcpm' WindowName: 'efxifqsjjgzrivdfamdhtmyfbpnerkepne'
ClassName: 'rxrenbmvgtrtdmawdfenou' WindowName: 'jhobhqrqchrbkeqfzwklprhmy'
ClassName: 'gfkezzvvlrokzzedcoarkcxodrfah' WindowName: 'lhdalsoxdqpbhjhmh'
ClassName: 'snseizuechrtmtiyftesckqcf' WindowName: 'djcopvzsryeupxgtydoppn'
ClassName: 'fggxvqnnljjadvziodrsmdzjonzhgqsxbhvef' WindowName: 'ekkaedwhrgwjgsnbpulfwoohseidxealmptriei'
ClassName: 'rglafzzbniimlgw' WindowName: 'hvplpdzhmlmegxghp'
ClassName: 'yscwlvmeenzvkkypecsninmscgr' WindowName: 'mkjiddljbvelnswgvqgthnoycmff'
ClassName: 'aolfwekezsjieprdxhfnbnufrsxyht' WindowName: 'aahslswsxdpchoykpfvckfvgzqkqebwsejp'
ClassName: 'wiybmtlwddxpwkwmbnfiyhwte' WindowName: 'zfmxnnvtaycoewhzjwwiu'
ClassName: 'baibooslhniapnikaynfkjvaqujsnjsrlky' WindowName: 'idvcumxsjmwrnmwpwfebqdzrttromcaxvdjtbpn'
ClassName: 'lzgkifpdztqgewvvidbmjotynizab' WindowName: 'msxtitvrapuokuttdn'
ClassName: 'cefxxshkncdmmzehoxikrfhmraalwdbadhogxj' WindowName: 'oqbboomkgnqepolxtnevdcgmbjuzgc'
ClassName: 'jktascbaciswmwsxomh' WindowName: 'yedfgvlkbnfbjscahurhw'
ClassName: 'hekolupelyzowjlelhnvqjfahtvy' WindowName: 'mikljkaqokclkddeijozmcaichiwxgfcuubx'
ClassName: 'nfafprwkcvhymeh' WindowName: 'awjbcrbbsxzitmj'
ClassName: 'uqlvacosuztfjnxkqgxi' WindowName: 'dznvntxxxhknyqhpuqiedvmqscack'
ClassName: 'pdlfdcfeijebbiowqjwmxkkcafcknav' WindowName: 'wtqshynqsafrctjgtvtzvvtbrpcrluljaxnfwc'
ClassName: 'crmfyfluukcmlkccmwcvjiqutyn' WindowName: 'svjwagxkwtiyfoxsvokkdochsxwv'
ClassName: 'eujvfuhrrqqdknzdug' WindowName: 'uxxrqytfjruduciw'
ClassName: 'bqkyzqgpsxjsupczd' WindowName: 'tcfewylyfznsqyy'
ClassName: 'jwbrzpqwxaqpmutefxrcoxecfdixe' WindowName: 'twurfskernmmtgqugszejmxjrmpgzilzywfmdo'
ClassName: 'dsooyzvzfzwbyrkkiydkqpqcpvhcpf' WindowName: 'vrblgnoxcbbegxkfoetnvl'
ClassName: 'flouqxlhhfctxbosdnoccd' WindowName: 'bwkgcpjelrhajqmlmjjeaumlglqibaeoml'