Trojan.StartPage.59336

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsq2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsq2.tmp\System.dll
%TEMP%\nsq2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsq2.tmp\System.dll
%TEMP%\nsq2.tmp\Math.dll
%TEMP%\nsq2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'qwjsigzxtgibynzyiqgacoxfjfepcsfedf' WindowName: 'oppaltkyiqmiqdsxvjizfve'
ClassName: 'nlqeccxiysjvwat' WindowName: 'lodmhoplaweumnnhptcrtnsuoeibqqffnjicb'
ClassName: 'cwbfjzeghgizegrdhdtnuwmyrspen' WindowName: 'iunpwymjqgbacgjrxmfib'
ClassName: 'yssdbiggtalnfpjmoodsqohbfaktycxtuku' WindowName: 'aeqtvbtfeaodtwymp'
ClassName: 'hnzwugdfwnfjswfcdcsekdvmpjlur' WindowName: 'mlhptziijaeedaupelx'
ClassName: 'oagjxmkafeurgeqxnkikdtphk' WindowName: 'aidwwcbutrahmgujuifhkcagio'
ClassName: 'qlqfabqfcywgrtnnh' WindowName: 'bleaxoxbpzzwidigyadhatinowtbkt'
ClassName: 'cyneulxarkffsevxvgrvulhzonguixyjugbr' WindowName: 'rvpbjqxtujcumnnjgptcjcspckbckoetaff'
ClassName: 'ndovzgwwfnwyfbehbrhwmgszjq' WindowName: 'quvcsgvnnciivuvbnjgefssrwulckezeudolpb'
ClassName: 'nmorsdsrnogqeevhvojbvvzwuwwqfrxznsnz' WindowName: 'oqzpieelfbchizgfadsuocpyvzvatruwnrgq'
ClassName: 'gcnumleinzovzowcrnlaoozxzhnfthsqinupyd' WindowName: 'ongzxdbdjszqljvyolzpivlciryvteiwdgq'
ClassName: 'kptldqljqqeociyh' WindowName: 'ggqepqnsomcmmtilsxstofzhmrdlhgnmqytl'
ClassName: 'pqsgxhkuimrqlymspmesffjoxhrshw' WindowName: 'gbgyziverybqywvlankqmzruqossnlojzvgxcrv'
ClassName: 'skzbojhelzrvyjgaj' WindowName: 'xedjkvswilkuiwaflrckrrxv'
ClassName: 'mqfornsrwgxvujzaksplxsphmfgsxtpqetiplz' WindowName: 'hrxopwhglmczmzcr'
ClassName: 'qpgqzrumulienxzbkrduoyy' WindowName: 'urnhijoywtvbfipasvy'
ClassName: 'jtkqumojupymtrhhngqxvewktlmpgf' WindowName: 'gssdhqhmepjinuhjkhzuizpanykmdiavlm'
ClassName: 'zmzmatmbefegokhbxtoemjpdzsbvf' WindowName: 'crzhmvvalfyhbqrnmjpmsdf'
ClassName: 'cbmzgufvgstygjyzaczd' WindowName: 'hhfnwrcnsbkkobtnxc'
ClassName: 'usabjugzghyhhithkzwfjttpbnmavaqhpjy' WindowName: 'krmgrlqgkceoawtysovdgkjs'
ClassName: 'pdxjcbxooxgorbipphpdilxkred' WindowName: 'tmlycvtcvwgaielnri'
ClassName: 'qrnoibkzuyitlsirihwegzwkpb' WindowName: 'zemnrfkcgtfwkmxevkjmkzzvczczmpxhsd'
ClassName: 'tgczjknfvmzoevjteawcmeriwdcvix' WindowName: 'pxkliistqwfhmczhnhxztrbxnfeyfptdy'
ClassName: 'wapuimtueffpwbekcfbldfqoumpeijgg' WindowName: 'qyormfhvhqrhgzfwciabuaqtxkzjcmgvobj'
ClassName: 'rhgmucflwdvgexzrrmjkwrjwsrkstvogbfrkpdm' WindowName: 'hqgtamcxetuodgwwlvkoi'
ClassName: 'hprkebffniuewrwoyp' WindowName: 'qakumxitnykmrkuqvn'
ClassName: 'cbjedefxwnwfpvdkirhpqfqaxwg' WindowName: 'vchasbsvagatwtubtdihkbziwxjhdoutm'
ClassName: 'qpazjihsvveprbbiribuffqtinujhtqh' WindowName: 'vxtgsuebohglgrypsdtlul'
ClassName: 'cmrxnucpqynfczwumgvuyxspasqne' WindowName: 'ndkjtpnjljlvwxoxzvpdx'
ClassName: 'rsvqcywjcstlqycbg' WindowName: 'lrqzroknehfcpycrlocefofapzasnppsg'
ClassName: 'haqllizleqlncxtwvpqywrppo' WindowName: 'ybwlmienssouekytryetqt'
ClassName: 'arwjkgpnplqyymmzbmzz' WindowName: 'qhgavbgovxzcpxvkcqziqhxenmyhfaeqbwczs'
ClassName: 'tuytvzfzdkqfykyytjdjymglhghvfqkmbc' WindowName: 'kvsavivcfbfdrwc'
ClassName: 'xonjmmzgdommktgrewlulixqygdixvknbtocj' WindowName: 'clremumbdalmsfsxq'
ClassName: 'pwrdxlzsfpzkqqrvjwzqcsbhnvzynbxrzews' WindowName: 'yryeltfrjakkjix'
ClassName: 'vkhyzzmlcooylpmpeqsg' WindowName: 'czvbivehgwchbua'
ClassName: 'cxewngxgasteowlapdj' WindowName: 'owmbazuymbohckqvxttmenhtlupxmxqkkrdfnj'
ClassName: 'rimtzoqfudztxadai' WindowName: 'eqgkghucpjhmxzuqb'
ClassName: 'xvclcoppcigycxopx' WindowName: 'pbxeqjacqbezgbfbgoyxpwaw'
ClassName: 'urimgqashlslrgashx' WindowName: 'ysxaigjkfkderbjbqcs'
ClassName: 'vjkblblxpsrwfudojohkisygpljuwkhvsicylv' WindowName: 'cvpesbfqyoomwjrrvfl'
ClassName: 'utnxwekepytafnjtfspcxxsizw' WindowName: 'klykhivccnmulhhruyw'
ClassName: 'rimwtkzoizkfhzfotsezagyxshcwxlinuj' WindowName: 'araynmcxnuutmcqwvfqp'