Trojan.StartPage.60461

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsj2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll
%TEMP%\nsj2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'gkjdihthznxviqfeigmc' WindowName: 'roqticcyuhpenuacdujvgxvsmadifm'
ClassName: 'mortjutqlfahsokfqbwhhsvjbix' WindowName: 'utyvgmzrzfcxzjraowyabioukfaqrpndjjaeru'
ClassName: 'giwxaizvsjtgfabmmnfmtzvmeexmbbhqzn' WindowName: 'xcownouamfktwgx'
ClassName: 'xswfvspuifzdhuiskwppnelf' WindowName: 'hxnxtnishutnedwxepvxrxfkzdt'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'mdihgznnygpdnhxu' WindowName: 'szdxhqybkaysoxpv'
ClassName: 'wtixzwmijxtfajbcrmpsc' WindowName: 'azkpemioskjpfcffifkfsbcwsyiaifyvpqt'
ClassName: 'kbpbpgrgzyppbgmiorgrhlsxwcyjaojlv' WindowName: 'zovveknvcdbdmaamytuizeneqsvblzgwpfbtzl'
ClassName: 'xcinwvanyahrlukxey' WindowName: 'jyufofmpjuhxxrlrgjtjdva'
ClassName: 'ybpoxpbxkbhoqqxueddgtqp' WindowName: 'nmppwdshebjewzlzgaodxwho'
ClassName: 'mudsjetzacynmnagefhjawxug' WindowName: 'ncqhxkjnqguheluiizwaqndeb'
ClassName: 'amuyuckbhawlffr' WindowName: 'kospdwpfjpvsqvjivgsbueivwacqiw'
ClassName: 'mifjtwnfqimcdvymhlslhawrzhcoxwfucfq' WindowName: 'twdpokpdpcpdrdpmotj'
ClassName: 'rsiopmafirgcxcrgfvrncsqqzilzay' WindowName: 'asdycbastdzzdagprjcckfpbygzlbn'
ClassName: 'ltxbhhmticbpkobafwbflbzzi' WindowName: 'pqgwhcuoooqznoucoyyfng'
ClassName: 'celarzmqhbtimuwcgbzoo' WindowName: 'landbgpxpkbfoekqygodj'
ClassName: 'zkkquzbyxdkytzwuwaholwnbccynkr' WindowName: 'rizhyhqzkcbqvffkhxcd'
ClassName: 'mfhxxmbvvylwyawf' WindowName: 'ybfixwpysjddorarjwnuasesqnjhynynzrfxuq'
ClassName: 'rgjvddajkfmdyxnydzcfe' WindowName: 'franooptackyecfhrx'
ClassName: 'fglojlgdxypkbrpibvuagsxunwywmf' WindowName: 'dzimwqluhgxemjjnifh'
ClassName: 'rznhhnytvmdrkvhgwalqmztnrogptpmrbrd' WindowName: 'wjdbhurwkzedansup'
ClassName: 'evbjkgxrcaovgtocpk' WindowName: 'jmbusfelekloppizeuvmywtcauceysxybpuo'
ClassName: 'utuppylwdrodlkzsmmockoyym' WindowName: 'mdhtllixgxyvxazmmy'
ClassName: 'eqbqfujmxjawnypvolhxfa' WindowName: 'zocvtphyztdymknmzspalot'
ClassName: 'sbyxpszryapazjirxzrsrdeabr' WindowName: 'cnwphkzwwcrikhsopxuhpmednyaub'
ClassName: 'mqzqxkkkidmiepumeqexfoyczvuakubkv' WindowName: 'qvclqrpchbqajmoumkovzvmaw'
ClassName: 'aikrwmkqfpqowciljryfndndzdkatxruwcasq' WindowName: 'lbadmrblbzrnltvdixhvfxnqhcmwlvxyib'
ClassName: 'xvevtqgtwtioyowaxrlyxyzddfc' WindowName: 'ogtlnhayzeexhncwdjfczcmcajmnjggdvs'
ClassName: 'yeuiqcadeiacksupekqcqsezdngtzunqmms' WindowName: 'apyvzxmvlpbvyshapodnalfyzgmlyuy'
ClassName: 'nmojeqwiaowajoiicuithmgejbpyo' WindowName: 'rxijkdsdxyexhotafckqfrykjp'
ClassName: 'lqsgsliochcqpaunosfxhwuuolmbeuevrui' WindowName: 'jegmfxkrcldvfwwrijzlvtjrdm'
ClassName: 'ezukrjhyyzsafxyfpmcxzcjzjxeyppqhjscplrs' WindowName: 'fmzwriubfpmndxlsxpkxggecnretgohsspqobe'
ClassName: 'qugqogahipfeilujmcoizbvphxym' WindowName: 'nijwzifwlapmiviornmvnggsztb'
ClassName: 'oohtzkedfzmqegl' WindowName: 'ylnmhryjfwiyfflsqcygxbhenpzdwan'
ClassName: 'srxrzrgqamktcotvmoeftzsisxq' WindowName: 'mlionepazdlwgqqilfww'
ClassName: 'tfgjmrefccssskoyatsbwycmklgub' WindowName: 'xvzpvflcmllyxpxmgatmlfifyjmfgfqpgne'
ClassName: 'tsgylhqnytpbbdcxeatpmkmp' WindowName: 'zrultigasmomiqbbgdtjqkizcyvsqmguryi'
ClassName: 'wtjnzeujqszgmdwlekfowopulmbpaoqvv' WindowName: 'lcfzmwajnbhdjhayelj'
ClassName: 'wzkllwthodnyyupxfejzevaaaagt' WindowName: 'gawciihrhlqwepstxllfrovo'
ClassName: 'unottukumdacawarlosbrlffknbc' WindowName: 'uygyohrwdqmrsuuazvgrubdnirphd'
ClassName: 'vnmurjseapnjcrrcyhixswjytjhjpdqnjbr' WindowName: 'lwcrninovnxlofwie'
ClassName: 'cpdcqspcrequqafgsmcblf' WindowName: 'adimntqxshqhgvirntqkqw'
ClassName: 'paxvkkrjbqzxziofltqhietwhvxwpr' WindowName: 'nzebdfxhysustfvkmtfgckvphckjufll'
ClassName: 'bhdsillvznmwmsxrjqjwgvspk' WindowName: 'zwebwaovgeyoluzgz'
ClassName: 'azegurslsbcjldaaqbyp' WindowName: 'bwlsqrmfyyqkdcapergysnaylob'
ClassName: 'hlmtrbzjetdfihcytcqi' WindowName: 'bumtdesjwuwygfoqcqoipox'