Trojan.StartPage.57934

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsp2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsp2.tmp\System.dll
%TEMP%\nsp2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsp2.tmp\System.dll
%TEMP%\nsp2.tmp\Math.dll
%TEMP%\nsp2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'soounburdrppqizzccbaajvvgiziaiezpcu' WindowName: 'ttellbzviwgctynjnxmtgvyoiasi'
ClassName: 'hvagknxjewepuqrdizhctxnrxanlnozpdpmnc' WindowName: 'sdtgqbobwxtbcetfjxlyrweirdunftinwrdo'
ClassName: 'nqjwxkbzvmsgcuiuvoznhnbydzmdk' WindowName: 'pasarnwfgcsgdagqxetnykysmkeaeaipjlzn'
ClassName: 'tgbofnqqtdycqpaozbxgrbopmjzsxykgwt' WindowName: 'gonsnutndfobkvjfdnksnfyskyxcdtptcycfoq'
ClassName: 'qjpzcykftpewnqyx' WindowName: 'eojlttkqoghdvrhglbrnjdhqee'
ClassName: 'uedycmeovofaguacxq' WindowName: 'gineazwiftahclbftrizyi'
ClassName: 'gnabtqxllpseiaggqdplwepzmvllvqu' WindowName: 'knkjxmfueasxpzvqvxsjywbhyqxnvv'
ClassName: 'mpchwwztelpjzfc' WindowName: 'znccnytlicgxczkecexmszzxyfwnipndnebkp'
ClassName: 'btdwhxdvmjcqxphvduzjqpuwcicflc' WindowName: 'qoyewkfbviulecvnmraogjjgavcstcis'
ClassName: 'zeorodlzskcmgxhqcjrtvqbknkulbnp' WindowName: 'fshpoynqyqplwrflgzsxgupmggmdcpapem'
ClassName: 'sexkngpiqsvdsubtphdhxtmabqvrfhpjcyseiko' WindowName: 'ghoecsrsswausjwzphdoxxegvgzsshswe'
ClassName: 'sooukdkjugccyxchgrj' WindowName: 'uhtriufjghpbvoqoabbf'
ClassName: 'rmsamlxldtwaqqtrxblpyemqrp' WindowName: 'dyphyrotkkfyqgoyl'
ClassName: 'kceycwvotlnntjvhdjfbs' WindowName: 'eagwtotctloxldgzrudvvehevdtfzbbqchu'
ClassName: 'pcnqsmqpdmfyubokjwjqnyhzzsevty' WindowName: 'tyslqpjmzodizicm'
ClassName: 'glxifgkdthssaemdmxahlnyspjmekkvy' WindowName: 'cdztftdotnzoitnjicdldbs'
ClassName: 'qemikecetntxpzeofanwypglywsnxkxly' WindowName: 'jfdarqlrrvitmhlrzsmkcgtwhvfzgb'
ClassName: 'tfhyabpqitizdyifobvrkssldccwrpszgj' WindowName: 'pxqlynuppuupnikbdtbbcjl'
ClassName: 'kzqzewlkdqbemzbutrpiievegmzggulxz' WindowName: 'fjxerannchszxlpbz'
ClassName: 'wzelniococmxachuvsogaqeqdqfivzznarhlfqc' WindowName: 'dyiuzzkkdoknixdjiwkhshmtliprepzinakp'
ClassName: 'przjjcqjzjionlzyjqkcffjpxmymnkvpctbk' WindowName: 'ycwatrfsohpcktc'
ClassName: 'jtkfaolfdkyhdxhxgfdgmuvvtuaoir' WindowName: 'vasildqxcohvoosxby'
ClassName: 'tndusidynwgbjggiuhpqocqtfteei' WindowName: 'jfsbclltdulsgnslgosyghnuosnvspscyumf'
ClassName: 'slifplachxzuvnusrah' WindowName: 'zewjgxzusturqkbgtwtzccia'
ClassName: 'tyijhshfaphdqfmqim' WindowName: 'lalnknwlokrvnwjcai'
ClassName: 'lqotasabwlbafrwmgigyxopdnrglawhi' WindowName: 'gpzerufafwoclorde'
ClassName: 'jcinckikuksvhdfsggzwtx' WindowName: 'unnolxpnogithlqvwzvnnlbxfujkrikz'
ClassName: 'bwgcjlrbvfvhpxdaqnioatywslygbxlrzwrea' WindowName: 'aeihobvhffoysxlkimmjegyhabjmrtbxqj'
ClassName: 'xnbnwpivojvsjlrkcecxmiqxlhdllwejflpr' WindowName: 'wrjnsefopkqtsmjmoohldwwbhafjnhavnm'
ClassName: 'kxzaoubvimegkxaramuzwykwsesmqkyuirpsg' WindowName: 'bikhlrgxmsdflpfxvfbzdgvcrcmjpil'
ClassName: 'obmmooasriuuzulvrydxpfduvwellqlvko' WindowName: 'ygknohtbnrugorgstrvfjitgjiuiexzck'
ClassName: 'hqfzbyjzjjrotptixbrai' WindowName: 'lowtqqgmnbagztjlkdruqqwghwzitjggjstlgz'
ClassName: 'egovkxwtxuypptyptwmc' WindowName: 'xvbcnuehnqedbkwxyeybvqivlm'
ClassName: 'olimoztfugyrnvifiijonexbnxdbdbjcfcy' WindowName: 'mzwfsyyugmlgpjnbbl'
ClassName: 'veanvrqnrrlomekmcpbyieydknuyztixskxachi' WindowName: 'isoimzqyoandbgcltlemphti'
ClassName: 'xjgxgjjxerxooedw' WindowName: 'umubovnlfintwxtcmlpacyfne'
ClassName: 'wehuycmgwfemufmkxpthlwlpbuktzkqr' WindowName: 'cmxmmpdsivlfzjgbhuockyioscfo'
ClassName: 'uxavtefreejetnuv' WindowName: 'mehnlnxbapbljrwwzgssqccts'
ClassName: 'ppohgyacbtssnpdlfhzbkqypihewftmlum' WindowName: 'ftbbapdufzeyggmyfrxctfj'
ClassName: 'ktzuletburqbmngwglbmacxrngas' WindowName: 'clukfesbkaeiprjukkrwxieqercygyacguquubw'
ClassName: 'bszskxjekwksrkwufismwpbnnwequjhbhyit' WindowName: 'ckiuizpdatbtnduwzkuwtvluqkyfggk'
ClassName: 'vmvwqfhyydwpkgtiuqlcjp' WindowName: 'pivdlxvkdyhvrpebtoikzxdqjr'
ClassName: 'uknnfqxiqmnxsncujksc' WindowName: 'zqzyyqjutyebumsslc'
ClassName: 'klprhwespxuenehuzsempaiyxrlnabbhcchmbqk' WindowName: 'luyrvaltnixlecsvlnotpkesmpuljjtjabcqt'
ClassName: 'wzhxsstbytnskhqsodegcsdfzhjrkoszxkyq' WindowName: 'pgdtcfbskvcayormyacxmjaktmcsi'
ClassName: 'esngvebhllrxpnoneycthmkswdynvqwjcjsftt' WindowName: 'insckaofhjrdiqluj'
ClassName: 'ayoiwjngedkkonakqbdyxfiewiubiwocc' WindowName: 'aimiqfsvcbakkrpbpviph'
ClassName: 'ylnpevyxsnekeafvjgubwy' WindowName: 'rsneyypgnkhrmakvovbqeeoaaystmy'