Trojan.StartPage.59248

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsr2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\Math.dll
%TEMP%\nsr2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'fpxbhtqwmqhhresnwn' WindowName: 'ohylkmyyzibehkewywfunfrtdxlasheuyahld'
ClassName: 'emtbywrmbibkarovfmimszeyzanho' WindowName: 'etvjqyvlltmvhnnqojnmdyacrulayxxsmnv'
ClassName: 'kedglgmankuknyqdbnpgsywtltcagoynwkebqm' WindowName: 'nacpxwsldimmztkox'
ClassName: 'lctjzvtvpzknfqhtndl' WindowName: 'rdylykqnacyormvitenvnaenlw'
ClassName: 'fcwsgrhlycdyzqswqkleltpyvmuiy' WindowName: 'rjmozobloknhirjruxbsqzaaltcsbkpxnqsrc'
ClassName: 'hvnnqmppihgxjuchfkowidndwfkijyx' WindowName: 'gtenzvimsfpsnrtzuoarpzigncfxpqig'
ClassName: 'ezmfckbnuheclud' WindowName: 'rdlqilzikkwiwtrawrijdxakqbmiawmzjfvqx'
ClassName: 'untyrgnkyulsscpgvjgxjrosygssijacqfarcna' WindowName: 'phqbezxozigrzgpnuqabqgp'
ClassName: 'iwieuvolcycnaasm' WindowName: 'ykhylncoxbpdamhtldiycmsuzmrpsarw'
ClassName: 'odanzejaafrknchjauvuioehf' WindowName: 'qdqmhglowrsxcqoykcwocmce'
ClassName: 'pvbzypmnzolzymqywxbu' WindowName: 'iouhuberwpxduxrdsgcsuqphzhcnyt'
ClassName: 'xsmjyozccqhgrqbjpevboqiey' WindowName: 'rntyualsotyqrfennshgfwhdkdhhmwhzcuy'
ClassName: 'rxirjubwoywtnoa' WindowName: 'motgneljpubzdhyoyujxeiecrzu'
ClassName: 'acqmfhfgkuwdxfwgmg' WindowName: 'ejihpukhpykaywzujsmgwncwciydgeftyj'
ClassName: 'hlteqwrfrywygvfrnisduhckscmzrapm' WindowName: 'spymrbndlvhbumor'
ClassName: 'khwdjpzrypcnpxanwth' WindowName: 'jcgvitdujdazsqnqjamirxvogqq'
ClassName: 'sahnyxidnohikalkrgqyahwwmiouifqmgkjddq' WindowName: 'pbefrzfvcwnjntdcwi'
ClassName: 'xgwmosjhukwzpcwhfmp' WindowName: 'jvaqtzexxfozmfrhy'
ClassName: 'vhftpkjxipsbzabvk' WindowName: 'bxfthxxwlofyjtblyeydzomldq'
ClassName: 'qbvmmyzngakgjuovmwvqrjujdxzepm' WindowName: 'fuwtfakylejtwuwzgoph'
ClassName: 'emdqcehzvzjgkxb' WindowName: 'jxnrtjbuisebswoeevuameuovfxlafkip'
ClassName: 'uigciyvzmxfjfojrvwgigua' WindowName: 'sypewtdssdnqwqfnm'
ClassName: 'isbwnwhpfbzcumtjirlpjbd' WindowName: 'ynogtmkvtrubkibuasof'
ClassName: 'bonsvqdfbulwulyahfukpgu' WindowName: 'qhmyzuehnxiowdkhvqst'
ClassName: 'bazertpbrkymikwcrfcxigargpmbjwife' WindowName: 'tplpeyunbmkdgjryclopgy'
ClassName: 'ezqskkthhoobvfyfxzuxwhlctyhnib' WindowName: 'sefqdnxzhzsqzrinezdugcsxxgncorfsmonuq'
ClassName: 'biekntqqusapzfiytecgyxvpqfprjspanufyjzq' WindowName: 'xmsflbydbpbeurnwppjljoilggtdmvvcjax'
ClassName: 'nggxbftdtdmzxrfsuibklbiz' WindowName: 'pyauuxonwslchfkwutjbxzinplzsobrrxxfer'
ClassName: 'hfmhokxcprkiska' WindowName: 'elwpynnmgtbmtchcwrevdrximilrsk'
ClassName: 'owjqdirwkculsqmsuxegehg' WindowName: 'kzshwkajqgreqderku'
ClassName: 'jbrlqpukcykihuefnjpmzgmbjwomzctdu' WindowName: 'mvmufcqbiotmzotjefqzgwivmzxdbkpghjwg'
ClassName: 'fhdtfjsdrvqaioubkuluhiwzsiyekapbljwehsj' WindowName: 'uvftcfkhltbpsdnzkgnzcqetgaaytbrledaw'
ClassName: 'vsbqqsmhktkupbfji' WindowName: 'fxwpalvpnxsjdnjtdkjyxuaphuffiwwhbpkn'
ClassName: 'ahaxttssffqxcnruvrfbric' WindowName: 'cjkdxmnvxhzvbgstxrniqnjh'
ClassName: 'akulqwgmlgipgpa' WindowName: 'wksghgghihfhfnqkajzrckslysnydlymsuh'
ClassName: 'hlzqugfxyxudkxsswwsjssjgo' WindowName: 'yrbrwbyhnxuzteyxooqi'
ClassName: 'wyijxdamlukkpqbsepnvi' WindowName: 'sxngaigmoinfxdx'
ClassName: 'qkoudddmzzxfkgisqxqb' WindowName: 'yoaukvqlltgodpj'
ClassName: 'vgpajvtbvftdsvvcciumsklbllowngsonvi' WindowName: 'alkepljtdguxxvq'
ClassName: 'efldhgfdwzmnyivnpnebykiequpoikpjvxd' WindowName: 'hrhiquqivrpybiofmwtxqkhqf'
ClassName: 'vzdpmwnctzlddufxnjavkktz' WindowName: 'jzlwwfvmaknzgktsxhqc'
ClassName: 'umoutxkincillajrrmkfy' WindowName: 'mgdbjdxuxjyyolauiml'
ClassName: 'ebonedadgsjzidss' WindowName: 'ecthufbnlisxdhkoyjrplitsmzyozxz'
ClassName: 'pqybeodvpfvrcsogzczfkoltzixbmwczibikf' WindowName: 'ebmavemgukrwcewsqtdcmojdkqegpvagabtjxqy'
ClassName: 'jjkuutzdnutugkmwzabygwwyfzfgheq' WindowName: 'aomcbldygivgclqnagnquqqybvblvzgsns'
ClassName: 'wjxzijetcsateodipdaxaqlatlnxpnvhaajouoy' WindowName: 'ucnrjwdlgxgxxnnijjnysryusvegyedgroiu'
ClassName: 'ryvxzyjcwsgggcyrxh' WindowName: 'jsatdstwiayvieejhqoqgqgbczkyhiit'
ClassName: 'fpdvvyztilamcbabjvxwju' WindowName: 'bpwkotgyhhyogtdthaecs'
ClassName: 'pnudjvmhvncbkktlenuzbvqupmmbnyahjbbu' WindowName: 'cfygvlivorvdamlbejsvyutaxcigr'
ClassName: 'tfwjictqsrfqahrwvggkdjiqgqnxh' WindowName: 'nimufzwxexmyddcuxzsrlavurbfqrbdfqcs'
ClassName: 'lsdlfrxffoodfbqmokcrvs' WindowName: 'wvzonnmsyiyaqnqgdmsdjdfoj'