Trojan.StartPage.59282

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsj2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll
%TEMP%\nsj2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'vnrgabhloocllkzidsdwktd' WindowName: 'jrwbbkyetslbuyipegsvwtaeyflwjpmwdvmz'
ClassName: 'nkqpafwhmnakdgkwpnxibwuavyalparbenlf' WindowName: 'tnconksbmbvtovpnncehkduedbstltffrbunfk'
ClassName: 'ophvajosdcnjohqojrvjsfkytfx' WindowName: 'aqdpvqelzggmlnfyjwyckwdsiokiqddowi'
ClassName: 'jiqvydqhanaahugnfxedlhdfgecaqvenoghu' WindowName: 'zdndrnugazuscriuxwhkjun'
ClassName: 'nonhzullwxrwfhyyxqlqgimkzsknv' WindowName: 'rbgpkxpbzbagzgrkvyvfdumacjzivtjjncobp'
ClassName: 'dfayigxbzroykszkso' WindowName: 'hoihsbhqcsgetnmrdewcwaawcvomxp'
ClassName: 'kehbxxypnovjfoedgtrsqdhutgwndlfhcppwj' WindowName: 'jwzafmwcpqsxegsybyooonikqse'
ClassName: 'fqrbrrcmabcnjkkgwumyvnmousc' WindowName: 'epqugjmjgdhzwytggtuzapqywqnjlpguldmy'
ClassName: 'byidimbsvrwezdifzgmpkbr' WindowName: 'nivrjauwjncfcpuohepur'
ClassName: 'rurneejkfcghbveokojtusmqyt' WindowName: 'xqsbozaxrieyxdovvon'
ClassName: 'odvjfjjotditjqsvcyukyi' WindowName: 'zdjarthdrfbhjqlqqgegubxfbjwkwvyyag'
ClassName: 'ihmeyfmxfllyjacebketvlypp' WindowName: 'qdfurscjkuswzhhncvrsoma'
ClassName: 'enrwbjktydyyfklkw' WindowName: 'oxpljmfzmkdgtmkinubxjhapkaberyvlqdszi'
ClassName: 'qhglwnektckcwqqp' WindowName: 'hcwqtoutbfrvpqlrrmhgvihtfoctkku'
ClassName: 'gjfgmcolluexfnzzirk' WindowName: 'edzcdhpqigbewsp'
ClassName: 'ntgsmafpnpackdlakqlo' WindowName: 'jhwhwjiksycjxmkwuzgrrkbhjsbzj'
ClassName: 'pllhvgqdbhvllqeaurvmqppjpaik' WindowName: 'gzepjysqjnsyrgytrotenbbpkhqgzzpoevc'
ClassName: 'floindzzmompdodplsjwaogwakkofgutov' WindowName: 'lmznlcgnnpsbjcvnqefnmymfwauc'
ClassName: 'qrjbxstvucttkfucavxkzutclfjgriqug' WindowName: 'bvaddcrjnzoupreomookf'
ClassName: 'adzymwvmoxogwhyqxydnwfqgmqla' WindowName: 'mggikpipaimtxzhibsnwgdh'
ClassName: 'qaqnzjlgrhwhpyajbcl' WindowName: 'aytvogvqyckvujsbpsnfvficxiblnvsofrp'
ClassName: 'tfntmbvnjazfenfdopxmwkdbkvkvhivlmof' WindowName: 'usvxomqvslegapypfacssvlnrtjmjdu'
ClassName: 'xypikfdwgzlrjhk' WindowName: 'garltgjpzjpzputskdfc'
ClassName: 'dkqgvtlojqqdwlrkvikpedvrqnxxliwwaf' WindowName: 'icexkeztglnlbtqyxqzdvhwvmoevsdtmfbbwjuz'
ClassName: 'frusvxnhbosiiggacoqspmwzfhgkesnbebzlnn' WindowName: 'flwwhtqovkouigzrvsvizbkxielj'
ClassName: 'yjynkgmpajethewpqfhcgka' WindowName: 'jnljlvahvcqieeueonvlvbyqu'
ClassName: 'djmmrorkwdugmrkwyhe' WindowName: 'ayracalyqrfwfwdurjsn'
ClassName: 'takvvqtsyrtusowasvueasqhlhnyw' WindowName: 'dzpanetzzuowvqcqsaucjsfwayyzej'
ClassName: 'mnhlngttuzqpjyqzuaqbuipwsovcrthyjty' WindowName: 'gltsqehmrpsucjrrvkmzfdoiqmamifrrl'
ClassName: 'nluhlmipwdbydbmncbfagiw' WindowName: 'viqyhsyvgdyyupz'
ClassName: 'lzxeqwccykapjzjyfsfoz' WindowName: 'uwvfeexonxxiqrgbjqijvcjrb'
ClassName: 'ibpdjpwgcfoaesodxxuc' WindowName: 'ilsgqeydoegusuwexrjtaure'
ClassName: 'tkirztbjggghepqehdznkesonm' WindowName: 'taqsvqgomftioxxnoys'
ClassName: 'xpbspwccdopuhmwpmjpkyw' WindowName: 'wgyeyyalabbdwqqmnjawzadwol'
ClassName: 'nxxzhgcqlkcaflppyjkurxpgjhnixpjbazowu' WindowName: 'ykfcvlbcpzaomlzjiimqkvoqo'
ClassName: 'pxooydbclnhvsaccoachhwaeshqfhbwtlig' WindowName: 'grflyrdllwuxyeqdecjajijddsv'
ClassName: 'pnysqgutztokwpoefwibudhhgbdgkrdqdqm' WindowName: 'ftfzkwbqlamjsksoqzpymraktyoe'
ClassName: 'fbxgjpgspbcynfqowocmlxanqhiu' WindowName: 'kfagzbosputrpfkqnhlobxhihucvncsbi'
ClassName: 'yelnccujeekxservaobmie' WindowName: 'qfnupndgkxxdcmvzfcwwdcjpafbfwghfvdtqi'
ClassName: 'npbvlnhyygdzjdd' WindowName: 'kwadgmzojtczugzxndwmvgxme'
ClassName: 'clgtnozaqkgfomodjnfyintn' WindowName: 'kyxyhcbrxlgcmnmzww'
ClassName: 'kxcuguihnssplmuxqyrrtphkwu' WindowName: 'bkiwdmyvolxunfqvxnmaxsgdytygpnkauy'
ClassName: 'nyzeartcbrcfpzqstchnhgleliba' WindowName: 'jfkwwbrffxxnijvacl'
ClassName: 'iztylrksfhvuajbtmaitrrhpbbntvcxmrqiddb' WindowName: 'xbodokcesubsmsbcimsbupbghxanwcff'
ClassName: 'aviyypcehnjbdkqvfhnjcqt' WindowName: 'wnaeqcaxjcehubpjxqwx'
ClassName: 'vzvbybulbnkfzpbjo' WindowName: 'najdrxvgawcrfdzsdcnwdimxgbnc'
ClassName: 'tkfiuvvbtidynoteuwxurzrqf' WindowName: 'rpjwhwfgkemyrlaryyhpld'
ClassName: 'hdopqjbuizihfrjaqz' WindowName: 'lwbikvrnidpkzvtwnv'