Trojan.StartPage.59399

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsh2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsh2.tmp\System.dll
%TEMP%\nsh2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsh2.tmp\System.dll
%TEMP%\nsh2.tmp\Math.dll
%TEMP%\nsh2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'lqwewqchnqkzwvlfpmsieqh' WindowName: 'bljdhblytpzjjqdayauzbw'
ClassName: 'bmaaatrrckmsszekhotbeolbyxrkhvcsk' WindowName: 'akfxufolmxhbzuyqdcflcjtqndpcozuxfynnwn'
ClassName: 'lsofoiwuymzljeuktvplufbkiygofmvwjyot' WindowName: 'fumfkyioqsihidahbyuu'
ClassName: 'utymdqsjzbcgpabzgcttbgbtrvptwwnemkyhyy' WindowName: 'balqphpgcpgocavbvfaborcsfszhbxja'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'dtzkamrwkdtvuirxqnry' WindowName: 'izlutlczceoqfgmwnu'
ClassName: 'tmivvlnugapmnraldsyxtctfkzyyke' WindowName: 'esnlhmrvhigfyjuttmugnzrqekzod'
ClassName: 'ssagxryufcyjpuzpuocxosbedzqdrviipklsph' WindowName: 'xwzhshbdzfbzzpoqiwkdktpcpzgxkn'
ClassName: 'xtczagnakevdkdlimemzkdqbsovcdlzksczmih' WindowName: 'tgxwaddofayksmtepmjvioqtjfd'
ClassName: 'lhtxxtltlwwarnownqetsfqpanrrfrmix' WindowName: 'eccynhqwwjdxdwzczvruihfnwn'
ClassName: 'qqeyokezjsyrwwnhfzpusdstaxphekymfxkvv' WindowName: 'wakpqjljpszjmovugsxldwccetezbrhwqxerszt'
ClassName: 'tdwflddocowxgyfjt' WindowName: 'bsgmnhigkzvdeuhwtxiltcilct'
ClassName: 'zxvoblyrogxuygnbcovtgy' WindowName: 'isfpdmvehvlwrwwqmnqddkxoysw'
ClassName: 'iloufhbsoqhxkvxseqa' WindowName: 'isovbgysalokpzxlaguibetlqqlyp'
ClassName: 'suyjbcdwqtssdzmyetmpauyhezhcwlkrhwu' WindowName: 'vnfdvbqzpdtbniwnqgctkfmhrizaurtkc'
ClassName: 'nexzyurvtkkqcroebys' WindowName: 'aoteaztwzwmoloekv'
ClassName: 'tumraazvvechsrcwzwawvxczeum' WindowName: 'buqgkmrwpiturtiorpttloqfzvrtnrlrwmue'
ClassName: 'xmmrcrggnilvmmtqfiqgfebjt' WindowName: 'zivabrmxrpioikdgvyixkktuyutf'
ClassName: 'apfnfmwxhxqscjexwzoefvjsavbbjegnn' WindowName: 'tavxquibakjrlbac'
ClassName: 'axgahglrkkbdrkqtxpbmickm' WindowName: 'tuxuqtyndwrgewhtn'
ClassName: 'acnulyaulrkhdanvfxlpbbwonsfuanend' WindowName: 'qzesxdwqqvjefgpkkdcofsutjfivknpjpdi'
ClassName: 'jfclfuglmjyfevdvereftmvr' WindowName: 'lqtzktpowkkeuvetatvvkyuovalckplhrz'
ClassName: 'euquuwfjirftyxadzunifwphkoajuedn' WindowName: 'xarmlouemmaegdbndijzbokafgeehaal'
ClassName: 'brlwzbypkumeqpfydcowprdkpvmspsymkinm' WindowName: 'tqfyjpqbewwfitczipcmdputwnic'
ClassName: 'pxwidlhqhaodhxe' WindowName: 'vttnbbixlcytovdfmfagfjwwfsfq'
ClassName: 'bnutxqqgaxhugksmanvsfqkhbsxjwfp' WindowName: 'chdgztnwzwcvskzctxlrxmktw'
ClassName: 'taiaebdyldbejsaqudil' WindowName: 'merfwktkpcnosicqfkgacxydqzlcpmhrci'
ClassName: 'fpjrgzrqouwfjhwmfskzmgjfupndwhvpc' WindowName: 'jcpfnsizetjgudvrphgglwfqhsnf'
ClassName: 'qfxndqrtmobrulxbhtmgazrhyvvzoms' WindowName: 'loaclkhetkpshmtjqrwefjrlmdjyduochuhpz'
ClassName: 'khopofdterwkebzghrulp' WindowName: 'qlqdfqkwzmpjybs'
ClassName: 'ahgpsracvrkvswwkgmrlmrwkboit' WindowName: 'athskwxzwflrgigxephqva'
ClassName: 'snoiwahbfisjigauw' WindowName: 'txcpljgayrpxstyfaaphtfdp'
ClassName: 'eeayvqhsqppnbfsgpxpcpfxwgf' WindowName: 'srmfbczwuuihshrzb'
ClassName: 'brktrrwbysiwabpnpzqogxkmwbqmckluba' WindowName: 'roknnbnfchdzfugocyqnrwancjlmjrpv'
ClassName: 'fopbsmzqcmttanygzccker' WindowName: 'rqqdbgskgrfpqpkqhoohwupgfwzgjpfbctlo'
ClassName: 'rkwhiemgywetbqfgcafsrsxeusunshvtxtq' WindowName: 'uwdtfrbejcmlhetedewekjooawnknwqantz'
ClassName: 'kvsuetpvydcuwanvotkwdodxxqrezkxvxqp' WindowName: 'irtofwsrqwypdnyvjncfmwaalcagd'
ClassName: 'gdzskvrtdfbfgirvzvci' WindowName: 'gtwumordprihsmipuuaovqlrjfhplzav'
ClassName: 'vbmatcauwaszvpvqft' WindowName: 'uiqrfhyoaqaromsgtjk'
ClassName: 'uphlpykywqvlvqgdqpccrhbaxlvdme' WindowName: 'mocffprpfkwjkgoxq'
ClassName: 'hxrtfmocuxnxmavkaqlmra' WindowName: 'dhrdlvswzehqulkpchmcqtxftriy'
ClassName: 'yupchpalipqcdmf' WindowName: 'cjzxnthhcpigvvyhvokdosxmxfhhqdxzuucg'
ClassName: 'ytvlzyhjezxycxeuukpogmjyd' WindowName: 'elyfvxkyyygtekfdmgyyuduomhpraqaqqvmkg'
ClassName: 'yvbgeqetdrpnrrwrxr' WindowName: 'uxuohkbdchdbhsencmjmf'