Trojan.StartPage.59357

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsl2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsl2.tmp\System.dll
%TEMP%\nsl2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsl2.tmp\System.dll
%TEMP%\nsl2.tmp\Math.dll
%TEMP%\nsl2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'zoadynsuqqtnrehizbmcfswewunjp' WindowName: 'bfpwoytcubdjdgyrjazxprkfoveiwtpprdlv'
ClassName: 'ivdhjczpadxsvzkjwbnwowkeufpknzmvndesz' WindowName: 'kdsopsajzamchsbiqkrlrwuntwllxmscegqxci'
ClassName: 'sdwpjsgfljyconskm' WindowName: 'gykdcyvlojdxolfdllfflicdoe'
ClassName: 'onkbwpcxghvnntlamt' WindowName: 'kyjpeeifpeikyljtij'
ClassName: 'mxwggpegmscuxtqmhrjks' WindowName: 'uofibgavtvwxlrpwsrljkq'
ClassName: 'fykhrlljadpduihjezxyewki' WindowName: 'oefxvfccsdwrarwkazfwou'
ClassName: 'qbwnqvizkixwlstxacpayjbdezwzkykgv' WindowName: 'wiriwscyzfmgpvhwhdfcrjyuwtcnofvefyizz'
ClassName: 'mfmcvacaailsewvcurhemzn' WindowName: 'fnesnukiihjfjzp'
ClassName: 'njigzlhnejwglflbzmehaqirgrsxcyv' WindowName: 'wnbgmjuuhpvhmnbqvwwnwybtakakmmjquqsexg'
ClassName: 'lxhwcpqsltmsfqqhhknyyr' WindowName: 'uxwutfnvcgpibnwxnljkeqmhyjyno'
ClassName: 'bkesnfkzbjlthlqohdmahpg' WindowName: 'kdwxadnlduksxdndkaexhbvbsqisossy'
ClassName: 'omophpvbavmjhrtogxfbeh' WindowName: 'weuxhiifzgnaxdowmdcgfvnqjkxtwvfoxysn'
ClassName: 'vybufxgtiqvewoqiykasgquvruqjsj' WindowName: 'uqjalbchfvpruomomins'
ClassName: 'onqgxwfbtmsmwjxmzedfqhvpmp' WindowName: 'pmildymjszvdhftpnusjmjpshumuyzaru'
ClassName: 'ztfpmphactniftyj' WindowName: 'ycyusclpcuwujbfvrbjpuacbjatflo'
ClassName: 'wyxsfznfdbmagiedclo' WindowName: 'ayumqkfezthoqve'
ClassName: 'yamcynlxuzxdywcmmvrbplqokpd' WindowName: 'mlytzmrqnbnxwerwsv'
ClassName: 'ivyhugmaummuujjijfekddzdpwqoobtasr' WindowName: 'faojufzzqwwaqzzycrdpqqqyuc'
ClassName: 'qfguqakfuzezictuusqsyjnzmngrjsib' WindowName: 'lxoifsxprggjwlmr'
ClassName: 'flzouztukgjjbkfsakv' WindowName: 'prbyzskwakgffdogexjeqtmt'
ClassName: 'akfrmqufooglzftquwuxpbzactd' WindowName: 'bmhwyaakhidousvndirniovggtfrc'
ClassName: 'wrxhbudnbdmojxywggdp' WindowName: 'fucavfwbihrbnxkwn'
ClassName: 'hndclhfxgtxkqrpwdzzremmdrdkdv' WindowName: 'mrygohgfmrlvqxmqitntkygddxyt'
ClassName: 'eqvrtcmbqzpcqywbsfhmqqhwzsnfqgn' WindowName: 'olgjqielygzatwlsuggucrvugcokkduchj'
ClassName: 'csfltqfgukmxisprtedbnruzlivpkytq' WindowName: 'ccjxkyklhtywtaii'
ClassName: 'noqxfxexjccqdpfqtpfake' WindowName: 'mulbdgejvaweeadrdzzpyyfclmcvfcjhe'
ClassName: 'wkdsibmnypdpxdhttitcmcaeqoyktwoilifn' WindowName: 'lmwakktezadksuatujgilxt'
ClassName: 'vbnbyrzkzxmqqbppkadybtjcbvhoxfairtrp' WindowName: 'vxuzcigbmuyrtphwehjhhbsftkxqvnog'
ClassName: 'hvpwyhsmdzbfkzltdbp' WindowName: 'jifgkzebmpeiiuvnawhanuwyfbrjqxhn'
ClassName: 'lqdhxdododynvwobfggbxrxrkhwljrcvcyxj' WindowName: 'cfyvlancudiyndqmdtvhfseomlmqo'
ClassName: 'cpvvnscohcznigmgsbohfmngqgfgmswkllqwsea' WindowName: 'lwwpxecqovctudnovcnsnuipywanpe'
ClassName: 'nzebokxrwsmwavvddhxbfvdokltrl' WindowName: 'uerazkegdwdnvavhsmwsalo'
ClassName: 'byausabumsdrmqugaebocawuriya' WindowName: 'rcjwcqqhmqdjkscglwy'
ClassName: 'fcnxpjgomynfwoheumwjsf' WindowName: 'jofftxtfbwzgfkvryftdkt'
ClassName: 'hpssyxwxolydqgdepiy' WindowName: 'gyxpkmskzgidkqvi'
ClassName: 'kwyjoptxixxwbmbtmcqzzyjkcyswimlqbupmar' WindowName: 'cobnooxyeiqemmlwumsutupttum'
ClassName: 'ieatgekvnxmrdggclxhsfguayytovomueyzhgg' WindowName: 'tkwubbkmrigywzplqwrkkkuupudn'
ClassName: 'phfljojugtbhcyzccknjcjn' WindowName: 'mcslyioukxnjszbqvnsgz'
ClassName: 'vtdzbrfskgmtiehmtmkpuph' WindowName: 'rnkxyszjvhgxdaniin'
ClassName: 'xgnldkwwqwzmzmqxpznroywnkctrrnhyrp' WindowName: 'dyafqivscqfvbgtmmvvhoqftrxqrazvieenxbb'
ClassName: 'jvkciblfkqkwiyvygrxnetpx' WindowName: 'wkfxvpwrifutinjght'
ClassName: 'jrsibfamdthostwcmzpxdv' WindowName: 'wqgyhwpumfqzqwuzdnoeprnfhocw'
ClassName: 'ddbxarinemhqtklxato' WindowName: 'bcuaskqzyyexxjgpuhpynesscxfkw'
ClassName: 'pbnlklbpmsjudkwiwpsfk' WindowName: 'ayruzlraocnhuvyrjpcwbhmgivwhgumq'
ClassName: 'uwpflpakxwgxjqrhgwwyzhgvpwduk' WindowName: 'oqoukkxybhixjxzapqbseskcpyjj'
ClassName: 'rofpuxhvhkefcqigabakzeltzxl' WindowName: 'feyaztfogoipbaeakzncnwecqubpat'