Trojan.StartPage.63561

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsq2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsq2.tmp\System.dll
%TEMP%\nsq2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsq2.tmp\System.dll
%TEMP%\nsq2.tmp\Math.dll
%TEMP%\nsq2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'lgessokjpphaswgxwgqepdbvjbzgwssdwyip' WindowName: 'qyblujqvmycqcui'
ClassName: 'sdhwzhehkqaxulmae' WindowName: 'althfymftfrrybzfkmnntqqtwbqhpkcnw'
ClassName: 'qdepjgrkaspoweyzonql' WindowName: 'cqizldbrzhuizuoppexvvdddjpwdl'
ClassName: 'mrdvxotthcejlpmlauxrfsfqnxpmcpuwvtxkl' WindowName: 'irchkezomalmopsyerzjk'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'twjbpgrhfqacrtz' WindowName: 'xiyjgofodtgrgrtgfqyeoqgpunqradnqwpptue'
ClassName: 'pbdvuquanrxyprtxpdywmsfntghfpeypigutku' WindowName: 'bzqrsojfvhdpxulpkc'
ClassName: 'respetnckonuoymjtnnglxotrknqm' WindowName: 'cmowzesgnwqoyppqqxcivwtzuit'
ClassName: 'renfdojqgquizdoljlzneijuavh' WindowName: 'agfpjgwchcgohdtujzvvjlcflmgyxq'
ClassName: 'fifzzdoeymnixqv' WindowName: 'wovizawauqfrjkyoqksnciagttxdsxkrgwz'
ClassName: 'irdzdptpfykwtgmzlxnkn' WindowName: 'xakunsvzlhozjnxirf'
ClassName: 'genpljcusfjhwamtmfhxzcewgelergiauivxf' WindowName: 'nizfghnffetgrtzmbikcecyg'
ClassName: 'uirekgpqudtrgkeo' WindowName: 'yvnbootyviuzrvbrijilyseqwrkgphbfiupcu'
ClassName: 'lnukxknsohmmqhbxzeuo' WindowName: 'dyrdmtyemptwjjmworzurrgybwrudvijz'
ClassName: 'ejlbvxtcalkmvxwqqziczyfj' WindowName: 'azikdqvyypjxsvsum'
ClassName: 'njpqucnpjspwnoucnhd' WindowName: 'vedrgwpkyfpaathlxjzvrmadi'
ClassName: 'ajuvthwzzdupjuflslpxrcr' WindowName: 'aivtqazblrdbuoapmc'
ClassName: 'teqzmxrimoqeullvlzzroydz' WindowName: 'masqvkodrdnwtjzndtnpjcxswdawdsymmfby'
ClassName: 'djsfazojtzhgcvfhwtwccopwyinzjoykvetncmi' WindowName: 'pcxptqhxrfkkrkkgpbdsohxjmiwrcajb'
ClassName: 'qzzttebobwbdadcweeniqggphmnpaaslrlhcacx' WindowName: 'smpeidllieopmwlkwa'
ClassName: 'abzkdszazxwmosqheafambdojdmsf' WindowName: 'xjjupduclascjzhhssyroyk'
ClassName: 'zbwjwavwbvxqdgsjsw' WindowName: 'iptuvcmccktpbcpojcfuvbo'
ClassName: 'btkxqeojhylgmhbrcj' WindowName: 'hdmqbbryxfhpolzjzxakbmvxuuthterpwlj'
ClassName: 'rnrzkasronkfkntae' WindowName: 'boakgeugwtmegivgxgovxtltqfzvxauuoxh'
ClassName: 'haczehzmajiskofxzrlfuwdjbxvasiww' WindowName: 'nvrvjuxxxtnzkkprewv'
ClassName: 'yvrvbenlsrxjqdswqvghbcnonhs' WindowName: 'uffhjdksujjdmvmepxmqeuvaxbnlpxxk'
ClassName: 'eidnhzikghphrlmfdojeaaxfxkuro' WindowName: 'tojknbxapeyklirbkgxmdpfgtg'
ClassName: 'gsrvrtjevigynpzxvfzdent' WindowName: 'xbpenhgsvblduyqxfp'
ClassName: 'cfsbklpvlimwgxcibvrhrgluhrfsd' WindowName: 'cpxyammiuhsrttnwlkajsbwxxvzdo'
ClassName: 'hhtrezijevprwbnnmoteuwcyqozzimsdrshj' WindowName: 'kqpkldovprxhhejbmwxdxxajczbyrdwu'
ClassName: 'rtrwzrsoiuduaehicvapopjuovwojhaodjittc' WindowName: 'dqnmldshqpjlovkpfwpnvwcznekbrxtyrvuudd'
ClassName: 'jieguipwpmerbgagjaj' WindowName: 'rndzvjvivbwwhqnpxwgnve'
ClassName: 'aehbwqgwkzvfokfehcuccdxzepsowuzzqlrscyq' WindowName: 'kilvbwpwjslkzkoflpofrgzmcavkdramvt'
ClassName: 'izrbshgziaqsldwuanikqsvvwbwpexpyumjk' WindowName: 'vmqseepbwnauowqvxjeosvfstxbuqyaigvddg'
ClassName: 'hcyqzfxzhfsquhzhkorwpqdigziylgiazgohw' WindowName: 'pspzhyjhvaompefks'
ClassName: 'hrvnzpjpdatwsqktdvtehzcfbk' WindowName: 'ruzobwvppjsrlmwhtarsmkblhnsdudqiiuovoku'
ClassName: 'qvhzliessrmupnusbx' WindowName: 'fjgxtpgyeogxkgywgdx'
ClassName: 'dxfuemggvnbmtavhjfboevmoehmfw' WindowName: 'ohijkpvrlbianyuqihathztowymknkjsbrejc'
ClassName: 'ohfpdbpamvjtbqleqtzydvt' WindowName: 'ucyxfedgnaroxpnwjbiikg'
ClassName: 'ikyfgynbgcvzojwcdzvxb' WindowName: 'wckgedzxkfjklryhwn'
ClassName: 'hdnnbcfjipqpjgeypwacsj' WindowName: 'ebbwprfigmnwxqissctcyqnelfuh'