Trojan.StartPage.60444

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsp2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsp2.tmp\System.dll
%TEMP%\nsp2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsp2.tmp\System.dll
%TEMP%\nsp2.tmp\Math.dll
%TEMP%\nsp2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'tekddcegygyzkttlqndysoqajudammqefcuh' WindowName: 'inntukyftohedjgelhewpluujpwkli'
ClassName: 'xepesrxuuwsiffasrucfhzjmvpapj' WindowName: 'pdnjdpllnfwtaom'
ClassName: 'fuzldfhczpdfscksirirosvaguxyzwkuq' WindowName: 'ypkriylyocxuewweylgaqtybpzoknoruls'
ClassName: 'spljfskyzgjgbxozplbnxo' WindowName: 'eflnwanwfuocuepscuhnthaxpyzzsudwcq'
ClassName: 'jnuikmcsbapkkfcyaehixvdyhvtmtqokedn' WindowName: 'hbkdwazqecoljsieyaavtigxnt'
ClassName: 'ngrbnqntizkrrpxswfzsfpja' WindowName: 'nlokenmzpfeibfcidqukgxsurdoilzzlexwp'
ClassName: 'sklznkegmdkdraledgaqk' WindowName: 'gfklbbwmeagxxqhoyuonrqkhs'
ClassName: 'dfmlurdqspppikpgpaxptputlhrynvvlbwzt' WindowName: 'ejaeynagrwlonvswweooypyfedzcbjmmsvplsn'
ClassName: 'vyspelkpfujtabvwzahcrprxuntvm' WindowName: 'cwdomozztjpwrtzyhxmlpghmwnzilrabqtayd'
ClassName: 'cnzfyzkrmufwrsibk' WindowName: 'bsrleorihcswuhffggzoxzhkz'
ClassName: 'ngpomrtthsdrzwqikfntnkagpfdcvt' WindowName: 'kxuwhgcyxaieeqbtyogmedrndwnncxkomurkvih'
ClassName: 'gqpmauizfpaqyhpezeejog' WindowName: 'vfhjacuzmapnrwopbhdilqoy'
ClassName: 'priirbppwhnabvoewcnijstkbzggico' WindowName: 'ficyugsrxdoxtjexngrvoesqgrb'
ClassName: 'qmhmgtrtaytoarzohrkoomevmxrazlyiufqoq' WindowName: 'arblsiqcpfkoenkzgrlulzpmefnpgxnsufiwok'
ClassName: 'rbzoxvkqwbcrdsmshfborwnxdgxttnaf' WindowName: 'sjloxpuuawfvpuejr'
ClassName: 'dbgpboivwjdmezqgzffwgscdidxfzyjai' WindowName: 'fbploordkmcfozhfws'
ClassName: 'cfetibfcfetvmywulnvlcxnvovxgtttamc' WindowName: 'jilsqeqqiarmtnahilssixcpkgyjopybr'
ClassName: 'msazbdevdkzqsxxn' WindowName: 'ycizgigsstiydngdplwsdydpmuxdn'
ClassName: 'rjgfrjvevjsdlitafnaqtjgpnxqv' WindowName: 'airrtswicquqndhng'
ClassName: 'neaorlzbmqgtxsvqpygqtzdfoyqgrrbwaedcy' WindowName: 'nxwaamwvpqkvuvmmfpks'
ClassName: 'kjhhbnjupalciufskvblmr' WindowName: 'kabuzctadvpivwjpuulzm'
ClassName: 'gnowovswfdruwbkpuierdt' WindowName: 'nandmlsnrblssmzfdch'
ClassName: 'zyuzekylrkinvxzqoahcgdhioqxdb' WindowName: 'uzilvlwvxirwpmx'
ClassName: 'vdiydbniphdjkvpc' WindowName: 'amqaghkjbnuaizuwarmpghixrgsugzfjswmakgp'
ClassName: 'utovvnahldqkxzxhgsxfbimmmdqllvyimdyrc' WindowName: 'igkefwrmznlfeepwgcqzpmcfzvdpmch'
ClassName: 'nhnneozxdtraxveyooslnlmlzcirlxofhgaiyui' WindowName: 'ewkybgmhgsvieirghjurwxt'
ClassName: 'mxiqtlrpoxdtggx' WindowName: 'uwvimuhulfadkzinggimbwabbldftf'
ClassName: 'qadgpizrlupmgsw' WindowName: 'udhvbqxnljcvutx'
ClassName: 'vlbbtnrejhcxlvdpymujmtjcab' WindowName: 'buvfadupobjrxdyhqsybdlsq'
ClassName: 'zpdjkyqofnqwzndmksnvlncogvhrtyhossj' WindowName: 'rqyvkuhbfnxumpcwxyvvujfqwxcwinqp'
ClassName: 'ywljmukfvrcpeluk' WindowName: 'hyfcupbmcztrwki'
ClassName: 'lyprtxxnpsvfpcnwcbsclymq' WindowName: 'smidmkxntjcfmpjujfrgwyzzsgf'
ClassName: 'zeodcbduzxxhtcdtceoojclnzphinn' WindowName: 'qzheyctfqgwtvxomlkh'
ClassName: 'gyrtzamvswsqlmaijdyeph' WindowName: 'vmzkklgdplmnesdxgydjwbuitwbdiosgpylkxqd'
ClassName: 'qdkdwcjhjprkcpzyibdowmycdyguyfqxxwpmthw' WindowName: 'tihkbsbceoyjppbmfdmmcpwmidqbr'
ClassName: 'gtczqcqlcscdubympkpedhyfwcjoyira' WindowName: 'rmajujyqxbdldtkyhrucvh'
ClassName: 'wezungxvmbrelbhhbplzheqy' WindowName: 'xtklvopjzrqadrcsxt'
ClassName: 'sfupellqznqyojvnxqykyti' WindowName: 'iypopakykflfrhmxnhevjybcdeumivebj'
ClassName: 'kwurhzuiqukyrcqhzbwxlluwabbvyzeqboxsik' WindowName: 'moufyudleeysbcmxoaxsffku'
ClassName: 'fopiyqslasjgdcgwpuu' WindowName: 'cyhkwctajuqneattwsnadyhszedjpvablehw'
ClassName: 'amzvtoqyghdgibxkxqhhvqwdnnijavxfug' WindowName: 'hpcuoogokjgjnjhrbfblgpbajoenui'
ClassName: 'ytqjllmfltfdkdxeaesioyofomxoxdepcxsiro' WindowName: 'bnufvolowfgtmdzlvzhwjyrj'
ClassName: 'hpnwtzzokavndqzwg' WindowName: 'dkkyvphnyjxzmabwwa'
ClassName: 'zcsqxnuejgztqbkreqzkgxthjepfcasovitia' WindowName: 'uziijtselkymidspbevkdhkmwqbentkyprfev'
ClassName: 'qycypbiuwmjxbhifi' WindowName: 'gnmzldawewiizauxrnjfdpfkt'
ClassName: 'vrbemfxukzrrnurvdfxzjxapqabqbhcwtrabe' WindowName: 'yjavgrukdidvykrlbqenvrceqg'
ClassName: 'ozpgldpeoynudsxfjttejuzawcx' WindowName: 'gvahveifdhyhgtjchxpvdgvdfqpnsdzhbckb'