Trojan.StartPage.57915

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsw2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll
%TEMP%\nsw2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'vkegmzwwkkduxnoyjwbefqxjautdlrjfeyfiga' WindowName: 'hyzbefatpdtrsmnrqfhxzbhqtcomjrcxvxcp'
ClassName: 'lekmjuvdryqsuytbwmgklsbsfzbijnqpzsixqf' WindowName: 'xtttmxmqosjytbksf'
ClassName: 'viefvzpyhxcrtxhiuszibwhlep' WindowName: 'mlxegvabqfwheptmzarmkyn'
ClassName: 'fuybocsesxwwylljflkddu' WindowName: 'mntkqkfsokrduifbcuocnkdexr'
ClassName: 'ujesvrisfatcbsd' WindowName: 'gbocpdcyzkeamlxgpcrpkdhqnhnnybzbp'
ClassName: 'klfuhmdwkfcdcsilwzhs' WindowName: 'phpujojuonjnxexcmkrsrdhzuq'
ClassName: 'yiktejsxomynlskv' WindowName: 'itxzdpdzlcllckvpphvwotavvemmskwpsy'
ClassName: 'bmkwhlnzxtmzkejhdkvkaxsfcd' WindowName: 'qymdtontxdfdjlzcofvqzzllhkvzbocwibfkden'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'hmpybiumpajvvtxjshwwfbpgsaxtetvjnxjnbhj' WindowName: 'ooepxyvjztgsflbdjatpbp'
ClassName: 'vsawudqqervxnpqtyupted' WindowName: 'mlywgdglehcfsskdetgojoxkzxotndwmruoodx'
ClassName: 'vtpwqtiubidlieawsqjyrmjraquuqfalitx' WindowName: 'onhnedtxssrqtxttqbtyfzl'
ClassName: 'xtrrkjilfcwqupe' WindowName: 'wcnypmdaohncfqgq'
ClassName: 'nklcgzwtunxmldck' WindowName: 'eumeylwxtmwjbpuocfphbxgpsxzfcsxbk'
ClassName: 'ljrrlipxigysvrotmyospkgtsxush' WindowName: 'phrwyyprgjjgkoxcxujbikezxyapexdo'
ClassName: 'lwkhmcczvkwoqnycorgrhwvce' WindowName: 'sxxbtwrgwmoxxtwriskznuucjpkshtmubd'
ClassName: 'fgbixcssrhejkyykkynoonbdi' WindowName: 'qwwqvmrylpzvzqaulvwbefpludyewmdel'
ClassName: 'dgitslkehnmcfvsxwyp' WindowName: 'aitdaopayusprrisorb'
ClassName: 'dboesnlyudargbodtawslzsptbzs' WindowName: 'szjonpegnjobvybypcnzahyawxu'
ClassName: 'hityzpgsejftpwzuisfelf' WindowName: 'ypqgmizbxriyzlcywyesvhqbguzjzc'
ClassName: 'eqbsjprmumaddwzexdkzdpsljkufnfrpnmvbwam' WindowName: 'eemhloyvbgeodivutnkbdmiehquowovkhx'
ClassName: 'ixraznqoectmvtidslfmaamfrago' WindowName: 'bwlorjcwayucjvjegewx'
ClassName: 'tqguiymjjliaomuyooxjnoculolp' WindowName: 'uajjqeheirzdhmfpmtabsaummlihzbgrsqbwfqi'
ClassName: 'bovoxvxblttwifoqyxuugiqjgdmvx' WindowName: 'fngjuofgqdccbprhd'
ClassName: 'bfygqzeixxyvlfqyfxfnmsnmovntgvjeepi' WindowName: 'wgjwswnwgknumnhhtakv'
ClassName: 'sqtqgoifevxsgjcchdfv' WindowName: 'pgoiqefrmtbflchmdckq'
ClassName: 'uhqdrabklavencdpzegwb' WindowName: 'vqejyfkcbufzggftqfcqqdcqdnqnfixuh'
ClassName: 'cidmkqhdlphlrtijuewfrxys' WindowName: 'uxsvmwjbxtviqoduozomwlafqctyakxjbp'
ClassName: 'zhohymgktyrxnft' WindowName: 'vwzmocijahvqfdrpqxb'
ClassName: 'utscdiahgpziuotqwgkilnvzqlntxykd' WindowName: 'qygesetcknrlfejwitkxhvggl'
ClassName: 'bwufnykuchceifnmyvxhmlghmbagvfdsgvola' WindowName: 'jljnzszorybcpbhpjibylbjmdlbmujksmiht'
ClassName: 'ltirrykqpdkmfwfbztjxgbzmgo' WindowName: 'aednvwefoqljirzkgwufrbjhxozpmrmvkkhqf'
ClassName: 'plgyoayjexdzmszgnoarhsrz' WindowName: 'vaaqwzehjztldhhsflqf'
ClassName: 'sitjrugqyoseefdnptngvegmnk' WindowName: 'bxwlozaxfvgnbae'
ClassName: 'umayvvlepxvtimvarkdrfmniambmbr' WindowName: 'bcgfailrvoecsgupribjzqgyywhgchgag'
ClassName: 'fbrqljdkakywhwezxmedffefjbu' WindowName: 'imztexqnncwwcnyjm'
ClassName: 'widqurlnodlvpzfnoouchzggkeqjs' WindowName: 'zvzejkqhocaehpzrybvwqvtqlbzioy'
ClassName: 'zidnhhqexmvgersqkwnnyazusnkkbshxmqslykg' WindowName: 'stxqskwdmlxafyg'
ClassName: 'eoufbetndfzqhxemgjvqlup' WindowName: 'htdunizshufbxyoyofnhnqnglhjytnezpex'
ClassName: 'aoeiwbxuojjakvvilowpvdqaihpsdjsftdehm' WindowName: 'hmgrhpijsplfiucbfui'
ClassName: 'jpmpamhqecudvgptekcpsulcxqyg' WindowName: 'vapxkdjqdxfvltvsfvhbzhqikc'
ClassName: 'potwzpvufjbcylfktkgtscwxzylojbxnbvq' WindowName: 'rseqdtfrivpuapemyaitrnwcjdysgwijwexgly'
ClassName: 'kimtqfebaegvzjbiroucqvloqnhfjbihs' WindowName: 'zmjporjwkmnqwdghmzxeuznkwdczq'
ClassName: 'xnvezygtoaqfczaomlnxsbjw' WindowName: 'wdavzshwiuunbmyoonbvslkkccjzvv'
ClassName: 'bheyququttriijx' WindowName: 'iwdmwdpktmvlsmwmgr'
ClassName: 'msjwwyoegbxkplhadt' WindowName: 'eymuhgcgljwlgmfnhgogezmfnpgibmphpjnllz'
ClassName: 'kbdyvcvhpxxdpglm' WindowName: 'zjsncdzlwydlixnhejqwzndjdxcqzj'
ClassName: 'cewvsmqzkzmijbfyeqwijdogxhpaknmpnwu' WindowName: 'ofxyfnyzkndlbuxuubionxmmozfyvms'
ClassName: 'rabmrynozllmcmefratqpskgxqo' WindowName: 'nqtrfseqdwnskkfjdzfvainkyvg'
ClassName: 'pwfopieqxhanbilnrhrtxffibggougrnqg' WindowName: 'bzsziiuizybwivqnhetyfqhquval'
ClassName: 'oanbppsybynboflgtkwzmxfhrsfagvi' WindowName: 'vyxfrcadarrinywgnocyuapliivrj'
ClassName: 'xzhelvpvlcggzbaccnfkrkezzs' WindowName: 'ooqxojgdluxcmtuthyrikcxjmr'
ClassName: 'yiptheajzmxiwljxaxguddcbv' WindowName: 'yyuvxynaobfolcz'