Trojan.StartPage.58423

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsh2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsh2.tmp\System.dll
%TEMP%\nsh2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsh2.tmp\System.dll
%TEMP%\nsh2.tmp\Math.dll
%TEMP%\nsh2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ikjnmqlbmnoytgldqwpdvlxsvchrq' WindowName: 'xjworeargptnflozqsgfxoh'
ClassName: 'isqtrmgbsvpjkbkvenoliuiyls' WindowName: 'wtmdaapeudndihthc'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'fnctpxbseqheqergydylabiemxm' WindowName: 'tkjslzgvubhcgtsufzihnmizbrwh'
ClassName: 'jlyfftztwfdectmuxhjxcq' WindowName: 'kmguksryuwtsowzaebnuzsibcseaotbcvscgzw'
ClassName: 'wfwzkxuhbnmurpvm' WindowName: 'rrncndabvcksyqwgbwfgvwou'
ClassName: 'vevizcamtiknsxhaxctvyguydfzjz' WindowName: 'zpgodcaleetmhklsllstbwz'
ClassName: 'nvztuxgurzaapnvngs' WindowName: 'yvvrriehmptbjduwsznmdzgilnkbjzhanjdk'
ClassName: 'cnqtdxushebfzsevmq' WindowName: 'zyrawxmpvoukxvjishr'
ClassName: 'byywldxlmejymgzlixdytsyzqqmyjtx' WindowName: 'ynhedhbtmxdpfaamaspdtvjhoulcrnhja'
ClassName: 'jkjrwrdwecplqsgz' WindowName: 'ddmdpgmypymxsptgaaxsoetxkipguhlsvikgw'
ClassName: 'xaqyuboautwsnbyygxbqcashpmjnjhmorl' WindowName: 'opjpybbjhaclqaqmxzyrxrtyidkbnofxvem'
ClassName: 'xdpfvdlythdtiaggxmlmpivdfjcjrsljcshudav' WindowName: 'iszliruerwntchptswzcjspwu'
ClassName: 'vcfzkpizplmvulht' WindowName: 'funkzutjsqsvasgeltlmel'
ClassName: 'gtrprugccanbuinkllhomgsobs' WindowName: 'cgdmwigyjyetlogbyll'
ClassName: 'bokvimcjtdsqdncexgamarvccqdbhcubcihopwc' WindowName: 'frvwyqptkreopzkcqlxsjsmpibtrpsglpxuhmy'
ClassName: 'jbeyxfizpbixicpcpfuzspvsdrxzhcgcmmqphwz' WindowName: 'qqeymzdotgeosfkgzwyczaxqnkorknfjdtkhds'
ClassName: 'slvgokdnolpaahscpenyxqkyoiozozbkvb' WindowName: 'wjuukjebtdnprkyogexefj'
ClassName: 'hgioqglmuzbvzrzed' WindowName: 'uksddmzsmjevatllgryv'
ClassName: 'sfxwuorwucymooyagwykoevjbpzasyuugmdjwf' WindowName: 'awqsvvtuavoljanpipbhgfkkd'
ClassName: 'curxmlnduuysinkemjkocan' WindowName: 'xlvnhujbwwrkkckwuhboolereu'
ClassName: 'jpgxlgnfektsvehubbixsyaeuczzj' WindowName: 'dapduygxqmliuqivhl'
ClassName: 'qfufrpcwshgczxdifvtpjjcmvsmzptdzjln' WindowName: 'gvpmgitvppibqlz'
ClassName: 'nmcqbetxgbchtmqtljdrqtuozqdamoypofvg' WindowName: 'xuzsmtrmxiaviposdymf'
ClassName: 'npwjcvqowwgcuzdxrxwdjngts' WindowName: 'xpwnfhxviigrvrqkbqwbxqvlvdlzemdzig'
ClassName: 'mwrocdxpvyqhntxcbdpcqbnijwynkgvegfthtf' WindowName: 'ivbgpmciywhcxagrrlosyj'
ClassName: 'gajfegulpevvfqv' WindowName: 'kssonxlhnepoirqt'
ClassName: 'ghqkrkouhrdakwhragbjkuwedgqnmax' WindowName: 'ympfquckklldzrrinqupljadofuspdlymupnp'
ClassName: 'ooxnkjiycfiatgflnyoaonij' WindowName: 'joimqrtutbakwmfbstttioloajsxiwgfpgmzd'
ClassName: 'aqnexjzofzxlvftgar' WindowName: 'vqxperskdnametixdztehgqiaiimnkivvaa'
ClassName: 'evurtnmbjtfflyapegzfglxbdbsfdq' WindowName: 'jnyqqoofekozeyelpqxuphppndwn'
ClassName: 'kncsuzlqmmoysqouasnbpfvsbuxgqsqqgjc' WindowName: 'sqvqgfoyrihjnudcrcrr'
ClassName: 'ibifkdiairtzibdebq' WindowName: 'hklifcogzdqzfbycwvrgvtt'
ClassName: 'mujfezidiemnqqvszhgmqfzsjhyiqgpntpk' WindowName: 'tnrdnwwjuprjomllibbradccbmtxwxbls'
ClassName: 'lzempiwysoshdnuccwncgxvfzqggejgcm' WindowName: 'cgvnbwwycoznvdcczspzegepuwxkrcthp'
ClassName: 'cjccmfytnhpomvpghccyttxybu' WindowName: 'xsgelpvgmzaccpofbdjgnrxz'
ClassName: 'dtlryreuskgamumtnszxncpkomfzkzgw' WindowName: 'vuoudccgvcrravmjzhwpvaxbjkxummxytxephx'
ClassName: 'bxhrxefmdmfujqcdc' WindowName: 'qztfkraxpnqsbbltzgbmzwasucbpbsetcd'
ClassName: 'oounrpljufahvmdvaoxitwkensz' WindowName: 'eppjyfgfjnczrxlj'
ClassName: 'jdwqfpsyeyeykaxnrs' WindowName: 'ogodrjtwijpgzjznwdpehrt'
ClassName: 'jdvqmjcjwijlicqxwotyhmjmsmbhmnrglvbns' WindowName: 'wywclaqhqwseygoyfapxkuakgrmggur'
ClassName: 'mvanpnfbhqxdelhxekoiadm' WindowName: 'clbizhndinjcwkwhcaerauguwrexenkjb'
ClassName: 'ibftncplbuzinzmlflilcyiski' WindowName: 'cdvukwsajxdbwkgpgwcmtnalcfkra'
ClassName: 'plwxglvbmmfivwpfojdoth' WindowName: 'hbogncwcxtqlfvrycypjljjrapoxxqewbyhjfc'
ClassName: 'bpjdakbclotjadlhqpab' WindowName: 'fzymaiqhsbmyvwfolexjxtokmbrvtsoukf'
ClassName: 'okvsonaxrholqdxokjkwszcnxojhclhilqvyhgk' WindowName: 'soeoenuvkserpggibkbddrx'
ClassName: 'inlmnvvtjuuvctlpan' WindowName: 'wzjjvyghqcxvdrpaddo'
ClassName: 'daquuvyfueqyydagegxboyntijsiiy' WindowName: 'paicqxonfclddfzbvpamxeb'
ClassName: 'wlwlhmrytnwrkegbwlgonpis' WindowName: 'nkorvwobinkvykslycxicehbd'
ClassName: 'vonlmgpgqewxrripzw' WindowName: 'zvzrzcfugtimink'
ClassName: 'ghwxjdvmbaonqgehbdbzvfbhqbebppzwdxcey' WindowName: 'qnfvinhnibrltoqdtpvicbfjznrno'