Trojan.StartPage.57943

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsw2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll
%TEMP%\nsw2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'gmucurcvifzojuhxjklgfzjdculvihepyzfkoc' WindowName: 'xrnpidsliddtdybotyescflzj'
ClassName: 'tyvhamlyojitpebmhcuiwonxlpwfmy' WindowName: 'lntrstkxavtlpnivropd'
ClassName: 'rmkkzpwmiejfhtsptehuirqxbi' WindowName: 'fglsewmaemimpupbuokvh'
ClassName: 'sylgvirodeouxzjkfqpl' WindowName: 'nthkvndpogwearxhnbdzymbwirgsfbtdzxwp'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'rpxyaprnfrvazrzdqouibzqxlstuisjmqysm' WindowName: 'ydctjilmghljnizfaffcdzhzw'
ClassName: 'zveytxkzmuxgimvofedsnwkfs' WindowName: 'qlcvsbannkddxkavmivfesqryyjghxsk'
ClassName: 'jiogmxwxcvrmhcbual' WindowName: 'jigvdjqiuuvdzfjvlmmwlmycwzxixcnnb'
ClassName: 'dnyxfaknhgyuazmpnmugukhcuiddqjxxfmkpns' WindowName: 'qtoddaxhhsdvsrbnrltplyhjoysykthawsoo'
ClassName: 'hjrfczimregnwnhwxnkglvjqymnxrdyxis' WindowName: 'zqlamljoxklsqzbqkqdnwhcuzjjahbkaywaycxb'
ClassName: 'zeqataqbaeroqxfaor' WindowName: 'orqnasgikcmwffnrtujoakokftihop'
ClassName: 'zmjflucsyzpnfikryzkrrtyl' WindowName: 'dzxdifqifeqbowhswhimjdpyvqqxpqktijbyf'
ClassName: 'piutgjcedndgyagdktyvtxylnnfr' WindowName: 'wwvitcuvbctjmfjjjfeuooeyxd'
ClassName: 'ckjotdejisnykfm' WindowName: 'wkqkgotuotiauqa'
ClassName: 'gntaxpgbjryfrhtdldzsbmoemxngijvygsdxrl' WindowName: 'mniktftmpijbguosmxcsj'
ClassName: 'pajicaiaybhnwwctqglyyssr' WindowName: 'ewzhjubwfjnqyjhtislaytmzqejavn'
ClassName: 'okplupzrclnlwfsqbutavbchfastiu' WindowName: 'tdswkluooaqnlomunfahetmncstqlbfbibzx'
ClassName: 'kwgdymjsnjozbskkxwlq' WindowName: 'vybadatdurebfjyc'
ClassName: 'npziduknbvimftdxsovffvioffotaayq' WindowName: 'ysmodginyskesnfzwuxprwomsayk'
ClassName: 'ygdnmubjcfxisdeicdg' WindowName: 'zkzjhovqweededhlscvtk'
ClassName: 'inhwjrnfuzyexeqcciyekpavxww' WindowName: 'ytjiowdmfgaljesrledzqhuuy'
ClassName: 'sjrpzflirgrljeaavjphssgvrhuyvwnupr' WindowName: 'kwkvwcoottbshvxtmqsuspdtqpthod'
ClassName: 'tsvdgmdvihazigwoilfvrhbjtfsvtskzme' WindowName: 'bdzhizajkpfqddehjwryxrpocnckttigzj'
ClassName: 'feesnohxlciharekcwykkqcbahdbgrksrn' WindowName: 'szhybbjjslmhorbmyujwbldowczibwyrvfppaba'
ClassName: 'jkozdaaqsaufaafdkfykvg' WindowName: 'hkornhrxtwvpudcvysafbssfnmuh'
ClassName: 'riiapnxdnmfmvfrgjhngfmiwlp' WindowName: 'mnjbfpgvjijbahbc'
ClassName: 'mvzeolerleuuknwktuehzkgeqljbcs' WindowName: 'kdvwxyishcqtykztizjhsvyfamjclzxapxwgik'
ClassName: 'kmupzjxpqywpxuxw' WindowName: 'nvqybkmyuogrobvakdeaou'
ClassName: 'skdjbfedmeyiwjwmhieddgrajmmd' WindowName: 'mkwxqfcikhekmlyzttqiglw'
ClassName: 'emhpkzbthpwonzwdcervlbtbiqysubydtvwhf' WindowName: 'hwrdrkgckhcyhqjrkirwenjpjpkhnl'
ClassName: 'qpsmfzuwsjkwgueikdgb' WindowName: 'lkjwxmnzufmuaimfd'
ClassName: 'avdpqcbtfuuatwsrxodstsjdyhmtvcfmjleu' WindowName: 'iarzwdkprbqihoiyijut'
ClassName: 'ejecgmgdgceqryqaosqpd' WindowName: 'btksidcmirjvspkm'
ClassName: 'nvlulswsdcyrmlmmwvn' WindowName: 'wbfwfvaselzmmmjukntkibxtmfwjlkhygphsm'
ClassName: 'garxwwfkxhbdefbtqo' WindowName: 'nturtwypkwcjgdzwbmhcxtzdo'
ClassName: 'jxkezzlgtdaetlqpjjtxyvf' WindowName: 'mzmrtpxlyfuhsuirljmbflmm'
ClassName: 'hevvoammbsqjrseuuyqndeenaixcvodfwxsg' WindowName: 'jkwozpumdsfmvbizdqrmlcwwgqkmj'
ClassName: 'laclhxcorvifpqnncaikeinsssaperfqaw' WindowName: 'frsxyvgwgveaomhj'
ClassName: 'xnkzvdzesewophjrxjqbgvydfhrpo' WindowName: 'zgqzstzxzzaighbghlojeseetkjrxzv'
ClassName: 'nzqujzdtnjpsiynkhoakbyjx' WindowName: 'zhttwysaunaqboyndacmswgtvdhgmyn'
ClassName: 'wqlywgxycscncvekrwsdatl' WindowName: 'wjylltfulglvlwfmeyxgjerrxzloqvzlj'
ClassName: 'nieaaeluvckafoiiglttonrskdapnezwkgrwj' WindowName: 'knranyhrlmbmuauebuuowywqmgostmmxoks'
ClassName: 'gmrpkybrjuujguhwjqpagfhcvb' WindowName: 'pgxwmenhcnlldoeju'
ClassName: 'ozgwzhmhamzmuhlztegjhoevlnospawtyc' WindowName: 'cphnumyolscgwhfqsgbsmdwuldtmydbsynxr'
ClassName: 'asrddglohrldbiwczvanoztkuewahkse' WindowName: 'lowiekkadsbpyzwkjvsalrobuk'
ClassName: 'fzbiojmgbcqwyprxgvcyeexskjwkw' WindowName: 'pacumcznerdfnzm'
ClassName: 'pmordqnkobqvdldpwxjokurovugc' WindowName: 'biskwmiufftuwqrpbfvfczcuzjlkdqn'
ClassName: 'ansvstxlodgxcnpcslir' WindowName: 'vouytetoeyccqgzgziavpmebdmdajelsgvyikjr'
ClassName: 'afafzndrkvqoxemqonrbyvelf' WindowName: 'gdutsjbjbrrtlwovskjybkpiiq'