Trojan.StartPage.58873

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsa2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll
%TEMP%\nsa2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'zrzexwhsvxcfqgtpqilaughgryyvkqe' WindowName: 'yvntauhkguehopoagbhcxuzjop'
ClassName: 'uwkwngxkflhjorteodafzsqjrpnpywhkwimbutc' WindowName: 'xjxlwdppbwlenhmtusxpozkvj'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'bfuhdnnufbhvhtpxpkmxmaihk' WindowName: 'hxejgjksihcklirjvcfzuhft'
ClassName: 'jawwxazsujnnsasiuevdglh' WindowName: 'zessrnjldsppxquomsypempxazwgdi'
ClassName: 'ugqlbuslwjkwuxgzfuiabobicesnrnat' WindowName: 'lvcltewtxlsyacj'
ClassName: 'iqbfpemmzywqzkxjvwkjlsvmyzevzknq' WindowName: 'zvdfkwefjadwcgsuadxdd'
ClassName: 'ykanieppcqgnstcgvyni' WindowName: 'eanuccydlxxeothsrle'
ClassName: 'cqlvdyleyhrxxqgzvyeemczako' WindowName: 'mpjlphzozrwtjmfoq'
ClassName: 'zfasdkcjnimdizlhokcjzhtirepcqvhtyatcre' WindowName: 'mhsebfclxqeruhqdilro'
ClassName: 'ioessnmtqeawnpwkoflhbjehcbqikowvkrtfrt' WindowName: 'bcxblhhvlgkvdkfaeuqubldumofzqqrsuwunn'
ClassName: 'fcxesminlmrzxycthgq' WindowName: 'qfoqtgtqbkvyftriohnxmfhwllbvchlsr'
ClassName: 'jszmsmkczhcuqpcxhavtjcvgw' WindowName: 'mupwklceickxlvbqehxwgquzqwoadjeaen'
ClassName: 'untqgpjcdlxrenbqcfcqqbyh' WindowName: 'moihigljlokplrkanvsizikdmdoas'
ClassName: 'enplvfzukixxozqnujtaryjzupajtsvxva' WindowName: 'wxddmzaadroulpjsxldcpcgstjvnhq'
ClassName: 'xghvmojnlyitwnzto' WindowName: 'ofgwzghtqsowsejieiaybtz'
ClassName: 'iartpzfjhokbwqmemjqx' WindowName: 'ifsuyjehvzppmqawgosltbvlz'
ClassName: 'ccvnhgxqhorvmachzvujpsagudizfj' WindowName: 'rclbwbmwfijjyzmuqomzkklgkyaftkftzkxqtj'
ClassName: 'ffsmugzxxzsztfvinmoicluuhufegrnum' WindowName: 'zvmdkbcgdsitlnvdcndvbbgquted'
ClassName: 'oenrgfjbnncdugoqqnnmqtqxudko' WindowName: 'ffnnasnnmqwhftz'
ClassName: 'xozdnhfsthqymncdnrrvgnrutnen' WindowName: 'hneykkpbjglrrobhldlaod'
ClassName: 'fnjqlhyvkgavwjghblxy' WindowName: 'gptljwmgyptnznhhiphwibwnqdhmxzebekaaaw'
ClassName: 'kbdgshlmevremeqfymkvn' WindowName: 'mgkjllgtxdupzbexczzuyl'
ClassName: 'yehrvfftwcxviwz' WindowName: 'tjtitcelzxmptck'
ClassName: 'exjvrchcsrcpcugegrzogcpgaycmvi' WindowName: 'lhmlzmyvmzvzebjyyqzhirmxeqvivysw'
ClassName: 'safxxsypvqwbglkwspoqoyzlpm' WindowName: 'evqkbxwpwcuxdxuqdpkckounduqlqjz'
ClassName: 'klqpjswoexcpowdpnsobsnfynctbhgulrczccu' WindowName: 'kmhpqzkrqmzfttltesbat'
ClassName: 'xjgfxgoxreftaugtzgnplxkdgzotmumbkfhumi' WindowName: 'cwsjmxozzimgpyznwedxlbblcdiuxcry'
ClassName: 'qcjttkrvepjucznpbem' WindowName: 'huefwgfpfulgwcqriluow'
ClassName: 'xnpmlwvxtltxmxjbrzavxgcrdbbvilbytlp' WindowName: 'etmjtchvlojkljmxwubj'
ClassName: 'ckoyxsdrlfwlfyaksx' WindowName: 'xzfmpeipnrlqxjzqedmtgiccq'
ClassName: 'zkqkdxagdvpxlzkovudgkkeqt' WindowName: 'mnqjmomiqzslfdikpbdulwiztjop'
ClassName: 'ljjwwzsbbatecyahriwdr' WindowName: 'jsuwpgebstlpsagjhjrhscxrngrrczxivmjr'
ClassName: 'welrjamdcfmisvaib' WindowName: 'ipoguyjmhjuqecsdzdyjbqyvpui'
ClassName: 'iuvtyiaipihzdoopqtisnzinx' WindowName: 'adxcdanbdyznkjctiwkdrrsvc'
ClassName: 'huirgbhhgqgzglvyrpyhohwcmhsoqkp' WindowName: 'oqbiyqzrntidpmmvypdfmyjk'
ClassName: 'mqboccddseuhywqb' WindowName: 'ernfyjvzufmfcjodzhblkzslsmpmmmrwynhg'
ClassName: 'tqcenpkkaxmsllexhvt' WindowName: 'rwuibmvcvdhjsrsagyvcquntebqkwarzs'
ClassName: 'nhbmiwkprhwassbfyvbsmueopdrbdlqveddc' WindowName: 'lwlyfuaqiyqbozcdw'
ClassName: 'sgncxahouoaxllnptugtmutp' WindowName: 'osvxgtltnuglglefxbeeqlhpnrconqqndl'
ClassName: 'lnkyfoyeazthnpdoyncjqfhhqfmuybbuuwue' WindowName: 'linoqjjdfuaxjouvzpgnjyamzxrtzkz'
ClassName: 'jjvzhyjvgbnkupej' WindowName: 'yerbzialjiclcqvlvt'
ClassName: 'avlhxcphoyqsdaxpceofo' WindowName: 'vqlbgdfcsjhduhfacrumqti'
ClassName: 'pjaqmwccsgsxvfhfcaxauh' WindowName: 'blmdkdnfsbwekplfna'
ClassName: 'lxjtuomdkpwzfhodl' WindowName: 'dbmthhzvyqqcgerhhsbiztwgvdknpbxgujihu'
ClassName: 'sjeexvrsxxnowbimevvsnwlfm' WindowName: 'wpmppzduqitvtjcopqazblja'
ClassName: 'teblhvsvbzjrxuvutwhkyucraednjtzhinmnz' WindowName: 'lpkqzrxzetxxjxsfnwhrcpamy'
ClassName: 'tuzirunkuxnmewrgzyghcrw' WindowName: 'ynpulzcjxitgsqyxafhexhqmfxxuxvexw'
ClassName: 'tgqijdkmlzhkzykttcwjioytvyogjdeutp' WindowName: 'gajuoqobluuehdppmes'