Trojan.StartPage.59126

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsn2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsn2.tmp\System.dll
%TEMP%\nsn2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsn2.tmp\System.dll
%TEMP%\nsn2.tmp\Math.dll
%TEMP%\nsn2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'cnnsscrzmeoalmutrkdytsqehxkgkobucnlou' WindowName: 'kdgygypparijmvzuoptzlimm'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'ystixstqttfwqssugobpajrpxrzsiyl' WindowName: 'xkyypiiaoxqceonvxx'
ClassName: 'xigfgfdoubcfakwjdnirchqipijdkyzvkfwh' WindowName: 'jzawttcufjrkevrvxftqoljdj'
ClassName: 'diopwmlhvpuukphcbrkssxsvjbjsywmylxuwf' WindowName: 'rdrsqravedjhpbtdfmruwxjfyvtndpvc'
ClassName: 'flflhzssxolexdohqqwklgdwhqh' WindowName: 'fbxvrvnppulbdjogtr'
ClassName: 'ibedwfdeoehyystnpybcfrof' WindowName: 'skjmruubjiqxasdzkcnewhcadrxxvp'
ClassName: 'mghoggrepywqiffvirb' WindowName: 'eqdcsvrzcccupmtbpnjzpxsvyshnqkyt'
ClassName: 'cneqqvaupsbvrpotrszjwfveoupjutxomnbp' WindowName: 'mlxqjvacigrbbitaeug'
ClassName: 'downvscsrnborpdtokknihzp' WindowName: 'ffnleyaqoyotmpkekggfdq'
ClassName: 'ufvwmrgnlzhylykorrhcgphmrhrmhk' WindowName: 'ahiryhxnokkkylygoidjanmszdlfhcmodgsgu'
ClassName: 'ytnsbqgerbpnrfcvvk' WindowName: 'disihayyexvcumdyrveblsmcc'
ClassName: 'wcxarhyyugxvwoxrdinswlbdrqpuj' WindowName: 'calxsuuvmdgzjdjyljlumfgvdtchmugai'
ClassName: 'kmrotpxyirwfvfxzbvxeqqfauhmhtsbo' WindowName: 'emixtmexbmuhnbvielqejyvvpermaruodggoah'
ClassName: 'qgnkgjvdimprdmsgfkwwpxgexxostxnapolm' WindowName: 'wrqjyolbuglzkhuoicxfaarruvy'
ClassName: 'vbdfxtbhetznfbhlspvpe' WindowName: 'cxhukfyutzohyfdrcobcnkitzppjeosgl'
ClassName: 'gusnorsbkvayhiddtviseuebgdpsnagjon' WindowName: 'vkrgugecmrcacxcmiqx'
ClassName: 'ujdaygbwaguipoakspzqgmbrkizfvwoyovj' WindowName: 'kqucummjbhdghgyudszwfglhndayd'
ClassName: 'umhxntqwanvxwhgqzaxzxslzpt' WindowName: 'ymhkmhkyihlkyuorpe'
ClassName: 'liawykchbyebbdnergwwv' WindowName: 'dwrekwgqnxpynaxlpwwpgzukj'
ClassName: 'gkdipsvggxerehi' WindowName: 'cicstgobyakpawhixfnxryhlonnjoxkdgqmaldd'
ClassName: 'inbnhohfwfxlfjbzqeyhcudtzqwpmc' WindowName: 'bntgdyedoklzegegitoahsshzc'
ClassName: 'nnmcmcgeynsvrqbify' WindowName: 'mqjoytnpicuvmhdbzaeuvvdrfujuvnixnuoubo'
ClassName: 'wxubprmkqvxuqsmn' WindowName: 'atxrnxpkrifxqxxzgemuzyq'
ClassName: 'kumeuyjxwpitbrwwgd' WindowName: 'cpnciepeyjwsissdghfvpta'
ClassName: 'sobpcconslksddzces' WindowName: 'prezpqwimmebbdbbavfaqbcofvohcq'
ClassName: 'jaqjcfinvqwdczxurruswbqvgaq' WindowName: 'blsgyjvlpitxvnzrwgup'
ClassName: 'gywwcwcyrbahtvh' WindowName: 'denpmyuzrgauuhouachwwvohrtsgodlrjihqq'
ClassName: 'hfaofkxmanevdzapooszxhceo' WindowName: 'fvuvqdoahvdagvys'
ClassName: 'klwnomwnfadmtafi' WindowName: 'wjsrkmmvqxufiqcdlzyiqxaqetytnxcolrucv'
ClassName: 'nsnevriutrxzcecpvigbbl' WindowName: 'aviwtrvprdrbovqgmyabiqyyakyqqgw'
ClassName: 'ccmmmshdsumpnrulrdddvnxeudqgk' WindowName: 'xqnnbhzrgqgnmtclgsfhhfljjpa'
ClassName: 'qtmprjklawsqwzcfnfmjxyobcxhmaeuaqnxy' WindowName: 'dzvylnykejzrqilqnuxrmqrbjfqxmtfalxowpfk'
ClassName: 'clvcffzmyziuxadoblvdzkivce' WindowName: 'gvyradobvkgsjgkdhprvkjh'
ClassName: 'xkcahweriplzvmkf' WindowName: 'bledgarnpbawrnrikwgubkgweay'
ClassName: 'slzjmxpsrntuywablyglqlcdmywqunlzmxps' WindowName: 'cksroiyptotxlqgnmagjc'
ClassName: 'oehrbqzecmhqzbltejmnmwrqmvucxqgon' WindowName: 'vmhytebwpbwfdxztpengddvuks'
ClassName: 'ejfswyyjvekkmkllsdeqxbovokshhqrpupwpm' WindowName: 'evgkvjzdimxkttblsytg'
ClassName: 'botmqvhlcpethtymbadffriomfnbsiyfsdseas' WindowName: 'rfqybfsclxdcqomoxbcqehfezevbhmwpcudlc'
ClassName: 'fdvkgqhmvmshjxqvyffrxejsqjz' WindowName: 'zcfvjkgsctvaqjwjyfghxqrf'
ClassName: 'ompcxciaogusoimzmwvxsazcoodockkmghjuvd' WindowName: 'ifntbnohzoajsyujvfc'
ClassName: 'zpsddsrstenhomihgjrxskwzdfepwgru' WindowName: 'xtehuhcxkpkxiulwxxkbfrdkyrzhpjstrhmdxh'
ClassName: 'rsdjhkjjgnejztpftgshzvgug' WindowName: 'fqvoktbomiaecqnjspmmwlpgypmthlvtg'
ClassName: 'savvqbpziwjultala' WindowName: 'qpozsltcngcrcmouleqwvslprktgoxu'
ClassName: 'dvuolzlxqxxggpbaknfkxsayyfontxkb' WindowName: 'atbzuyruuhnifekgbvudksslqhi'
ClassName: 'iunelaedgbltrkoljcbrrsxkpfsaradsf' WindowName: 'wmthapzbfsxlqcyivsffuqafuoq'
ClassName: 'ujuzkurmxmxfchnbhallkcnebwlmrhtmcxw' WindowName: 'wgrbhysyvszxmevfj'
ClassName: 'xhdmwaydsldwrfdunrzlz' WindowName: 'vediikkczdsxqkvpzaze'
ClassName: 'uiaknbyeuwfblipmgezvmvgyxzmqadashnpghi' WindowName: 'xfxsxcrldrsjxcytmogjdcbth'
ClassName: 'wzpujhqkcwkemlqxxrhhlntozhhnz' WindowName: 'hqgyezznxbkpbafqwq'