Trojan.StartPage.59172

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsy2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsy2.tmp\System.dll
%TEMP%\nsy2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsy2.tmp\System.dll
%TEMP%\nsy2.tmp\Math.dll
%TEMP%\nsy2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'xhsjkivpcpfbknbgjmqwkx' WindowName: 'zjrhufvtvxxbwljzcsbtaumtxypmspfcjbghkj'
ClassName: 'jzietvncsaymziumflkkveu' WindowName: 'cxsuzpgqwjgjocwapkdiz'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'dmlhskmngmtgrbcqcwuzkjhmojwtwlzxf' WindowName: 'rwzgirsivaxsdsypugbpdmx'
ClassName: 'ckrkjktgoypqyxpgobeuaxlwvazhel' WindowName: 'vlcythuxjvczepfeuqfdrzendwb'
ClassName: 'payjzfbtvdvpqoxkyjfaoartxw' WindowName: 'dvpxcjyvnnqpmhqephcjcmxpyiqj'
ClassName: 'olmxqreeajecugnzhpgjutffinvwnaubmraemr' WindowName: 'kwrzaqudkbxdhmlqhkhchezkmwtcd'
ClassName: 'npaqocupvrptcdvnjjrkqzkkygepgmuymkdkrca' WindowName: 'qodnafrezwozprggidyqfnpnjzsy'
ClassName: 'qgcyvjtrzqkhoogczzsemhbr' WindowName: 'jhyrjqmcywkncbboizdugjev'
ClassName: 'lmkhbugbxexscpcecupanbavrqeplroloaapvw' WindowName: 'psbbphmhkrbisbgdbiypuvzhb'
ClassName: 'jyijqstlvudhhafhrvoqkjxe' WindowName: 'wostlucsjuvabqzahduaos'
ClassName: 'nzyqfjuqmdknznbjczgemelg' WindowName: 'tyuywjuzcxagaqavjuxhmbqzjzdmctiinanpoxs'
ClassName: 'jcuykbrnbtjqoeafl' WindowName: 'ctdvahdwgywdkhijxnsilulpbrbgnver'
ClassName: 'dkddzhwxztpsnbjqoxgwra' WindowName: 'ebiqawktqcvgofajulqxesdmfg'
ClassName: 'wvcagyonovxpyhhghzhjucsl' WindowName: 'pzquwbcztxwxcapepgotecewjpoustkjq'
ClassName: 'uclyhdqntkqpnzgqpqljgtfkjdbfwjmhij' WindowName: 'gfxxrluuqvdmlngzbozfblk'
ClassName: 'xpevffifbgwemrpnavevvyoclghbbyublwvkiu' WindowName: 'rumdzuetnistsasubvvnydqcuxiqpwxlatylyi'
ClassName: 'qxpkmeljboictndnwnkuzrxodzmrrlflr' WindowName: 'aydhjexnapmgvnbqryidhydgjbtcj'
ClassName: 'iwncytanzqsmhkyocmkxfbjkjqfwkanduwgizhl' WindowName: 'jjcgvjplfddwuuxiyzjm'
ClassName: 'frehchyilofuhngsmogmnelna' WindowName: 'elvmihcaelocnovdrmwyafxzkwqbgqlfhkwepu'
ClassName: 'bzrkytadksxjommljydhfvjfwmqhue' WindowName: 'whjwohklkwaevaj'
ClassName: 'funhojvemkomoskntkybuxt' WindowName: 'lmnjvybvisripebysewvbcsluwqjujh'
ClassName: 'rfjmpjwltarpvgjjvouk' WindowName: 'vwyxdnbwaucukfax'
ClassName: 'lvozvnwyvuiffzxdlbkcacgriahzgspcwwfrk' WindowName: 'qzvfzwxsitwfxaj'
ClassName: 'blxcxairdovyevjylkinigsecsnerxady' WindowName: 'spmzldxjebciwyq'
ClassName: 'cqtxlfjgetqsehw' WindowName: 'gudrtkfnnftqouxectyrbdyvknxvohvqu'
ClassName: 'keeuiyhmyouofpbki' WindowName: 'cgwyrqzrpxbzuxdmafijyjigfg'
ClassName: 'qygduahybhjiefogrdtjqvvqqkva' WindowName: 'pfwvmoggnjelswfo'
ClassName: 'aejqrbcbwzybxmdsbnnxgdnyecubmeh' WindowName: 'kwveraqumolpzusgmatmrjipa'
ClassName: 'aunxkmhbjceijzf' WindowName: 'jycppqijhpbbonslu'
ClassName: 'aijmybqzgfmmxvlyjhyircsrcwgzuideictv' WindowName: 'ycsrfsryeldrhevpirkaoojcqpskjbggpdifl'
ClassName: 'gahosdmpmacxayikfthtwlxvxcwctvgchs' WindowName: 'fxjifwqlfugdhvjkujwqtbmnfdxl'
ClassName: 'bgzogeddbspnkbotizxhqnplclhl' WindowName: 'zfpsjccbzmsovocpkjsjpfgwamkmrvfheq'
ClassName: 'bbrgghejgskoanzybe' WindowName: 'awobzumllbjcxtqyh'
ClassName: 'oevcxrbzqvbzttgmtvvqawhfxpkgaduzpptt' WindowName: 'hawcinnynrrcpeqrmckmbqollo'
ClassName: 'vxlcymqengdpbkhvmqkdqslf' WindowName: 'sgavpzvlsjuffgjr'
ClassName: 'sanwtiptsyboogkng' WindowName: 'vgrbbjfwzuxmnwirczoxlltzqikdwbzmvstivei'
ClassName: 'lczaiourqacihkxmgfoaztucqix' WindowName: 'blxloqczpuiqmjkqxxxzinsieq'
ClassName: 'ffcwwxurtuolnznlzcs' WindowName: 'elqsqyvkqbawjwdsokxufonlcyltfism'
ClassName: 'rbuozcfvzfhelabaw' WindowName: 'aseoniishynzyvzhplgyfjqsbsiulj'
ClassName: 'rnxhbbabtatqmsnardfnq' WindowName: 'jqyeomnfqtlbiuonpdsoxodyjdqky'
ClassName: 'spwqtrgjzweuyhwpsmydmbnimdqvxbicsj' WindowName: 'lktighprpmshurm'
ClassName: 'enzspwaebnatoptyccu' WindowName: 'utfoztgacprxryo'
ClassName: 'ttpmjjfclhurogm' WindowName: 'swynwecmdrcmvzyzejbkqravimqnfdn'
ClassName: 'stzcfpoowfyidnmepkszxdgknxnuhuu' WindowName: 'dxpuejkhgsjwuoybxghowwiuyehcekuzbdpxpv'
ClassName: 'jparthmulursskdyfoooaeiyyrn' WindowName: 'aluvrygseviufsqnugq'