Trojan.StartPage.59187

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsr2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\Math.dll
%TEMP%\nsr2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'zqfpdokqdexwcaizxlsflnlasqwatfqjz' WindowName: 'bwunflrqsjttzewephislhgmcfvtdlfgybn'
ClassName: 'iurqnjimlbwzkmcfbhx' WindowName: 'yntguwgcwliwmjoywckligymydc'
ClassName: 'difedlbhfgvxqvzupudzexk' WindowName: 'qiutaruxwkabrrfvkgmdfnvibsygahsynvtk'
ClassName: 'lzspkyhsimvkjfzrjqxy' WindowName: 'fcvyorvsglffevckovdsytvomnwbdxr'
ClassName: 'bmijprqyciocrns' WindowName: 'amgmtukkafazrzlhsghvqerzzleoipe'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'ezaweclppircsekjkkvsja' WindowName: 'smcnscwdblfbcdrurln'
ClassName: 'uzhdmzyejdmxdzhjlkycnpqjqohzrrudtdrwtv' WindowName: 'qzgspmlybsffzrptfqbgpunhh'
ClassName: 'aehxpdcmhfhnzxeteceqdiguds' WindowName: 'uzywftodzsastqdigkuqswojab'
ClassName: 'lveoijuwljqtwtzmlpriagdeqoghqmvo' WindowName: 'ntvgzzotzyibkuopwgcuixkseqaucpzayfwyfc'
ClassName: 'fzsrwvdrkpverfzflssamufehzwszwnup' WindowName: 'iyiecrjfbqgjzdxapmetwl'
ClassName: 'yjsiukzthlqcdiuqs' WindowName: 'ctfevslvsygzvjgtzpp'
ClassName: 'wqhocbbiuabmxeoikuvff' WindowName: 'nwghhormgxakufsipyvfsyskutrqwceimughg'
ClassName: 'nhbcrmxghclwdsm' WindowName: 'evqztwsekpotsgbpbuzgoqwegxmuoql'
ClassName: 'nijhsvzrokapiigpxhdfrzosxevcugesz' WindowName: 'frcepuaglctgnmqdirexcmnvqqcbbxyqwol'
ClassName: 'jctlmcceaouafmqdzrbvaqfquexvwpuxppgdh' WindowName: 'gppxkupeaouhxuznxprjuizoz'
ClassName: 'devufmcrevjqxpvskizzojjwjifichpsbzd' WindowName: 'nbdnxoundfsknraigpve'
ClassName: 'syahumryqnalhrmcvjuvyeoadlarimlciemfv' WindowName: 'jycihmblquvjhoowlhkiwkzoh'
ClassName: 'yddfxrtewiikdxwrcvwxebwssmjxuw' WindowName: 'ndsismwquoxqcueavpip'
ClassName: 'csjelmehhnhnfkwysal' WindowName: 'sxrdsyheaqjfvqhefghyjqzlscvciciegrsuos'
ClassName: 'jrdnidxukmolrabzawljsptjpdeflor' WindowName: 'prnludrdhhjqyepxxod'
ClassName: 'ztknoibzrkpwlykpdqcoyfgrtnnktrsiigik' WindowName: 'sjmmmgrafxjgwoaoso'
ClassName: 'tnxyillqrxvyppxel' WindowName: 'anpqswxnajkpcatohphmodsjhgcbybwymxmhhq'
ClassName: 'rmmciobgeokuuneibffaghlokgbvsibur' WindowName: 'tqsrzdkqbkdsfqivriqornt'
ClassName: 'rqxqicodtdudyqdgpaosmuwrtptxtmwgopbc' WindowName: 'rwzsmdncloisyllfj'
ClassName: 'lrjxdvtcufoiwvvhzaxpocqfwahdknt' WindowName: 'yupsldnqdyfnerhpjamsirqpinieqsrre'
ClassName: 'tubsrxdvikmyagofftgqbddieyykoqarhnr' WindowName: 'kilnqlfkncblpjtftuhtiehaeurfmvnnvdhos'
ClassName: 'raqynqxwilmqncpvwyaoswfkyokkmujmzlda' WindowName: 'uaoebwcixrpvhghrjhptlqbwyzpj'
ClassName: 'ixtdzhqzvmhvryv' WindowName: 'nciermpjtjtkdvnxyhkyhgziakojk'
ClassName: 'mfrjshgivnhnctasqtgryehqv' WindowName: 'augbymmneojoajsurlgnbumqxlomii'
ClassName: 'nwhfebbnrusnwiskgfwksyrlikzselj' WindowName: 'cwrqgqvswqyktuxsxjjmbkflftqjdlrf'
ClassName: 'qehpjcxsxkbebend' WindowName: 'bqjnotzmqbqqlnmqfuqvmvcze'
ClassName: 'rtumolbuxfxfssldmtlblvymsedocuxvvp' WindowName: 'eohullbooyygsyhjcdbaisndlbavzxjqawenu'
ClassName: 'wofcbpjjdfjqjnlgeaszteilislxqjbbedz' WindowName: 'lpvhzveeogkqqomdpwvgumhomxrvh'
ClassName: 'obweinzwyjutyitfexumqywalvc' WindowName: 'wpdjpoyoxyajwjmj'
ClassName: 'jormodeefivxhtlhubn' WindowName: 'nhwtyqlhqdhjewbmcctwllfvsvbewvso'
ClassName: 'xvrjlklrqrlmctqbevlckzuwpuiraj' WindowName: 'duheygxkjkffnfvbriviwhwazcrfkmdfxmbqhfz'
ClassName: 'fhpqnrydtqbdiqzhqulpk' WindowName: 'ygrtudaqmaosqqejgznhoronmhwpjjqfk'
ClassName: 'muhewpdpdxjgxqmhc' WindowName: 'iqyitwvnrlesteqnakstsjteujpflhk'
ClassName: 'pamyogvcazafeisxyv' WindowName: 'owgumazkotnmxsvhaxtg'
ClassName: 'ybrlrdvvikuavtbsjsutdcisbkzfviqymx' WindowName: 'cbwdpfpjsxokejwmaihzxv'
ClassName: 'clazjxzbjgnglynhckwjvxwuympeivpaqrg' WindowName: 'yanobnbunndzrsgjz'
ClassName: 'nwegnvujmkfnmavuivbkwgk' WindowName: 'cnhhmvworzknnrjdme'
ClassName: 'kpevmvdoyueoqglgj' WindowName: 'vdksmjhxodivtgvlaxuzgjefczvox'
ClassName: 'tbiqgrpsnjdodztdb' WindowName: 'kxrmvxdnjdogyicmbpqfcuaabbulhfvs'
ClassName: 'efxyfygivsatwndyzcmxpsdgnjstmdsqix' WindowName: 'piqxpjlemuwkqszyzwrifopurazrfkvwj'
ClassName: 'iiaijwsjjrdffxyysmcrozzw' WindowName: 'psudmbrextllipz'
ClassName: 'sbzotxpehhjijzclc' WindowName: 'jfjquxzcpqhqimpgu'
ClassName: 'mdmjcyplnnmsjnmaa' WindowName: 'wtapgfizrvrlqkhxorhhwbfzrvqcmvnxyyhww'