Trojan.StartPage.59223

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsd2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsd2.tmp\System.dll
%TEMP%\nsd2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsd2.tmp\System.dll
%TEMP%\nsd2.tmp\Math.dll
%TEMP%\nsd2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'tjpnqnlkqqjbsgxiqbytd' WindowName: 'gsqeglihwyramrvcdnq'
ClassName: 'eeecafhwdejpvlszjag' WindowName: 'jrbofaibogouptwimqs'
ClassName: 'pincjouktppgtnra' WindowName: 'hvzmfuapbapfgixmibqpkjbuzskzrkrhotfvu'
ClassName: 'wsceipdnpfhjkkcjse' WindowName: 'ljxxkuskyfdikwufdkcczttgyarxzqvjar'
ClassName: 'pfgjpwrvvijfzgkyfs' WindowName: 'birnqydkevulufdduofrcrmqernkkxu'
ClassName: 'lpxalhflugwdbbsysbavzvaqxlfob' WindowName: 'wgxrrjeynregdlbdrrdol'
ClassName: 'hyzvojpvbckcmvemvmsbwbqyo' WindowName: 'uekewoezmzqgbwqdeefu'
ClassName: 'nterflysrnsdnhpmporoszexjdva' WindowName: 'topwdzlwpfwehgtnhumrhampyagxixybzhsckkw'
ClassName: 'waafrrabbnuajsgzwmsrr' WindowName: 'ashmcjiysenkidotfoylreosjdvftphjt'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'esfalwxljsmokiotmkil' WindowName: 'aamvfmtwlgpgfjbqknedddgddvvm'
ClassName: 'nzvmnxtdqdsgcoxc' WindowName: 'xeludixwnefjmhybqceuzraclbpekzkfojpco'
ClassName: 'tvckelzbshqwrjmvvsuq' WindowName: 'tearvzjuewpuximx'
ClassName: 'oalkknvzsrnmwqvlzzkcidx' WindowName: 'chvmournmygiijwrkvriegxalqwkcsrbhuwfuaa'
ClassName: 'iqelmvsrzazrpgcuwboocmhljrvbzlz' WindowName: 'unnomfdhcubauflpxhnlbedibvnufclwxfid'
ClassName: 'warooueschwnpwosgzrmpzbubuxovabzv' WindowName: 'itixewbssjunlsaqurifdtmppakigdgk'
ClassName: 'stqfcbsczzehzrpeaccuronzkjdxkqi' WindowName: 'gucujblpcdtsnzfpkylhjiwdcnssqpt'
ClassName: 'dmqfmrcybasjtksivj' WindowName: 'diekhikxrpvobexugytlx'
ClassName: 'gofinyrctexratsmtqxftvrkzqddqbomarxto' WindowName: 'nyofytfwkddnnlieb'
ClassName: 'bghophvhnitpcvdwwlqi' WindowName: 'vawwoyvbnfegbgyvjl'
ClassName: 'phuupiicymtgsfffhshjmotsfvyo' WindowName: 'ilfeaaoxwwsrconurnosjwnwl'
ClassName: 'uloxnenymvpnuewoimsuwbngraqlgwr' WindowName: 'quoyunxqpbbhjlcipzrbudetgafngdspbdgr'
ClassName: 'bsvcbygquhlspywzmhxj' WindowName: 'bpvnqekywgyiqaq'
ClassName: 'jfnmiqdfzdcvdxigocpufeukjizswtzww' WindowName: 'zoevogtvsjtygkklqxepp'
ClassName: 'rwgqivelckclcofdahmpganznsfaeusfxumwxq' WindowName: 'tczjaqwlsjmvbaaxef'
ClassName: 'splnxycyfheazbsqufnisxh' WindowName: 'stoyyivorwrxbyl'
ClassName: 'uqmrexffbjzxukhcpvxjpwkpnvbluxknyppuq' WindowName: 'chdasezaqrmrlemymameannakuhmipblbbiew'
ClassName: 'bxrjrxuohtspslpsmjwkcuxrvuwdzhuflf' WindowName: 'rkdjadyloinppxthqkmrgvjxvzwaxrkqkg'
ClassName: 'vikxhwlwxfffnnlheocwminfjitpgyr' WindowName: 'ncnddvmwzqmkdrgrthwscmj'
ClassName: 'mywxgkaqfbcrzxdtkfoyrefocqpxzeqkbmsklw' WindowName: 'dgjoszbpewzojjmh'
ClassName: 'qznaxdnzncuxnesmabifdjudcgaksmnb' WindowName: 'qybrgmxkhozbntbjoevoiwhaxxhniwwvyssjxe'
ClassName: 'qhcjsentypayyhcwjpppybyzhsryixwalrftyax' WindowName: 'dueixlnsehpmhiqhffveewvntjmenzj'
ClassName: 'brofaqcdicxtrlehmthxcybgnawvijxwoegdjl' WindowName: 'tiafrmlzduczlxhhkrtevhiluzgifmuvgwmv'
ClassName: 'rctzrjmvsulmcopllbntzdplawmoqs' WindowName: 'iwflbfndyguwdpynmilgtgqn'
ClassName: 'jkmakngivfcqedwhamwhwek' WindowName: 'mwbuvnowewsmndwowvbuxeqtfwza'
ClassName: 'hnrwvhvbjetxnfyjzwqstxq' WindowName: 'xjtvgavoprmpfkjzklqgp'
ClassName: 'uwwxjthluvvrlmwgaklfytxyoslpajpvy' WindowName: 'snnolnohokmmlwdomaprvbq'
ClassName: 'wvadnbtzomwlfeqdsxsxjjxd' WindowName: 'jidvhjwkpvkhblfiyucxtnrlxdd'
ClassName: 'fpjniknrnxzckirthseicza' WindowName: 'samiwrthtzqbkhpcycsalwr'
ClassName: 'phqbdewafxjukgazv' WindowName: 'temfmadrtekmvqjdcdnqdcz'
ClassName: 'ephppqcmilhywyhqcgwizymwzqlukwq' WindowName: 'hqxzlonfitxdhlszcodzbkwyobsg'
ClassName: 'jmgmnqkclyrygykzjqyfyzjgzmciwzzurmw' WindowName: 'eusbnjkufznfyfmj'
ClassName: 'gcqfqvnwlenlilrxrmfnnomqnrrhhfuamx' WindowName: 'xuunqylasnfqsykitzqmrrujvwajcxfyxzynhdw'