Trojan.StartPage.59229

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsv2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll
%TEMP%\nsv2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'hphspqxlofkbwwhxqhjuxgouzqxknpzhfcovn' WindowName: 'museejexkixzanufbryhiodtfphjmbfnc'
ClassName: 'ahlvcbyawxvmxbrwkhinfczssqenvnvyea' WindowName: 'csbrjmhooqcexoirflvbs'
ClassName: 'krjljcepenzhxajopdeevsbmpmdymbowsxzyigd' WindowName: 'axkkigtitlicldfeqeczmrumgsraexxmcvp'
ClassName: 'zhopxpmxybvybsipyqskk' WindowName: 'dfdmdzrnqzrcozgmqjgjbvh'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'umxvwhhjkeulqjdelfhd' WindowName: 'nyjjbybnxksyqzbjscoybxlsbtpxpho'
ClassName: 'gmoaokjvqvfkqunqibc' WindowName: 'bcdvhkzwkfojigbxdxqjlmzwkq'
ClassName: 'ixgvmvoyijmyddvihsphdlsvwei' WindowName: 'ndjrwkncsauhzarjmkxfecwqogcugq'
ClassName: 'qapvhbbwmpzmlsdfowiubxofryj' WindowName: 'mtcnarstzfuqtfnuerpjazvcbkmzmztau'
ClassName: 'hajjyiavigyjwlocajxhumx' WindowName: 'qipnhmheonjvqmgbpmyqfjfpemiiz'
ClassName: 'eksdfdwjlcpgfkslbbynzkbvmjnc' WindowName: 'kpwsrhmrsafkaecyddvaurvbuvgjmiotsaolwuc'
ClassName: 'gmshumdtsupgifveucoqcoljqpmahlph' WindowName: 'rzhjfyqtwlmvzrwbciypscosyj'
ClassName: 'agcanhupjipkcwslkawunbanozxfdsotknmr' WindowName: 'cwjiwzlfbjnakkj'
ClassName: 'dmjkupoisynlulxygir' WindowName: 'kbipmrpkzfcilbfzsl'
ClassName: 'ywrhtjvdnxryfxu' WindowName: 'eeldsoojedryseawnztxkmjzodhf'
ClassName: 'mhzsgpxyoxqprziifxraaffhl' WindowName: 'tdwosovdlipfxbt'
ClassName: 'kqzthpejesrqqstizzvsdvwaguemzuopzsh' WindowName: 'iynawlcnhhssuqzguswwpaoqgj'
ClassName: 'xkuhwdbyvlcwvxglbasbbtrpqhbpe' WindowName: 'guirefblwusxhpr'
ClassName: 'ptdrpgninxlehrsrvgbqoxxthhmdvzvwsqlha' WindowName: 'obicbbdblcbjfxfcgnhuvm'
ClassName: 'xuvxycqeiuowhcbztxcojcuxgxyxn' WindowName: 'pqcobvctxziwlpyvhirxjruotuguyraimeicyyi'
ClassName: 'xsormwsqnuuctpfiddmzmgpmaszmgnrs' WindowName: 'ssmtgyijpmaaotogjvioegjnsbjirbwdocdnv'
ClassName: 'seojxyderncbmncucvxvlbngcrvjoarinlrs' WindowName: 'gauvsiqyvscynmpqcpxkiuvdg'
ClassName: 'iuljbscowvvkhql' WindowName: 'gvndmmjnobqkuoxegvzkshjapbzzmpbst'
ClassName: 'aquqbadqpmhcqgtu' WindowName: 'woefmxeaphhrhxfvixnsowopp'
ClassName: 'pjlxxhxpzxvjedcjwyrv' WindowName: 'kllabzemrectfwzhmloufnsfatfxcp'
ClassName: 'zgxfitbzzhicjafyjbhbsd' WindowName: 'hcsltbgcsgeumngvucpakmokcgneykoirojsvk'
ClassName: 'qkwneksdhmnkhtayqcabtnsrfqlh' WindowName: 'gzmvwkpqrmuqznosblzajsdxdyokvmhktutn'
ClassName: 'fprtmfinyuseammxsysjzyfncnkivwut' WindowName: 'hplcgzmssqbmbedekcmwdcdyelgndtkwwoqbxn'
ClassName: 'wbwuwmfsinpppkltdtrd' WindowName: 'dkorilmunqtsvcyvyhhdrqnehstzrfhqlsqywwz'
ClassName: 'krdwugfilfwucgxszvsnty' WindowName: 'ulicxemxguxdtzfjiilvat'
ClassName: 'tpnrtinlktlyeiektkwvcdkrklzypwiqxjroeh' WindowName: 'gpwygdwtctdhsuiueqkkcuquoplsjvykwjy'
ClassName: 'abhqdxifvljuodg' WindowName: 'xorjkqxbhzfjkgjv'
ClassName: 'enptxapnvlqodkolf' WindowName: 'ecrjqxpvpmshhfnyrefo'
ClassName: 'aktsjxhziezzpnk' WindowName: 'ztosjfbdlanckuirvuhp'
ClassName: 'vvbqeyxdnecamshcalxofprvj' WindowName: 'bwugrmmcujdqqvjs'
ClassName: 'nxwtdfvbbobndfkffftgacjidv' WindowName: 'pcxclouhfvlhylfgiepgxcrbsraaag'
ClassName: 'tfpsobcxckywpoepocyimketqsxekhmltuay' WindowName: 'luhmfhxiynelqgneig'
ClassName: 'ezwbkxhoxzgyrpbzpkjxtmbhmoijgzqxdwfdre' WindowName: 'kfwdhhzhvvmmowgwxhtiwthrfp'
ClassName: 'ftfibxzcchmgktvsktgpxavazngcbz' WindowName: 'vpyemnpzxepelijbxmdzeyyjtqcquisicvqq'
ClassName: 'ixruypdsvbazpwrwocrupb' WindowName: 'efvgybryoifiymbtj'
ClassName: 'vqeayqxikxedoxnpdyaufosdmkr' WindowName: 'jooajpvebofcrutrff'
ClassName: 'evdqshpmccrcphpghmylhus' WindowName: 'jhsfsdnmmaobzqxghhlcevakjunwrxqci'
ClassName: 'jssbjofvzochsigkeotm' WindowName: 'dguopodgzlpxfibmzeupgwcerhifsb'
ClassName: 'orxwaiktjkjtjtqgytytnysmzwi' WindowName: 'koyqiugphjizcwgyljncsklia'
ClassName: 'odrexsfkofvhjevnge' WindowName: 'tapruswpmqwafbuwzgauuxmuwthjvpqv'
ClassName: 'sqfkklcbainwuoiuyyqxdqsjsqgdinxg' WindowName: 'ezevjpjjhhlghifh'
ClassName: 'vaykeydhmpgfjrbkfe' WindowName: 'pibyurkrausygcbetopnl'
ClassName: 'hstuujhxklmhwubhqqkiuvgvrlwdbzvrkz' WindowName: 'ocjcryelslkrseazjudx'