Trojan.StartPage.59293

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsj2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll
%TEMP%\nsj2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'spewybpamyikvfi' WindowName: 'doxcuxihetujxyjdsayhqljrookcudz'
ClassName: 'noycdbeffnuahduepndpimcyqzpjhqhkoloz' WindowName: 'qtotjwjlgbopvnzsyfcbkbarwhnyzaahgjofys'
ClassName: 'jbhqmgnxrakyitggwuucaszetmafbo' WindowName: 'uzkcbnxwzuwjfasibvmmrijoucgiqonbnvtapy'
ClassName: 'fxpvovgvpmuxwqptatrw' WindowName: 'brtlnozgnwzxlwiunlymdeqlls'
ClassName: 'yinzfshilkyryeamulvsn' WindowName: 'vncbgjxncjyevtkbympbjxvbuefsrvg'
ClassName: 'eoqlbtuxuouqpvlyekkoskqucefblyltxy' WindowName: 'yjahrzpxdlwfnajhjqbkwue'
ClassName: 'wgrvuznvmobfeejfiggiyoavhnpkzesrcx' WindowName: 'uxypinesohlpjytxotbitfav'
ClassName: 'uelyozaawlhgodpdkwmnvnhg' WindowName: 'sszlyziqzowpoaloamvbhfe'
ClassName: 'buofqatimbkefunvsljlr' WindowName: 'ivclsptzdkipydzr'
ClassName: 'liemkjeyxebdopzygye' WindowName: 'fmxeavnnuzncmrkuzrgnxmpzuqf'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'xhiwjxbfvrzrmtqooqogxhefpeza' WindowName: 'ztsztbedyjoydovtreocm'
ClassName: 'saopziegdhklpuyghkqhkdoblwcjndirydu' WindowName: 'cpiozgelslaxzxvkogwrjpy'
ClassName: 'mkdfkgtrobubtdqcohobipbvxhq' WindowName: 'gdzrxgxjnwsegrdsuucoqhv'
ClassName: 'zzctiovbvcneufhkgrkxhmayemimvihwrjtcha' WindowName: 'rcaanzuxxveooafivrxwycqfurfw'
ClassName: 'hykhoemsumdmukxr' WindowName: 'xkmfubrhkqnhfwcugahy'
ClassName: 'pcjzfvbhnukroenqxgs' WindowName: 'gryuohbembxyubgfhuwbkffzfjtprwnys'
ClassName: 'axdjlunpnvehsippvwntjawzypxncyifof' WindowName: 'dqhkqsbbfhmqwujurtky'
ClassName: 'wnkiocxrowjqumfijhjycdwvmwuuzuvwmqagj' WindowName: 'jmaaodeurfmhgpqrjr'
ClassName: 'roezkcjebiuqtne' WindowName: 'dvkdvumskltbmjrgggdqlxyeix'
ClassName: 'boxtddzmlqgkwsshf' WindowName: 'iulufmfspuolhdjtoszlkwhalixcwcpgyvudwb'
ClassName: 'xvroirdilqhfoeukldgjrjxwizlvhemp' WindowName: 'wgxijjwzooekkbikwonmplytplg'
ClassName: 'zejmzpumicpxurply' WindowName: 'vovntnecnsetyapziavpmgisvkvvmkprxuvoz'
ClassName: 'riyaqnhwepvrdiqjgklchrzelhzeldvdt' WindowName: 'txuflhuzizfyitvmasc'
ClassName: 'agvsvwxniwxxmkmhucmybaiyffhbc' WindowName: 'xszsdhggaazyvud'
ClassName: 'gqmgjxceryiqdirmdtfuj' WindowName: 'eavjdwxsghkalpwqzswuexuwhtoyedcnfeqa'
ClassName: 'eeziqjdlpdkujkts' WindowName: 'fhnskqemofwbyykousgj'
ClassName: 'xyzmkzhhfsgsvftfenoxgxktsloisvholqsdn' WindowName: 'srvbujaujdajtpgb'
ClassName: 'ivcdttrfyisrnjmxr' WindowName: 'wnkcfikrvwnvpctnjmnmwxg'
ClassName: 'uddyynftunmkolrdsq' WindowName: 'vqgbgxzyykpjtqkq'
ClassName: 'eoeaiinrjpyvdexlqrgescygyu' WindowName: 'dkmzklfexhwbelvhnvmzlhsruhbyncnqekn'
ClassName: 'rdnbcelybbctauohtzbqa' WindowName: 'nponekdvsnjqmozzyicbpgixobk'
ClassName: 'xfehlfsqlyvnwntdpvdlpomruvvaq' WindowName: 'gvaagkfdjxmtsepzvihp'
ClassName: 'fztqkzckxakbxipgvzujppcsieq' WindowName: 'qmwqgyzzhcxpsmmnkryylrgkdrdurkizibpqo'
ClassName: 'mkrpjipvdtlgmfgodhkpmwsvfvfpeznrcxpr' WindowName: 'rdwbhgxoukiaiqonxngbdcxhekgtrtlryyvx'
ClassName: 'jqqjwiaemfyfmahzprre' WindowName: 'rpeoliodfcglkijldhxoyyrvvarqpufz'
ClassName: 'ddkbkprhdggaeegfgddz' WindowName: 'idixxkmjqonshtmkirvstthrnsccxdt'
ClassName: 'hmycerbcogxsulfgsyejlc' WindowName: 'ocansqiwhneeeyqbh'
ClassName: 'jyzvwahxggxsibdzazsl' WindowName: 'rvdskvvcdwcakomlzglzodfkmagapfbwkaxzpnr'
ClassName: 'udctbzillxatljjbobiapsxzmwkwphyiqgnne' WindowName: 'wbzwzpvtuxptikxivvabftlf'
ClassName: 'vreqzrnwcogzakiuhfbybyjuxlmmfv' WindowName: 'vfdudpdlixzoyvxrao'
ClassName: 'qclgscvhmdxxomzi' WindowName: 'kaeoekwkuyksscyrzrgn'
ClassName: 'gifkwvcsrubhxckbgk' WindowName: 'pdvduuyabxrfwzssbuqpetlbcckftqyzgixmt'
ClassName: 'pmqwiryimjfugjkg' WindowName: 'geuvpprzxgbrgrptzcvuqyexxjcmr'
ClassName: 'cdkeakemygahjrfkgwnnn' WindowName: 'kpnwhkmrapurbbvqxhq'