Trojan.StartPage.59346

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsa2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll
%TEMP%\nsa2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'qdurxgqmisevvperzdnhwwgkbctbnvyepmkv' WindowName: 'lmsxcbkyyiwtxrijucjmxuoz'
ClassName: 'kqdybkcdsbzewofd' WindowName: 'qviszbbqaquhmvbthdootgpgsiajd'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'besuoktmstabfhjcbye' WindowName: 'mehpjriicjebkidmjusozbfuorpzyh'
ClassName: 'urgxruevtyrcfrnfdrgowyxpelolqlgsg' WindowName: 'fxgxrvzmjzuvhcjyamolapdxzen'
ClassName: 'uuqkxkmyyimqlwvuvlrunnvusowwglatz' WindowName: 'vvdjmibazkfqrftqlreqguzfyrbjqh'
ClassName: 'rjypcznwtyhkfkjaqbcgd' WindowName: 'pkkmciuidvwxjdrp'
ClassName: 'iiqgnkkchgpmnhryecbayn' WindowName: 'fbalwuginbdckkilsltxwfvxxfdkmouovef'
ClassName: 'dfolslilbujektqyvinfgebzw' WindowName: 'aghhqufhqgjupdtn'
ClassName: 'ocdjhgblboxukvthnfrwdhfeqnjfbaehgejitja' WindowName: 'xyvgfgrzdxpvajbrbwphlnyuvezzzjrijz'
ClassName: 'trnqkleqyrrlxdnysuviexdecirqhvgloktpzl' WindowName: 'tqojdnghttzmnvvgahgljgsq'
ClassName: 'gzcodscfnrqhukor' WindowName: 'irszbwwomuquvjfyqjlmqnjvjyepgd'
ClassName: 'zstmiikdayglbaxgenzihliendqyewjyhzikkou' WindowName: 'tsomuwjnkhwspavrljfcklmrjwkckqomhrdn'
ClassName: 'oapzwnbbpknzunyftsunxdqryuywurabynoton' WindowName: 'egpqyniiseswxeqwfbnxfjkgybufp'
ClassName: 'sgvggaqzglcprlrudnzjctscsjgkchktfco' WindowName: 'tmxqlrzmjlbcglbxtsswjlmli'
ClassName: 'lfpyxsuugrpbbugnpltgmwadhhtfayhmmfr' WindowName: 'uepshpbjjveizesfmghrxjo'
ClassName: 'eouhxmxpklzcgolqf' WindowName: 'dyegslnrripumrtzhoqdtkavqbjkuqaxlve'
ClassName: 'yoqnlgvqdllvdghhky' WindowName: 'yiicobubfmeyvczoljdthtpvhxrfv'
ClassName: 'komdyvpazcidbyuqfesm' WindowName: 'fazgdxwxqegnscpxqmsnnpmczjjbfu'
ClassName: 'oimrbierkuieyjrssax' WindowName: 'hqzcnxeqmshqhcqkuw'
ClassName: 'ipzeydvqovcghcxgxlnzh' WindowName: 'mvtrzysbbttblaycugf'
ClassName: 'vsujmwpsdciqzfdjvdtrrdpavfxvvghv' WindowName: 'fylaemndmyggaugogyqlqeskuddelvrpnlbrsx'
ClassName: 'gdwdbeboeyedqyeubyyz' WindowName: 'lpjzdkpxkkjxphyfo'
ClassName: 'jfatvmnugctuhmhrxvsfqgggqojmdvbcv' WindowName: 'lwejgwbxxhfkhqtveepcovfdnqsfej'
ClassName: 'bmlkhmhpjtaavsxjxvibnc' WindowName: 'xoqtaxitsysoxwqsbfqdmqf'
ClassName: 'gizglptvlsqkjvqowmpnkuontifggzqlwqn' WindowName: 'pyxjpbxpwyiukcvcca'
ClassName: 'iskgwuurxtzyovlgptkcvlzww' WindowName: 'fqftqrzypcalwfxsm'
ClassName: 'oieyruibgutlplpfuffqwarpegslxumo' WindowName: 'keqctsqzbbmsakhlxox'
ClassName: 'wzgtuldgzuoayhhkipgf' WindowName: 'sbopzjhkqvaylosxkbgofpydhtaan'
ClassName: 'kvgnbkntqolxzwelnoxlifmffuavbmyrjklcd' WindowName: 'omxkeoskydlfiszvfjqlpddzrhihuu'
ClassName: 'kbbcmvdorkkrskpvr' WindowName: 'mfjcsprvdlxtqwjmlhcwxyzoxfngohx'
ClassName: 'urkcviskvvgphwoiwlnes' WindowName: 'fprrvfduidwkrrwvisgprhcjarfzjqcc'
ClassName: 'axtveeopwudnwbphelb' WindowName: 'jvesjkrffmdwpin'
ClassName: 'msajmgyrzxaimroqkmdbrozzrft' WindowName: 'vjoddpfhitmfwstgktviukdjlycpkykaccwt'
ClassName: 'btqicrqrwkwkmkqbukmxqdlbmlgoffhj' WindowName: 'jdxtajvhrkilweuzuhmjvpspwukduprywda'
ClassName: 'zxprddhridvczgwifns' WindowName: 'cdppvmtvfovazqveiuxzgqvfjw'
ClassName: 'ubjwhsbefkowbsvekymrlirobsqhxahmqimin' WindowName: 'pacosrdhbklfqpvwroysvhpkvlmvikqkfvlwzs'
ClassName: 'ampyzlwlrmveuxngrhzwnbwwrpqlogkvmc' WindowName: 'ovpbcwofghifmpjobtxi'
ClassName: 'nhurbtyqhoexxahudgyaelktcpszkgukuxtgyz' WindowName: 'pobleqccomahezjctzicijqwigupoxfguwzbjfw'
ClassName: 'nxsjdlfhdmwdkzlzyuwmwngoavgisqznhcs' WindowName: 'zpdmeddsgbplveje'
ClassName: 'xzetvklbwasmadezpinevjrkxht' WindowName: 'oosdtidtfutchvwabwmqynisofrwjmi'
ClassName: 'dltubltkjowgonduqeobdxhjvipj' WindowName: 'odedekcbkqyemglmjgcmsqfmakkhwz'
ClassName: 'ntneadhllgjmealqjqngpkxgm' WindowName: 'rzmjfzpwkrcguphwtcwfwvvl'
ClassName: 'bjavbbypqpbpzkuywgdpzidr' WindowName: 'cflwfsiixcujjvyqdlap'
ClassName: 'xxlonuqghknkpmzfnt' WindowName: 'mjynfupjzcxebxmygkzhpzzmfyxq'
ClassName: 'uxotifciebbmwhg' WindowName: 'wlqzwpkpgjahliixqgxvmzdhhepnvcbm'
ClassName: 'knoerlfksgwaktguymdqjwogefhgcm' WindowName: 'rwirovwrojdnppvxblpitvhoehvc'
ClassName: 'paxhothpqdizqmcrgixl' WindowName: 'dnvezirdtlstrbqxqcfodeiiowqxcfrysxjrtkk'
ClassName: 'qpekiqkyhdavirz' WindowName: 'wmdgzykqvfgjtclaokeiheyoub'