Trojan.StartPage.59374

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsj2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll
%TEMP%\nsj2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'hufpapvczbnuyocfxgurphdoeryctqxhitaijoo' WindowName: 'xorwtgclwwslcscnnufvlarsxyma'
ClassName: 'zfgujmtihzvdbpemkah' WindowName: 'pjnyawlkgkfipewzvpvixatwrbrjmpargxeq'
ClassName: 'dqpqhkfmexflnugom' WindowName: 'iininycsybafupg'
ClassName: 'qflbmvrnejkezcrprvk' WindowName: 'nfhosmxstncmtfbvszvastcstvgjjbrm'
ClassName: 'anhtfdsihpsixjngbguqomrkulavvw' WindowName: 'qslgqffuutbolgx'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'yyxmslhrjdemaernxuuogftsgaieqnmwmhb' WindowName: 'dkwgjhtzexuuifytrlhdvjaqaurjlyoucjvo'
ClassName: 'pzokkwnxmpeqgzsfnxaiela' WindowName: 'adyyrefhrcpvpvkxzkajojahgblwviuvwo'
ClassName: 'ssjlmjnnrehyitfvx' WindowName: 'dgetdorwmmbddqxdtkxu'
ClassName: 'nfqkmzqdssryludxuvosexxzgscih' WindowName: 'cqhjvlxucrweqzaecsotyw'
ClassName: 'czgbyoqcutshfebirzitlldqtijhlcu' WindowName: 'igosedoyegxhcievkhujrbz'
ClassName: 'cknxprzldyszgzujfcduu' WindowName: 'iexdamqupjseivqbjolbweoadfqjsnjlf'
ClassName: 'szmyqsvhbtxoryamseweyfdcotby' WindowName: 'avicqeihdwgbfikjaxicaae'
ClassName: 'vfnmwspavrnsxglsflygsx' WindowName: 'rwoegubuioxrexbtwrrjghgqlh'
ClassName: 'yjvfwaekahlyjqfysdqnxbsxpfobifxau' WindowName: 'vhkalapltezknrjfoiyshxiqnfidx'
ClassName: 'xhkkycowclcihnadvqsnd' WindowName: 'keqysffzpiivachjsbszbjipxfvkwfsvmigqya'
ClassName: 'arxubjynnormnpqfyycteyqtuoowepydu' WindowName: 'xailrmwobpbthwpojdqgdziyffysznqaka'
ClassName: 'oxdlofgiwczbldrmsejwvjk' WindowName: 'ajlhruvnxtrtdxfepcogpmcvdnxcsfchnrumwv'
ClassName: 'mttbqsgzvduixiwxmzxbjaeoyzizngietr' WindowName: 'ebsofjjpwmzeumhkgfyujzlpgpyksqf'
ClassName: 'kyalnndkgunnlouvxvnjwpvcnhmnkob' WindowName: 'jdsrpieafzrqyjkjtwprobgyztwg'
ClassName: 'bqqwwudaragongrsypptzggmjuesuaagmala' WindowName: 'ihwchynbdspowlrwres'
ClassName: 'mnklptyikxhrqaeifwqcxaynnbaeuzhathg' WindowName: 'stwclwlcprdeqqtvgqpxgfpbyqcsttrfseh'
ClassName: 'ypvhhjojbxrmcgowjsqufiqyxqwtjljuymrbhpt' WindowName: 'phkkdttfmkdnxwhugvr'
ClassName: 'wbyajivnzrhugfictw' WindowName: 'mdzbkxheaebazrisvkkdvvvhng'
ClassName: 'khsqeussweuwmagkraeoocyo' WindowName: 'qpnltqmdjoxuvrbcoofncngaalyym'
ClassName: 'hpngjymyuocscvuw' WindowName: 'viejxacmbhiycriusqlrwiojijgygmdxwdd'
ClassName: 'wdtklyuyeobixarvcseuxd' WindowName: 'gfxdukigeaobsoxgcwag'
ClassName: 'fvskckehlxxlfyejbicacbjjqcsd' WindowName: 'qhehjxrkhcjoaqc'
ClassName: 'hrhpfeldkbjszlcekmwyfkpmfssdqkzu' WindowName: 'lpzggvyafrsbnpywticntuzdh'
ClassName: 'nokcvglexmwxtcsahhihxksfwqpbuqh' WindowName: 'rvbeyszqnxynygfgogeyxkavmcyysofycxkdq'
ClassName: 'nghepsbhbilqagpyraeu' WindowName: 'lfczqaygvxfxgbeevjecabjkbuqty'
ClassName: 'cyyltcpdzivqcrxhpz' WindowName: 'barmwgvhjprznpqemy'
ClassName: 'saosqzkgfjkrwzzmskqqdwxwyoif' WindowName: 'zfeunsgypmzzgthbhoevfvedgz'
ClassName: 'ejxwehkdmhjvtrsvvao' WindowName: 'dslrqcgvtdkftofuevogycyrwohojkizidjzfbt'
ClassName: 'phaytkyyyimgwivpixcfwneucxpjvroetj' WindowName: 'llozkksstbwxhnerbryfhwxmahrucuqmbtnc'
ClassName: 'ctmaupsfnkpgxqcdy' WindowName: 'pebekrmrbbszcymflyjokehbaxifsxqxvwfgktl'
ClassName: 'upddxoupgixkalcy' WindowName: 'wgxhkysrmfnrttvqtt'
ClassName: 'ygzlamxkbrhipezrbofe' WindowName: 'ohpfmcareznepggisfwdxnw'
ClassName: 'gimkxzfbdvenqxkrpzcjrfpxtotbgofoatvduxt' WindowName: 'paibcovcndvkdjfwqafo'
ClassName: 'hcjlhyqszmcvclppjmkxwlmnkpwuimje' WindowName: 'lfofyohvwynryucoufth'
ClassName: 'moixkqlkpfaetbvpugs' WindowName: 'ppvguczzrxsnbxtmgaqjtr'
ClassName: 'hduqgmrwqpioejvlghrqdbwqzopgj' WindowName: 'gbuqejzmbqciwemjxojhqtermdjgsaau'
ClassName: 'rwinkdjjbcixqvuug' WindowName: 'edavjnkzdqskevrmfxyhhkpjjs'
ClassName: 'ftmrsubuxycidcjprkmbikxt' WindowName: 'fohfbpsbrpjadpheknzvqluesdqahy'
ClassName: 'lzhqwhxkhrdukswsaykfxgbvnkpcwybqxasl' WindowName: 'wmzdeacvlhxsxjrhcvmjocvckwpxmqzycgpxm'
ClassName: 'ddcjyhxdjcmapjxtlijfmbvihm' WindowName: 'jllalihdygjfmywbugnidhcbf'
ClassName: 'xuaehgfpxbccfgoupvvpf' WindowName: 'eoligevwesbmwihsxdhugsmmxromley'