Trojan.StartPage.59393

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nss2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nss2.tmp\System.dll
%TEMP%\nss2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nss2.tmp\System.dll
%TEMP%\nss2.tmp\Math.dll
%TEMP%\nss2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'qqnvcoydoosgecrypyxn' WindowName: 'ylieqomajqhimxnzcttupgcylulydupv'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'jdrwmirbxovzqdhopuukqusxolb' WindowName: 'vyucenajqjrbluvpmdr'
ClassName: 'dyqevviqjqeopbnke' WindowName: 'czngrrguhzwfwnrdzlbpesuu'
ClassName: 'fupaxyjynpvbruiirqh' WindowName: 'armsiunyqkvkutuxdchvjuoiljeemuqg'
ClassName: 'iydpcmuchslmyhjdpr' WindowName: 'nlxdohauyzuragnidvhdtcbumshmwhujbmwwuo'
ClassName: 'rczawpqktjnmseluadxqbuvaccxvcgudtl' WindowName: 'feungjrswpyertixdrcbrtiip'
ClassName: 'ozuwpyvwrpjnqlqkhfyrjsoztijn' WindowName: 'punbjuxpverchgtpxgpcrsouxaodlizmruxn'
ClassName: 'mekopsclytfkteooqzmhhsojmqm' WindowName: 'ejidjmobtlfpjnzqixfoixoklidwtpztuk'
ClassName: 'ujahzgcyllaqzdtuktjxqicknlpxyxt' WindowName: 'mqpdeencxzqdgfofjtqjtskle'
ClassName: 'idebgizlaxydnwfvnpapvtdxhoyukg' WindowName: 'flilpvodlyreendylvflairgmqtwsdy'
ClassName: 'qtvsctolwkpynldaztj' WindowName: 'pogijwyeiitvkhvv'
ClassName: 'mzxgshbojbfwwssyywwykixhbqirhwyraruzw' WindowName: 'hntfdxippevhkiryvj'
ClassName: 'hkcofndpbeootbobfcihnsrblu' WindowName: 'tvipnxtsbvzsqnkeupjeupfkecyrxjf'
ClassName: 'gmavbjleghteveapvgstjvvm' WindowName: 'ukfzxepqsyojpeyiduzdqq'
ClassName: 'pibhrpwqksrzffvuqboclwls' WindowName: 'albvufwrsunxplylhptdgwqxybbktbioug'
ClassName: 'fljgvjgeuglwqmurykatjci' WindowName: 'wgqycfwavvhpjpkodmicoyfcaltaw'
ClassName: 'oesnnzelohovbpziznworv' WindowName: 'zrlxbcpvzofwwqecenhlznwfazwjvihqljz'
ClassName: 'oaybicpberkrpabspyziyvjdbotblls' WindowName: 'whoevyihpqpqvdegpdwh'
ClassName: 'nhpetgfaatiunkjdkz' WindowName: 'ntuwuvcjjhotihlyylengjyxjhucbqcdows'
ClassName: 'vpfggfhucnvjrdbj' WindowName: 'femqructojnlpjblciutvdbj'
ClassName: 'uteeporoqjfezmzfmbnfihtcgmfkpwgtpaqkdyv' WindowName: 'osophhfvhgzggytbs'
ClassName: 'vjvqpymxhimjflds' WindowName: 'esbdxesvoihmtgpwhi'
ClassName: 'xamdtsjynrbblpkumroepyklg' WindowName: 'xjtfvbhtgdbtltdqmmzuixokizjgoirtaehggxh'
ClassName: 'stcwftqcnpjnfnlzoazeuyzre' WindowName: 'ofmxyqahvglydrvhxkfb'
ClassName: 'usztjqveuoahkwmctijxklmwduxnps' WindowName: 'clhatdyiuxpoeeeipuj'
ClassName: 'mbptwyjddrpqjxcnjsqv' WindowName: 'mfdhfjvbvepnheqsljzhorjyosasmdcrr'
ClassName: 'gefylwhqzmittvrwvhfxxjbsmazssvuoc' WindowName: 'hetslwrrxjjvjlspzedytnbtdz'
ClassName: 'carsgqohqnrcvxbeqcjpijmpr' WindowName: 'jdlccrnehgiyjtioxatsrgapzxemnzqr'
ClassName: 'ydskowzdjerdzwcxvicvfzdbpjyjymlvlqa' WindowName: 'cqiqyalcnkgvqconnujrtiyqgukjjdiyvtv'
ClassName: 'fbnnipisslcgtmwlaiwzx' WindowName: 'dhtityvwsnravxetjpgzyfq'
ClassName: 'tzhtnerikqabqvlcwzppjugpcifeaucwtmod' WindowName: 'isyhybuxlccbhepbxzuretzorsvihkhorppdza'
ClassName: 'uyuiveftlohgbdtoajgeuisqeoxqb' WindowName: 'pwgnuyukusaiaczysccn'
ClassName: 'jkmvqlemlbhkvmjz' WindowName: 'vrhvxlceglrgodsmjtmaqjk'
ClassName: 'vvsvzdvedxoaraigbwntooculkzqlzfrl' WindowName: 'gyqxrxsoptcwqkbeqnzqdkknbgqxqjdz'
ClassName: 'wnjotzgfojjlmwxdefndghtfnpovee' WindowName: 'kdbkhbarmyspsobubmqyl'
ClassName: 'avbztqjvnlwpdnsr' WindowName: 'yocubmehmpduhaguxvvxgjrtxub'
ClassName: 'rdzsiuycrqzheremb' WindowName: 'gdsuxqwobwnzdsbygfaexiuxmfnrgetbt'
ClassName: 'uksrsdzupoilyzrval' WindowName: 'aemfpvfdjfjvppnkvzo'
ClassName: 'tvpjpcivrarwkzwlvodgbkrpzmejlgrdtobe' WindowName: 'fklfkfqjjdxaljjcwhr'
ClassName: 'wdmafgktpurzkcbuwdiiqakywxhrr' WindowName: 'ikbwybostvsbuamibrktyaqdcqj'
ClassName: 'hzxmevrrwadjztkmdizousoptjvxtq' WindowName: 'isxutqgsbxspymbhbdvfooqqbuvdqhglvcufjc'
ClassName: 'toncqskbaqtxtwbcclnkrzxqeskdgdiea' WindowName: 'ewqlyqxnkkvxglvhzxvacxoeslhbmwxjyvupa'
ClassName: 'xgisjurdgdiwcrirrhbqyuqkpdzvnnmt' WindowName: 'iuuwqeupngipyvccwebbnniqgvjeoidhn'
ClassName: 'doakppoybtzcwsfxfrafkzjziajqnjoxsbsw' WindowName: 'fjbbuxxngnrbxlcr'
ClassName: 'dqvuygzlcxnqklakocnaac' WindowName: 'vuvcpafigkilafoyuvplhcccsopfvusj'
ClassName: 'whnkumsiimuxodvhjbil' WindowName: 'rzpioosiimecosrgsieiwjy'
ClassName: 'rluzsckrityvddjv' WindowName: 'cbphxgogjaonbpdlojwcvlluzophwpo'
ClassName: 'oflddtaixcsabgior' WindowName: 'jvhhypkromfqxldwyhudewajloykibrxonsaqux'
ClassName: 'jbtysflgnhzztjmdfjhhzodeteqjktpzbrhy' WindowName: 'pjpmhhvtwpgzcwjoyoyqzpjdjghqzgsh'
ClassName: 'wfuiitjnczxoezbrcmhtfpjjeiqf' WindowName: 'pzfxcsikswsuyimyhgqvfdzmp'
ClassName: 'vrostoukieuxhsketuzs' WindowName: 'euakxkpdzlchfwuazazwxq'
ClassName: 'ggqnhqdfsrnqdrhnkvgsrxbjhigtdouqd' WindowName: 'vygjhfsamapphrxfup'