Trojan.StartPage.59388

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsz2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsz2.tmp\System.dll
%TEMP%\nsz2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsz2.tmp\System.dll
%TEMP%\nsz2.tmp\Math.dll
%TEMP%\nsz2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'igtvswqedrqsewjjtrsedklfankypd' WindowName: 'itfjpihfjnrxgzxwjjuwnpdvpcicqachv'
ClassName: 'zysuspokofrziolzps' WindowName: 'slvcrzgtofnaltwgxereadkzarzp'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'fkxwgtginbaewsgibfxqfgvymgfskywtfkwjyc' WindowName: 'siitwkvytskzgoatyeoyal'
ClassName: 'qcakfgjsyegobnnnzwdszobejkjpct' WindowName: 'xynvjsvpfkszqrfp'
ClassName: 'myxnmazjmyqifrteizrj' WindowName: 'haqxhnrhjkyldzgnntwocmpfvewsewg'
ClassName: 'eyjwtwlxtxmuiijssfqcjhgmzvgmtrqituimxr' WindowName: 'kozrtzefdwmdjbe'
ClassName: 'ueikbmdczewasxfwjsgblkvsxbxnpnfpllitys' WindowName: 'yhzbjyiovmzvmkekooo'
ClassName: 'mcoxftdyqskynfvg' WindowName: 'bbbgxipjbsacklkyamzj'
ClassName: 'gpwnviisivbcwzfarqapjnzzio' WindowName: 'cslkbwxizzmxsktecxyyexjvfgagdfwgvx'
ClassName: 'tfwoffikwnwxgfnlnmwcogtbariznnkgl' WindowName: 'ekuuzmpkuifhcxkkaoijjchssbfoykdsluifzu'
ClassName: 'czayzmtqdjszojvoueyniyzot' WindowName: 'ozqrtajjaelaavotdb'
ClassName: 'zqeszpwmimoadrzgiejfymkdfpiywes' WindowName: 'ouvsoykluokogtaojzbxbgo'
ClassName: 'bcdrfpqrkwfjmlwdg' WindowName: 'gugytwudomyceijorqtgmbgimibhtnmnh'
ClassName: 'pvimtgqlzrhxeauihwgdp' WindowName: 'bfvhyazdkdswtfkugnpqituhu'
ClassName: 'bodoecuscznvxhiprnxvrrjoujniffwiiqfx' WindowName: 'ydwpjfoavncwgmeiwetpvecczjgrnsvmibsgtr'
ClassName: 'uwffdyqktdikanwanquqszykikxof' WindowName: 'vidhcgxmwddirxiphxhb'
ClassName: 'ckjsquhqkzontvgvvpfhpblzsqaxfi' WindowName: 'qnmiehtgpiaiaezjutswwkbswwhnvkyrpwxvh'
ClassName: 'qhwfguwxlgfrgmurek' WindowName: 'mfyzkjzypnsxbpdmhfkrh'
ClassName: 'woxdqlgnnifmazmowhicqejybsmcmt' WindowName: 'wsztkceltsynhphuwadvxmstpyhhrfxllqq'
ClassName: 'ewfkeohyfpvoesmmbjhyp' WindowName: 'qeigefzqhjpaxxtlbsl'
ClassName: 'fucsywubovwbouhqcufxbaidqqpvnqrejdqw' WindowName: 'vqpgbfmbrnbruqgmmz'
ClassName: 'yntbmzyztahsdvxadlbtuzsrbowcvudcufsw' WindowName: 'ztqhsjfgevirtclpvixfwayl'
ClassName: 'oqvwxybenpxbnrethsxtqhwjggjjbzls' WindowName: 'opinyzobtrjnsqgylobvtfborxgqdh'
ClassName: 'nuffidutkhizxsmbpesceokuvhlzjlpkglni' WindowName: 'zimevtcqfnejgrg'
ClassName: 'ddxrtunltohroawy' WindowName: 'zhotbfqnhgkwgxzkyodizlnojwckqtkf'
ClassName: 'nvkigvtqylnqszkbpdbwbno' WindowName: 'ygcsawwaniqeaqqqbgfmzptjvjdhosru'
ClassName: 'xqseervfcfjsxcis' WindowName: 'ihetjfniwmqmpigckbae'
ClassName: 'gwvzxyltpjoisyp' WindowName: 'qqxsbtovglovaux'
ClassName: 'pxehghowgwkwdrjjkowsokthogsggzbruce' WindowName: 'gskdpofghhmoczvzxyrjxrswercmpb'
ClassName: 'flooqvxqpyjtbxpeknran' WindowName: 'iaugueqriywvohogmeibzjcnarcbesedfy'
ClassName: 'jbgzfljozzrkslytqlxrrjasrtbc' WindowName: 'yipldyapjjjgnjqgdsyccgp'
ClassName: 'oxkseqwsazdnydnczlpfvhjahyzfcdkjofoq' WindowName: 'pqvgtjyxaspinlyeive'
ClassName: 'wxjmoglekfqbyjxm' WindowName: 'cvqtqlputsjvpamtnxgwunwkordszs'
ClassName: 'endeywkvflekuypnwk' WindowName: 'eaemzhlzxvxkvqncwdaah'
ClassName: 'myofyrlquecxrpnbnavropkwzyhqtszv' WindowName: 'jyrglsvkailprxbasqbhocvjkrppdigbhpl'
ClassName: 'dnqvmbalvrobnhfj' WindowName: 'kmviyqlzczdfzmkdamxcwktcpp'
ClassName: 'ogmqjtydutilcdjcajtdqluoayneqppnje' WindowName: 'arpcbcpgqfmozdhjflacznsksy'
ClassName: 'gfoscsidanrpznqovvqzluyxfkicd' WindowName: 'rwwyhoyjouqcvduprupaitcigflm'
ClassName: 'fgmjbdnurcafyeivsrfvxjyepfpbhmfzoe' WindowName: 'ywmhpjqmulecfefjhzfxqsmdpzgnuu'
ClassName: 'ypqtqkqucxhzkduzhzrezqiunazn' WindowName: 'ipsyrpturilagyfyprmzynrmi'
ClassName: 'zbkycmfdjslfmiim' WindowName: 'pukwryfjvgiieyiuwogcyqtgfwpyldw'
ClassName: 'qbgktplftyxdkrdhmaqesjdfjnskq' WindowName: 'mcwqasdeydummexxietrqxwkevecwekrqnm'
ClassName: 'mtlpytepmeetuzlcsykpfpyvlgyylagjyq' WindowName: 'ikavpcdsuiqmumflsayqklfcn'
ClassName: 'nxhavfwvcgrqxpaxg' WindowName: 'qxqsmsxbolvlijjdyeshgnfsheggaztxancfz'
ClassName: 'fwixzryfrbejfjusgsnewancxwpdtpebvlcizqi' WindowName: 'qelnzdsfbldyseewbsgpxlqgpdt'
ClassName: 'roivhwsfqsacpyuo' WindowName: 'cmuazvfhdpbxgcnwpfezegpznzhfyvrvpxa'
ClassName: 'firgrovlvtfhkvzuakdowwcpgwcmqrkjratpuzf' WindowName: 'gwpdeqznswcvzmpojvmqpuz'
ClassName: 'xrzpamdrdxyezneenkrfuixqknyofopjqryjwj' WindowName: 'jrbyggmyagrbvzxwyvctkpeu'