Trojan.StartPage.59396

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsv2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll
%TEMP%\nsv2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'oawdwtwwhgwpttozvqkihphsumuivtfhm' WindowName: 'voehwfbckhuzufxaaqpxb'
ClassName: 'ihsohyldyfyyoijialqg' WindowName: 'bogutusaurmuichwtressjvsxapzbhy'
ClassName: 'hqrpwhxngdvpijj' WindowName: 'vtjwuyoixdpanfldmqtlssdwcttzgpv'
ClassName: 'hiphfgtcantgynabeahfloxl' WindowName: 'ajroiboxunkvjeh'
ClassName: 'lfwwzwoxnvnhaxhfehtfenwvug' WindowName: 'gmjetrtdnmgoswpydw'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'wtijdqdkbiisgasqcqembfyhmvuui' WindowName: 'vpfyxtsxzynyqpeijzh'
ClassName: 'itncpecnjlynqsipoazazmonfwhrlmhxkmrmzh' WindowName: 'lyhhkcfrfhfzzjxrv'
ClassName: 'tdzhtsazrgvhdezsgpjytenbqdbgs' WindowName: 'akxslkrechcvxhjtgq'
ClassName: 'scfnjegzpkrvjamadccm' WindowName: 'qknqmfalzryzltgpyrk'
ClassName: 'xzwcuoxqthzmayd' WindowName: 'uvvnkuxurvbncayvwpwtrrdbcgfkpv'
ClassName: 'hrxztmcggfzydgotasbadhiaxolxl' WindowName: 'jlaqulplltotard'
ClassName: 'bzxfkngwvyxcsayvjdkbwrzdqfa' WindowName: 'xriadclhhlgufsisxourguvkhneinyjajbx'
ClassName: 'ugmvnnhjxocqpuoxyqgouwdczspnviejmcvh' WindowName: 'jjatiabhuttfwltxhccihxqfv'
ClassName: 'kfbfraefsedueelqgfsjymnioidvuditejkj' WindowName: 'thxvmunkkphzhhveffeymtbfktszz'
ClassName: 'xqfmcmerhtxitiedjuvkgqpkawwlntpanpkzvhk' WindowName: 'pendxzktweczaaswkewotaaiukemriuklmk'
ClassName: 'pyqsnmbsiriujeruumpjgzgauyencbes' WindowName: 'rzrmscojxffbgrmjgejnpurglpaxhvxmfenzzun'
ClassName: 'tzvhcqgrxfuexbfhwlf' WindowName: 'nkistbeyxnpezgykvulumxjiikeatvytoiicc'
ClassName: 'ooqolltijkijutdzhfcxrhumisrr' WindowName: 'fltxkaxvstpeudnm'
ClassName: 'yxmswwdmgjcuhvogdqwfqkb' WindowName: 'ufgehngmagwkgbautpde'
ClassName: 'wrevcroxodwqwdsslfmjkvigpwwywhym' WindowName: 'mkyfqgtssypfectapyftcdpsd'
ClassName: 'erljgtfedtaswqucrcexyb' WindowName: 'euedwvozwznoxgg'
ClassName: 'zbkbzbplbtktbjrmmymbbifsxcubpo' WindowName: 'hmiyepymtaunzgxqfvxwmeyybedqrlhs'
ClassName: 'qskpepsvlvbgeyvywvdyqxtvrvtdco' WindowName: 'vxiammhyethglrzfwkadusebwaud'
ClassName: 'dfsrpazxcqrensdesnsrctgf' WindowName: 'gufxotrzhhulnghwgtggtxpdhuamowfoxapobs'
ClassName: 'isolzndojfqgyockhjmve' WindowName: 'wfjfdeyreylmgfd'
ClassName: 'fiqtiqentbuxddinhsswjwfkfv' WindowName: 'pkzrcgvtwznjteifgqkzwnlrarhvpzirgh'
ClassName: 'qyrhnwtjicqxzzsjedwtsxeg' WindowName: 'omvvyvrvmsfmvkbnikkxvbzriaorntqa'
ClassName: 'oxgtoibrsvumjhzobxsgpbwnnw' WindowName: 'ujektpsqdzyydcjud'
ClassName: 'bedmqamjxylxfalx' WindowName: 'xlaqnqyidginyrocrnswb'
ClassName: 'xtfyfphwbdeshsuqvunykaszjdhqwovdq' WindowName: 'xcqnfpakwotcwfkavehbabjyxppwlt'
ClassName: 'bbqsdzuplhaexfdfbvzqxvrtdc' WindowName: 'tndftthvpjzxmpjscajdnhqcgal'
ClassName: 'fohivsxobmkskdtwufhqjihcurfheiiqrcqyke' WindowName: 'ahyphvpcgviraesncbwbhqybhbjfjeoockxjkxw'
ClassName: 'pjhwnkcjoqyuhzrlytojr' WindowName: 'jtddcpttyrwulpsypijokankjhrgkuuk'
ClassName: 'phgwwdvbftawevlftclgllhbsuicwzumr' WindowName: 'zcfvukmqmucynxxnbgpss'
ClassName: 'xeuwcvykzxmqzlnenmrlaauxajyxuymvikglj' WindowName: 'mwqmeqieerqnjktevmyovycxe'
ClassName: 'qaftuilrxqnihmmvvuhqh' WindowName: 'vljatvlpcycdwghcemmotxejxgpiclwcal'
ClassName: 'rzkiumwtyquqprwhhmlpuywnqozzkyh' WindowName: 'hhorfrysgtvugklnrdytkdmzved'
ClassName: 'ayeuybnvqysnxufhtbn' WindowName: 'lseahlpthrmphzpoicsx'
ClassName: 'mxbkedlllofjocvqaktdct' WindowName: 'fdmrqcbsrriqjkcweqrmbeytytlf'
ClassName: 'ieqtqtwxenmcohoyxrtzqm' WindowName: 'jljfqbksrcbiosrqhpzd'
ClassName: 'bisuzmhemsttuprvx' WindowName: 'aykojifztqdqggzklw'
ClassName: 'texxllibpeviqozngkwmonqxa' WindowName: 'ehkmywpeimmjptsrya'
ClassName: 'alfapldyssvholqpvvmwphp' WindowName: 'lkixdydeicbcnyepcgb'
ClassName: 'niiimmmoqqvdlrmrrhxqjdrzxpjauklfakzw' WindowName: 'rwnsqwjdwdvhnykcbgakoscrdnq'
ClassName: 'kbnowyjarkyxwexnfgoqmvfiuy' WindowName: 'kagvrpsyildjuozangfczdhnhpskukqtvvdymo'
ClassName: 'vtcawukmracptkncpwvetibfwdtlinmecup' WindowName: 'igqmfworepvmeiyizijfeodzyfuslu'
ClassName: 'apaiwwpxdhmtcbpfwkvynjsxadglssljjqoby' WindowName: 'xhlnbcdhcmikmupvzvmavgzctjwdonffdz'
ClassName: 'gubqkcspvwwmosjdxrpiverxubbafcsnrwmguc' WindowName: 'hmlojvzptqiqfeppnkphyvfutnvbhcpneamwlt'
ClassName: 'erwyzuqynliidetuxduefxsoxiigbnvw' WindowName: 'snuhsrlostcmzcyeabioivdyrfsxo'
ClassName: 'qirqqdqjvrkuiwmjalopcokzulqb' WindowName: 'tftgaobgsllhouezpmw'
ClassName: 'vmcmiryibdslcmqnrypuwvmiso' WindowName: 'vjvzhjhxbpnfanyscbrtokqflgkmwodvzjou'