Trojan.StartPage.59401

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsj2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll
%TEMP%\nsj2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'tajmeoqqwhiecssensjcqzyrokssybbantegpf' WindowName: 'bvupdnngqnchqdcuj'
ClassName: 'hmsxomwzooodacgom' WindowName: 'dppaviiprfccyqincrjc'
ClassName: 'smkvkjunlkikvbwtwkrraadkhutcul' WindowName: 'icmwlcdiybbmqnsmrmmuikxtwcoiue'
ClassName: 'bhwzmvcmxxvklcrkudgjibpaqrbsm' WindowName: 'msbfddwxulznzzby'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'azaywstewdilkoioee' WindowName: 'gikvxgegitakcrbyloaxtnzpt'
ClassName: 'bglauvmnmzevkaqnrgbdptzefhnrvhkhndl' WindowName: 'itrxzfumgedarcodbqwaqquipvjfvorfraa'
ClassName: 'vitwedrimoxabrfrtcgwhindknjqvnkeurqt' WindowName: 'sebaukmniacwpgou'
ClassName: 'oaiounmbcabyxvyrxjyheeyylnpmbmc' WindowName: 'heyjujelfwjkhvzzlufywlvodkjqsae'
ClassName: 'envjappkoyrslpworuszphifhmqkx' WindowName: 'uihqwtqzmxtfrwgaifl'
ClassName: 'enwrqucjhysxrbjiklfacap' WindowName: 'ejlrqwqwcrxuwrchbcmukhyungvgmtrevvckthf'
ClassName: 'fsxtrccvvxgeqrrgiagmiobabgcwxiiuumfvth' WindowName: 'xzkfldkjrkktrbjry'
ClassName: 'ftjicjzqrtvffcjcpszxwvtfcmvjshdjpa' WindowName: 'qzenvthydujsfcravlaicr'
ClassName: 'wfjevdmaczyqeshfoj' WindowName: 'wzizdeutzkjwcdqxmdmud'
ClassName: 'qnibxzpxwavzevbkohvqvealrzqfbydzzgxzg' WindowName: 'pednyoypvjtfkmwzch'
ClassName: 'fcmbuhnqelqkzdqyxw' WindowName: 'bdtmyttpoobxvnsqbdbpattpepziosgnpsjk'
ClassName: 'jhvxqtgkhdqgyhyjbbjsbdxgocunzjlmwwbcwrb' WindowName: 'ddnapwnrhrqbvzxvwktwooxe'
ClassName: 'ejwepgykkbkolicu' WindowName: 'phvuwijsainplrhrqaflll'
ClassName: 'pwyvhddbuevcfrjezhxydxbzgmgqeyrfjsktlxs' WindowName: 'afetxqdjvgpcmmuwsq'
ClassName: 'zieaoamvenamdwcjx' WindowName: 'dpdsfzbesfxqmfyirogwmstruapavge'
ClassName: 'hzkzhkfoipftdnp' WindowName: 'zzvwjuzrgjypmdsemj'
ClassName: 'voimpixotsjgdtcdwzepx' WindowName: 'xqzomxgpqyeajilnwstxcfb'
ClassName: 'mjgiycavbkdycysdklcdrtsqwcnwspd' WindowName: 'qynwgtobqbxtrggtopuylaifakf'
ClassName: 'jtpgohqginguovgxdpbzeevof' WindowName: 'oqgthbookfonkrzosjmnmjkbkzykyzfxr'
ClassName: 'gfzcirykptuevpseekcxtazzyhgoa' WindowName: 'czziqxebgtaoydxgojomjuwxyrylqwvotp'
ClassName: 'avcgtnibtdgeekmihmscmflqqvyxyert' WindowName: 'ehnwshvpejqgtxwjawdigr'
ClassName: 'bhqdruqwridzmijpchpvfiovvecnirw' WindowName: 'fxtvmwwrvsmrcxpvbudkjiwopegryl'
ClassName: 'rgukbnpsbjmdvcmsbrfjqznyfpubkpqc' WindowName: 'zjgiteswcqwfaqjhhhmlspfmczmvdygmi'
ClassName: 'odsqazzxcjcqxhppoq' WindowName: 'wddutbektmvsgfljrqtacnoffjchfhbcmcgtr'
ClassName: 'rwhraxpthqumfjwwbkyolhbkmwurq' WindowName: 'jdkdudqesoznpnckfzko'
ClassName: 'hjrrvhimojhskkxtfstqlltnjayyeoxj' WindowName: 'wweltpwccfryfpnemchhlvjpgiiywqc'
ClassName: 'rjrjmsdscpnzpyoxaermhzgvqqw' WindowName: 'xyfstzetxyycsjoiurarqyxqaijez'
ClassName: 'ehbjvgoqgimnnwfingmyxerefxbp' WindowName: 'uydrnqbhiateepxznhkgxus'
ClassName: 'ggyeqzsfealhnka' WindowName: 'dweiuxmsoaqnivegmufdrzfmitsozd'
ClassName: 'ujchqjgbzbxqpgwmioqfhbugqfk' WindowName: 'oyccqrorspyixnefpsmcpg'
ClassName: 'hsysapchhnenvebv' WindowName: 'xtxgnghvefqbyfxtzlyvfiai'
ClassName: 'iovrxwquyoerlnlshinaymrurumqrtrlxwbrw' WindowName: 'rhdojcaguhztirmgwuemhphkarasauithosxdj'
ClassName: 'nanjiimilnhempoolaenpisj' WindowName: 'ycwwzbpojlxpdkcpzotpfrucu'
ClassName: 'kcbchtfifwmhcesltjvulgptybnnzc' WindowName: 'lodnyihxenggsjsaarjqntk'
ClassName: 'necokokdqczdksvq' WindowName: 'syyibzkdwnmydxgclggjrdllzrlvvkcvsdaj'
ClassName: 'tdchvudvrzqpavmapixxtseiapvtctb' WindowName: 'zofrochomzudmwywffgvmgqckxaxmxbihsslt'
ClassName: 'huzwlpbuxcvvovxegsxlhfcchntftsjtcx' WindowName: 'rlxnffeqzqelgvbrbxwjkw'
ClassName: 'iehkqgchserpucvqg' WindowName: 'ojmlwdjxnfmceockdn'
ClassName: 'gjdiucaixpdgnuhbypfydukhgpwttq' WindowName: 'xqwewdicmvwqcqoibywsavlldunknnkf'
ClassName: 'lxyympraeucrbvumilhdplqzbwfyybfa' WindowName: 'aviwsxoztcaerzotfknydoyhapyebn'