Trojan.StartPage.59421

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsl2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsl2.tmp\System.dll
%TEMP%\nsl2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsl2.tmp\System.dll
%TEMP%\nsl2.tmp\Math.dll
%TEMP%\nsl2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'eaqjlbralgpphmjhnynzdbvbkkg' WindowName: 'ykunccuberyqhgbovozofrqykl'
ClassName: 'nodmnhbeqqlnsfustsbnrz' WindowName: 'ttdnapatxpynyofk'
ClassName: 'wcnixfxnhbpxtjhjdyywpxaf' WindowName: 'jywbbqvbkdddurfpgyjtzkgwzna'
ClassName: 'vkuqhpbxaoacutfuiwoqov' WindowName: 'oisuerezlaoaxvcxyamiztmuzkdoneucgkviti'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'gdoyzgqbkuujjbyobrbqcsqxsmtixyiswn' WindowName: 'wveyrkioaxoqrby'
ClassName: 'rwtogegkzcioonledhzhwftjjmgqijgcrjhgyty' WindowName: 'aeuxthxofkgiaskpuzyochlbpbrwiqu'
ClassName: 'brxdvqaskfexbtgdbzwilbfqjodktwxbf' WindowName: 'ggwdjqltyxnnocfmpeodzoevrazixdg'
ClassName: 'svdxvwsjhkdcfnvx' WindowName: 'roytpqkeropduzbkyxsosipqzzjatitppep'
ClassName: 'juawecbbblfeabtkvtnzabifkayseufzqz' WindowName: 'akyqehqmvassdeozjmd'
ClassName: 'aezmbcudrqzezwczwpxqhm' WindowName: 'ursratxouxvqhbifmutgjlsljqmybjlccffj'
ClassName: 'lnruhxikycurjeldgzrrtdy' WindowName: 'wgqkbdtoyfrolvxfunsvfroqw'
ClassName: 'thzkcrmiiwkulrsakzqrftgajdjldj' WindowName: 'udhnjmaqtpqhtbvzfipyiiutpzroialqgn'
ClassName: 'omxdfemmlwvhxohdgoiusoukzi' WindowName: 'ucbihvchncgaccoeifrumjjsrmayycx'
ClassName: 'hjrzxvjwqeamatxzxwbqjmxmktnjgtfexhojvsx' WindowName: 'ulrvcoskxwojvsoipsrrtdjkyt'
ClassName: 'taqdfrzvlfirdnqrfxop' WindowName: 'oboppvrgkyfxcgxqrrryxuoxnnp'
ClassName: 'rgdpdfuzvavepsigtcjgrucxxhp' WindowName: 'bqdgkeeialyquflbzljjkjn'
ClassName: 'mugglzftvjltnkxakncrgolqso' WindowName: 'nzsnliwexkhozuhetyldxgpgwfzqozazfdzngr'
ClassName: 'mecftwqmmonjdawqjoiyuopwoxar' WindowName: 'swpqwcluppghzqziarvbvwcysredsyatsabgvp'
ClassName: 'azbpdmrefvyftljnpsfgirurj' WindowName: 'wkgimkdipyshdllopefopdypvggiybpwjpmh'
ClassName: 'vgmkgjalnducnqjgrpqxzhqj' WindowName: 'qwlzoczayijhmlhkmintjpqfhtgsnftyhaqeofd'
ClassName: 'buakwzudsijaugftiresyaljqpknnnjgqugjeuz' WindowName: 'koskchgzgimzqmsxsbopjzspzlk'
ClassName: 'faoivmnqxegfutykzng' WindowName: 'kqbbppqjqtgbeyzztyqrggxhihwvaskoaktjyi'
ClassName: 'yqjmtfgvlshqojryqnpplwpjiiaals' WindowName: 'plmftrupuszpbnhlzwqzsyyrsuos'
ClassName: 'hewthelcrjtklltnpnntauedfykmzwlo' WindowName: 'bslbkswfzxyiswgympykiewcyhomqcpsdbidus'
ClassName: 'invlywgeraochdvoqwehiehumcv' WindowName: 'cxqabutjtzmezivvykvnnkxhx'
ClassName: 'vvqdqnmcicvltmvjwzkdlibdllwahkejxzz' WindowName: 'djfsenerkqfgpxwchejuwwlqrhmqemhearri'
ClassName: 'xdmqodgvrvhzfamwhbsvrq' WindowName: 'fdqzsdtbbibhsrqppxeplioeomybnhk'
ClassName: 'bgnwsplqpuouqpgxvkdfljfo' WindowName: 'ipzhjkjntnnptjlpqdvqdlyokckeahlzspg'
ClassName: 'igwxwgqhxasipuiut' WindowName: 'dubuaixlroinzjrwwoairetyrgh'
ClassName: 'liwjpffosdlfphhog' WindowName: 'hpszynwbnnbcdsncjuqsqw'
ClassName: 'vhcszqkqdzmulpkaulqzgfjli' WindowName: 'brrhsooyfgsohjbardoihrepaspsekpwixg'
ClassName: 'wdhzfzmzqfvfgztlghskaqgofcxstrtydkm' WindowName: 'pjjhgwjwbwdhxlqsofxrshacgrkhrip'
ClassName: 'vljgfrcptxiequakyrshxdrxxsw' WindowName: 'dnpvtweqvmlptuvzccsywxrsgz'
ClassName: 'abdutektfuuppjyilaixdvdmdf' WindowName: 'svlferxaujjhfoqwhvmkoushumhmztpagmnelb'
ClassName: 'sxqdakouwpioqtdzrbpgrvfktvaag' WindowName: 'rvkrryecpvmizqlz'
ClassName: 'xioyplfwzqlicmliuswtgqcuxytzfhtgxqmmf' WindowName: 'kvunymplcirstluwvsejbifjbyntgi'
ClassName: 'kjaksjbsbbcouytrvjecpvdopj' WindowName: 'grhwofwkqsstlwtzwfanzqhzurdfac'
ClassName: 'ajluuxptjeauybfqpxbwhyhjrkffzptlycf' WindowName: 'rvbumzfbrddznfznqonqaojkzjlgjvsr'
ClassName: 'hsegdbrnnosnbantqocrfdteky' WindowName: 'cmjyixterpcvvdfqiwpqlef'
ClassName: 'vlcowanjiouwdxyuvhwogrtqcwiolustarw' WindowName: 'okfpabpeierawxn'
ClassName: 'nxivwwoplunwbioqwsxu' WindowName: 'nlzwurzuitntherpduloiqxnxskc'
ClassName: 'ouyzayxcxcdnmvwypjbzhswyvixpfvhcpilqjd' WindowName: 'iihyrsyrttkgcuzgktvqcbpuggffsz'
ClassName: 'oceujzltmqzofjdooetoe' WindowName: 'jabyumixbnaelcbcqjqne'
ClassName: 'kuoutnvparqhtxieiesetfzpadgljgjxd' WindowName: 'ulaksbfxxsdrbzzsjxvikufrkuqeldccsdpad'
ClassName: 'lykjptwldztgxvejmlkzthtlgmiomgqmq' WindowName: 'rcmyhfgpimhggecfokkkdanvnm'
ClassName: 'trdwodctjybfiiapcyqwdxcivbp' WindowName: 'kdkcxfgpagkynkuripkgwxxzbdbjr'
ClassName: 'bljmfjldnmyptieoigywxirbneiwjawcfbxttoc' WindowName: 'kjnaooniccroyqgdbuzhcywedydsdk'
ClassName: 'oprsrobxwlyofvpzulq' WindowName: 'brqmmzrolyqtzjwuvsvxiuptnwopoilbcppvm'
ClassName: 'egteovlceftdmluhlpwquhfgwc' WindowName: 'rjijmvzcvtyxbrqyjfqugmjxnblomila'