Trojan.StartPage.59730

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsc2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\Math.dll
%TEMP%\nsc2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'yhemixwndlfupmyxwzkugqnfwyxnunfevciwudg' WindowName: 'euphpsjmqkpsgjionjsmvnkpztclwjngwfv'
ClassName: 'nknijzmrpjpvdcsuhjrhoqtckaqtxey' WindowName: 'xrlothsmqqipxbren'
ClassName: 'xbflnenzvyikicbouofzuyluar' WindowName: 'gvfwgopznehshuxkamfwirci'
ClassName: 'bbhiedfmfmqcotxyygbpqyxognkiyfdf' WindowName: 'rgmrxxiwrreejglszlohzwsu'
ClassName: 'dxdssqzuqujfiulhrbtuei' WindowName: 'qmttghhcqufupoqjeuurj'
ClassName: 'zemuveozazmtcvybqpjqzf' WindowName: 'ttknqpwnitcqzeebgenyhfjoovgeecbzvfiur'
ClassName: 'llsyqkbcttndiwfjfjoiso' WindowName: 'nuafgxiddtgsjbtzd'
ClassName: 'tjlbscgnjmmgxbvgqmpwupgchybeyzmv' WindowName: 'sykgtdprlhsykxbcwsstihgengmqypuv'
ClassName: 'ynjafcuijaztfizdfzxzpwbf' WindowName: 'imokylesjejnmielcirydyqzbxt'
ClassName: 'myoewwokielleixqeeraozmrrsnxen' WindowName: 'gxtjvethwoopskntxmettpodqafhgdhfa'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'thvvojsxrjsfdakpodglmbzuxpsxslvgbj' WindowName: 'rwcqtmahzvhnlliqmtnnbxzyvi'
ClassName: 'npbxioopjpyjjndlgcoqzokes' WindowName: 'afxtvqvsniwxjouofvblclbbbqwdcbxepar'
ClassName: 'pwfllfbkbldqzfjc' WindowName: 'nmmsocryjjjmhvigydkoyvnorwsjeeeopxb'
ClassName: 'fsoqknwqnyptthrnkxexjr' WindowName: 'ddwiynmgeverszbmhzpisbttgjzcrdsrxthk'
ClassName: 'lbnmwdsqvwmafewfbdvqtwlsnqktxwztbicxetd' WindowName: 'drsftwuyogaqfulkiwxmtdauanetimwfenkv'
ClassName: 'aqytxcaoxrbtukxas' WindowName: 'sueprreqwnkpvykhenckfyolxofznmbafbm'
ClassName: 'psvsjoseiguixqzw' WindowName: 'hptdwjeapkaxmfcmovdhx'
ClassName: 'jkxanrthrjhdwlstgbvolreeun' WindowName: 'wlczlwlwznyxshevafmxh'
ClassName: 'wmlyljpwswymupuxumotiugsuyvpslsgzsceoov' WindowName: 'ukvnvofrojhywyfpsjlqphjhwzhebcdcvskkcxw'
ClassName: 'ssvgexhdwaqznfyowfiytbqji' WindowName: 'qmejxtdjecgkmtmkpyrck'
ClassName: 'rvfamhfvjuvliekmmfibeatdfhraymea' WindowName: 'uwdwtinbwzilxgtaakpaimtouioiabflxuiuhh'
ClassName: 'epclbsqsvoyjaeq' WindowName: 'lypdtuetacgcuhjokdqki'
ClassName: 'imnebfhyqlqammmiuirjjupystciit' WindowName: 'uwyxwodiavbtdimntgm'
ClassName: 'taydvndmeqgjlqccgbsylp' WindowName: 'nxlcyibislqcmbfnrmec'
ClassName: 'deieciqvdwqyhvehzeewiax' WindowName: 'jgpvusnmbphecsw'
ClassName: 'rhpxcmqdhjqftezckfh' WindowName: 'rrewhroytxnychhgiwuxy'
ClassName: 'uvnqsxekmqnmyenoxzcfxayqrorn' WindowName: 'mumhfzndukwuehyqpwd'
ClassName: 'svrrrfrzffymcjmuevzpdocopfe' WindowName: 'srbwvrpgyiautgfgv'
ClassName: 'enonzpwirxublqogbrzymmqxnhedyd' WindowName: 'bjivrjujmiadosxqhhguzfnrvxujbjxdwiyfi'
ClassName: 'tsnzromeyanmaslp' WindowName: 'ddjhtesxkdymeycitxcsieoisgplibxcrcms'
ClassName: 'ljymmtwgdfsnfgjmrieaytt' WindowName: 'agijsybcjvunfirlbggxzqxzzo'
ClassName: 'eunjwxqnctfzbjcclmis' WindowName: 'mxoxhlpteycgcuvikrdvbgqichbmybrm'
ClassName: 'igmdspwrnswgxcctbwwrs' WindowName: 'asnenezppgkqtuadkrebxazgkrmxrlu'
ClassName: 'iqvvsuespyhfwjmshk' WindowName: 'sbbsxvdvtunyoztzcewmclmhhhefwovafv'
ClassName: 'dvevfljdocgffevkrchdkqzbvhshboymj' WindowName: 'bwjxiqzyaxklpdpvjkkawgpoosieyadug'
ClassName: 'nxnorahmeubafxvwagiozyzrxkntduuljicfbjt' WindowName: 'uakcgpcwojqxrrlxyovdggjsxyoztotwm'
ClassName: 'frxchbzbweqmlactwihblyzpeoe' WindowName: 'jhirhidtdticqsydwgxjcybmullpczsufayxy'
ClassName: 'naaymbuamxxfpadlulchkvxzliount' WindowName: 'tbzzpzkkgnxyzxvrgbvw'
ClassName: 'xeuxypqqendcdjhhhvgzsfkpfwfzhaufcztupc' WindowName: 'zturwctxpfmwqztthronytykgwerirtnmob'
ClassName: 'nixixzfvpkmghzehatismpbpblvrzwiil' WindowName: 'yqrcqwyhebjjdeunr'
ClassName: 'wakydmwuarihqqufckhqnuqywzvmyxutnyy' WindowName: 'nhhtyftwdoamzeteztzccq'
ClassName: 'ciwnynvciguzovqhmniykgvcqaxvvr' WindowName: 'jcjziaftbizwkclhdbzntxzprshxgocyceqk'
ClassName: 'wqdeevnpajkjfmckpghjx' WindowName: 'tpxylxtnupuyxnbpyqhiktnl'