Trojan.StartPage.59878

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsw2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll
%TEMP%\nsw2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'uhvyehzhdshybagkjuomghbupzbaglfp' WindowName: 'ewfkigtbozplvqamvw'
ClassName: 'gfiiofjfcnohagreniwetg' WindowName: 'gvzgvkzmkytjvvldefdmwxecrknqoavrene'
ClassName: 'dxknmbdlomoeovbwydvhtvdweemagjogzjuckvd' WindowName: 'ipigrsvvairwfjudquasdlrkdmtxw'
ClassName: 'uupkphxbbyxasem' WindowName: 'ofckfmfjdpyelyiahxufircdjrejypkt'
ClassName: 'kpzsbujzutrreylssrn' WindowName: 'bymlhwmiyvzqbcgszjkaohbeq'
ClassName: 'qxznouuysqykhsbeujoylgyjajv' WindowName: 'awqoseqtlpbglqkpoulwdewmdmizdialbsdghww'
ClassName: 'qbifnfsxcqxsvdqwkvhsgmf' WindowName: 'frnlswtkzzguptg'
ClassName: 'borippjarjispcprhozoinzuhpfmp' WindowName: 'wtwuetdnnwvawmgabjymiauiwxndrqlti'
ClassName: 'pnqjrmtikbgfdomodgywgaduszznklkielclawg' WindowName: 'kggbhxebtxnwnrdbrshggqjojbczszclvouptfm'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'delzvngylkobrxwodlpatnps' WindowName: 'xiealbnjnvgngsfbrxiexqoroacnczp'
ClassName: 'jpqfollcacqdkazcrldmbsaolemukxmargt' WindowName: 'lhwpzovtoievtwsaxjsjmos'
ClassName: 'nvthsrkychmfywahlcwtqenqnudcleomfxip' WindowName: 'niherrpbhiulqwrflskmzmcwrgjtsltqguzbuq'
ClassName: 'oezvcaxgpcjqvnaumpmtafra' WindowName: 'rstgbmbfbcmaneaklrzsbnhecazjloz'
ClassName: 'mndinzrjjsyimzszhsvuniltf' WindowName: 'pavatbgfzersdltjmxxodmmbxgnvqxkvvozyuyj'
ClassName: 'ejujeatjxjapzogdlkepnv' WindowName: 'bypaxrixwmazqtrxdtishnillewsitqiab'
ClassName: 'wqvrlhofsmkkrpithyhjdmjzsjrvfiijtcsxgbt' WindowName: 'fufmqxebmozefiirqtxj'
ClassName: 'pzglcdhqpzjkhwrzxvxc' WindowName: 'sdjnwnmsztdxoxpkyss'
ClassName: 'xgppiffndcenkcinco' WindowName: 'ahastxvkayemkuoejmoiun'
ClassName: 'npalwpemgwjxttgqe' WindowName: 'kfbnvqshxjdxuwxgrnhvrayzwn'
ClassName: 'ashogpzqqoiwpqbdgsmmczwlbxjkhkobf' WindowName: 'zncgbfwvmxbrukbdomfowthbuicm'
ClassName: 'nuomslzyxzpvygfgg' WindowName: 'vztuiypqlcoxmidcdugjokbrg'
ClassName: 'zpcjrcmccefuuzfvaewvyujtdivwtmbg' WindowName: 'ejtayhewglkngjctbdedjkmakxhkypzfkdkici'
ClassName: 'rkihednezdmwlysfrjpkmvmggsvseqqqysd' WindowName: 'linlctkbnfwpvpiovxkszbdk'
ClassName: 'gxyzibjxnnzhhzkcj' WindowName: 'cihtyhfagmeygskruujqkfrxycnntwiiqk'
ClassName: 'nqnzqztfxhdbdmazvzueshkxurf' WindowName: 'isxavfabbcjwnbhkkgubxfzacmvzwicjabwlt'
ClassName: 'tqkzajfwggdejcltfwijrupx' WindowName: 'txdyeptqrylyfzmtidkrzkssujksgwthe'
ClassName: 'ruiulapaamcubtefxefccxjje' WindowName: 'ptcvdiqnmotbepkdrdhetjguwmdahqayxt'
ClassName: 'ktzyynrsxnypcqlztpmzilryjtugztig' WindowName: 'wpcawyrcrlhbexsdbykmyijcqlekqndxnhxfgd'
ClassName: 'mjosdljvfmfujpupdkdntoyvxdokiopbhts' WindowName: 'nkhzgclyrrvbdxmuujavlqnvohuutolmrskta'
ClassName: 'ttrgxlbvdtodpasabratuqhnxysoyolddbgjmwh' WindowName: 'liiuutrvjuhtldsotb'
ClassName: 'ammrxyarwkugcpjmquhwrncazfnzl' WindowName: 'yigkvmzhbiyejneqbkjqmgwxekqddqerxg'
ClassName: 'ijeixgcralxlqhfvqpczuplut' WindowName: 'tdxdbxbjklfllirputfjzxre'
ClassName: 'hevciynzbnczjanyuhyfiqvgrjylaegpadkozg' WindowName: 'pobqnxycepyjwubjtwsotdompfypkuvvcgop'
ClassName: 'yavlbvkbmzvlggzttny' WindowName: 'krremqewltgdafxbywzpfghwjwmotrf'
ClassName: 'nrdgkhfprlsttyxcsgrxofwkaqn' WindowName: 'yxgzjerfycobroxjhcwnzrtheottzknb'
ClassName: 'zhimveoflbdfvuql' WindowName: 'ebnbkzxzwzrzmyhbtwcrowvwjpp'
ClassName: 'ekiexdcbylwpdwumramutdgnwnynuadovddcjwk' WindowName: 'rztuyqixkjfolocdlyiwemp'
ClassName: 'xlgndjfcgfcnibgvtgxrveiy' WindowName: 'hairjocrckzjiyzrhthyelvfqebwi'
ClassName: 'bawhpjtwtpfmusj' WindowName: 'zstwxeuccbpdhnteiyn'
ClassName: 'pifjyvyljnjcejlyghxjd' WindowName: 'ynxuclzqauxbgvhykunrsfgxnarlfdgzaut'
ClassName: 'znwlrdrrqxeokwvqedlxrvw' WindowName: 'umnxkrwbafgsjwprcsvpsvcvejkvpphwx'
ClassName: 'djxavnacjgichyum' WindowName: 'bnqxlduklqgzehhcgyvnikbzmaosgobautlo'
ClassName: 'rcaciixhdrzwbrcaliepwziu' WindowName: 'xmqhzztowoieqcvmmgjfckyqyoeqiatca'
ClassName: 'odbuqnzxkdytarqagdsyzfneqmngodpqc' WindowName: 'ebixzuwvjpjjvcsjhp'
ClassName: 'jbkrgeqgvkumdsmatd' WindowName: 'jqqhazurzwtudvligixewvwusmyeawuj'
ClassName: 'pjjewgnpadgsyfjfpmci' WindowName: 'pythcdoozlrzkvahoygpwtanzblc'
ClassName: 'trmpzvtxwjvzfcujdfruxff' WindowName: 'rjjueexsphzsjswubmlhgpsjftiv'