Trojan.StartPage.60491

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsr2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\Math.dll
%TEMP%\nsr2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'qkqsapzazjrgnkxsgifadiamxnww' WindowName: 'fairmlxmzprmcsoysdoxwsjtpilaltlt'
ClassName: 'dfpojgldjlwxtwwkzumqbxdjmrirzcunerrc' WindowName: 'lqxwkctpjcoflmpepezsuybixdbziv'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'izhqyobnxurqtvvarmyoqwvrjfvh' WindowName: 'wvpqsbqtoyebjmrh'
ClassName: 'vjuwwjdwmefejyhptgupj' WindowName: 'ifdwiirbompmlwtdpgyoc'
ClassName: 'degkaosysewanvotpzexcizxvkntkv' WindowName: 'ryzftfakctilpekfrsyovzq'
ClassName: 'zcuazjmyzplavcpcvobgeenezzrdkw' WindowName: 'kcrvhvxiiyankiynpjgukxvqg'
ClassName: 'vcespcwujrkggoiblhqyppddujjcfbpgzlqwfs' WindowName: 'ycelukawvxtsdsobhdrjpacuoir'
ClassName: 'zhlbnxnmmifgssyugqqhruqnbh' WindowName: 'zprjeywnvtevwafmmkfgleorntocwhkagfrndt'
ClassName: 'noqryxehosmcegglzetrhtpim' WindowName: 'afoxnmcgbbuboii'
ClassName: 'hvnewwkuummspyltsziliwjjw' WindowName: 'phwrposmfuucrlgcgjnikbwoqeowlfm'
ClassName: 'zvvksluboqpblatdfycvwiujqivea' WindowName: 'ldavkrolzjlerijdrkiy'
ClassName: 'zwvxsuheoytzeffqmux' WindowName: 'dgodfxjxpaajsdenv'
ClassName: 'htnxobhghdqvpmdrqdoxtndjsnvwneeiohcatm' WindowName: 'uyfbxqhkfmseisvcdbduhtc'
ClassName: 'vcgqzjapdogfzytiqnucszcvb' WindowName: 'iqtunwaaqqibhcbznabpsqp'
ClassName: 'yvgehhyzpbqnejqekzwiqitehadw' WindowName: 'kpfvvvlxevetvdhcshvjqng'
ClassName: 'dgzqdhxsofaaphqadmldeugaox' WindowName: 'zsdybgidqggikideizqflodxdvp'
ClassName: 'kxfryqrvksfsobiisyubxvcyyelqcpoydmobazl' WindowName: 'goaabjgpflicyqdozwshjcacxexgheiw'
ClassName: 'wehffceeidvikcqolhzddrhjhlfah' WindowName: 'ghnzmtbwfstsakhbcukyyhwqeqea'
ClassName: 'yvnspfvdgwqronxh' WindowName: 'udwuxarxjkmmqknmlzknwqcnd'
ClassName: 'qfucptsjheyhrnetdmnb' WindowName: 'hpopeslfyikqixneje'
ClassName: 'qnbapmzcselxufbehixsxavt' WindowName: 'buqxvmukjcnotszyrkgkrfiwlgsqxi'
ClassName: 'hhasjapmeczkznkhhihzmeol' WindowName: 'yircscrjdxhmdkmjjzothrsbfqfgwvghqh'
ClassName: 'mqwghmkbwlgknxjepbazddrfnalhxujll' WindowName: 'zsgxfksahappgfhbqmysrqzwshxcs'
ClassName: 'ilytuzcxydrgwmhgvzcygmahjdgruled' WindowName: 'zqltotogjdznmfuf'
ClassName: 'cuscbgzgwppogikdgodbfsacfyxgaw' WindowName: 'ghqcfhxtgaroziwsbmzchtmeszn'
ClassName: 'bbyxzcjqochonefgqdipod' WindowName: 'zjjpetcsowbvsyuwmiskayhadnbvms'
ClassName: 'cnosdeudjdqqmftshbmnivkwbynebpksnqhtmd' WindowName: 'vvghaimwqrvqmprifuunyoeotrsn'
ClassName: 'cwbrlmhbwthptkobtmkfqtxkpsrhmyens' WindowName: 'rkjnhklzwttkovvumljy'
ClassName: 'ecmfdlrljjtsxwhnlwandnzmxjstvnurv' WindowName: 'rgpjrenpropquhlwadqny'
ClassName: 'tqwoadlhmnxiuxe' WindowName: 'xsmmzmmalmnutbgaqwynkptd'
ClassName: 'ziqiaatyagsvslvjxldcijkunmncho' WindowName: 'yedlwnyieutbkuxcxphusbgvtxss'
ClassName: 'dvixcczshztnxezxw' WindowName: 'hpsovweuefwwcmzpfospkrxvc'
ClassName: 'kvrrfijrvhbfpto' WindowName: 'smqbdodcpiuwhhkjq'
ClassName: 'roecosdgewoitwgmtqaivyrjmxayqbn' WindowName: 'figdtxflbpvdjsvoqbqztdmeovpbwyoa'
ClassName: 'jahjiaaulaqrpepcsuxubzppuectrf' WindowName: 'jmfhthntljgjriuebqemvaqkkknljkwwjbs'
ClassName: 'ssdnzovthjritojxuozqtulmwnzzqwbs' WindowName: 'zxhbuepqzixcfgtywsxfdsyrkm'
ClassName: 'hstlcxnwxfwcgjttqes' WindowName: 'yflgpzuweeuhspuktjvegjj'
ClassName: 'eiqhmsazuxegieylcjebnppngiedfdwffc' WindowName: 'idwhqnfdbeselhutldehaaljai'
ClassName: 'fhdrrtwzlvknowlocrvmm' WindowName: 'jpqhmopqiuugmtyuflpocnpzqkovnyjgh'
ClassName: 'fyurqviyeaqnmoulrhy' WindowName: 'bytpiixbmixfpjuuigarvk'
ClassName: 'hpzvciyocngpabcbekhpgkvwigd' WindowName: 'gppcocrruqcmsbbqplpnfjis'
ClassName: 'ypfoerazopflqbmayfzjpv' WindowName: 'sygijgthbujhvoyyvabfcamvuw'
ClassName: 'ngluyjfeborrrdionzh' WindowName: 'rjftiuhcawjtzqoqwgs'