Trojan.StartPage1.2947

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsr2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\Math.dll
%TEMP%\nsr2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'dnpyvcdunoqjvgajlhpcwotafdkxdpccnbog' WindowName: 'vudvbobovzrajwptbmrgjdgwfaejz'
ClassName: 'saceodqxkbsbooda' WindowName: 'itgrmwiepxbugvpmygxpenypljqxrmvn'
ClassName: 'uknydnzimywacuddzwasdhbpba' WindowName: 'ilhqhzkvvwfqohkildfbs'
ClassName: 'xoyfaabspomzkmsccbph' WindowName: 'zjtreiknuesqjwmqxkejlhweiunljkphqzkwe'
ClassName: 'nnjykmrilrugxofyuuxufcxraw' WindowName: 'yklnaxyvakavaplavrtdke'
ClassName: 'bbhalrwvgzipcfxhwyvnvjokscjysratb' WindowName: 'eilcyqjsubukzjupikkrizuk'
ClassName: 'yqgjlkdziroeikjosakfepkxwflxanazbpezml' WindowName: 'catpqtbvexitvjwbmamyjxgwwl'
ClassName: 'jrqkvvfsinzhgfptxahpgz' WindowName: 'lquqrtqzdvdpdiihzalhhetdse'
ClassName: 'pdugxlqsebdcedvslko' WindowName: 'nulkrlrptgqxzprpvzpglgintvjqfpnposq'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'svkjcwypdjoyukzcifkntycoxrdootreynf' WindowName: 'dubeaaikttfbisfbea'
ClassName: 'oprqtryjqdnyngrrcqnjxedpxuwpnxdtmilbc' WindowName: 'thqcrwgguiohdikordcaqiqtfcwjul'
ClassName: 'hvcvftcizjtcxeekgewxvwhmzxpdkcsbhxkity' WindowName: 'riowgduhnxownxigmadfcmgbvzidbv'
ClassName: 'xtivtriemzxfbfvepcxcachfkowedzumutuumpf' WindowName: 'vdkyraofgxntcqerobavvorbzkzxzytq'
ClassName: 'lgcumownvrktpgcpnddlqrbcltvwdeehoypy' WindowName: 'hkvqkemvvwtgjupvycf'
ClassName: 'oxzshilsmvzbaaprrvtabs' WindowName: 'vgkeyxxuiabdgco'
ClassName: 'ptjcioteaxbqwaiiyujpbraudovifhewo' WindowName: 'lnfeycrjtukkjhedhgshlgby'
ClassName: 'wngqnwqnewcznevixczvencripzwsm' WindowName: 'gmvbvbrgbzdvkiyjpurerkjgdwyufchuzkzi'
ClassName: 'szdxxxnejpsaxxjegtbnmmcdimkd' WindowName: 'aiiojrjtisyxyduhm'
ClassName: 'mgdtktrycjskrtphmkufws' WindowName: 'vjyocpwbykkaoijpjvcgmrps'
ClassName: 'fdfxexhtmonzfomnkwregzdbhplnyjr' WindowName: 'fhouhxkbrsrldemtdykwasrxg'
ClassName: 'ixgmxlmsuigojrlpxynpmweghhhqobrmyhtpw' WindowName: 'cgfliffehlmktivtyz'
ClassName: 'mbsejgsnrlugrhzvhleywqdnqqlawilvg' WindowName: 'uczihbxyjllbamddkeyimul'
ClassName: 'ozloyeiyxtitjafergiurmkcjx' WindowName: 'dfrckpiitvshdtptotfmgjxfminxxtngowcf'
ClassName: 'lpspjmilnaowljrwf' WindowName: 'pvcpbpdoonodtamjfoctjgfub'
ClassName: 'hphpjcusknmsuktzuuvcrkhaiyrtgc' WindowName: 'ijtyztkzjcemplsuaqmhk'
ClassName: 'aygofnfptgshywwrdxvcldgjorczeqxrplo' WindowName: 'ngssueefnhyplnonrqze'
ClassName: 'ihvmnmypwskxgeosouh' WindowName: 'qecnbmeshpsfvkurwowemnnwaxfzyop'
ClassName: 'akpyeiltopqwmrhdfvajgnnieuzyiovsmh' WindowName: 'jwqanaydrtnefgh'
ClassName: 'itgmrdavmejgravjtunmbrwnet' WindowName: 'kbmcknibaclroaklbskivhbac'
ClassName: 'tmkzfboefwxesmraofdwzoeuvjjtsw' WindowName: 'bclrqxokeplefkvvicpeahtcfrvanadvg'
ClassName: 'xivjqherlxrzkimxwzaupamybhjwrmbodie' WindowName: 'zcifgbilflzdsoitpsnrkvybxwlpjje'
ClassName: 'dhehzfixbphacvcclbwsxod' WindowName: 'kjtyykrjgtpsgfcpju'
ClassName: 'orbnbpkxeshgfvdwgxnashedsonaviorpa' WindowName: 'pspeqkiyclpcrrzcqghnlddrgqidojd'
ClassName: 'dvlpeaolkowerelcngdwmqtramx' WindowName: 'fcvsnvqyiqfcxyuvshzodfvlangtpqi'
ClassName: 'zeiwrssrffcvhnvqxyohgyshpaahisomtrxc' WindowName: 'iadsxneueknetvuavfyzblnb'
ClassName: 'adcnuqykaqlsfusrgcrd' WindowName: 'alsvwnibxuesnhfixkbuqcnewnhpbeiwg'
ClassName: 'iwyedfvmhdfxyomytsbxkdkitpmpfphhbxqzi' WindowName: 'byvjtyrmcvrxnewqjjqpavy'
ClassName: 'cfjllogyxhiexibseckprbzvkfavvpalww' WindowName: 'oszlmfbcyzzpmytgluxxllivpayydhlqfqiou'
ClassName: 'zmllffqsecugkczkbgdgeghftxsydadyy' WindowName: 'wirwbdfmecvqhulcjtnsswtr'
ClassName: 'uljttvkcpsrtvbdzqwbic' WindowName: 'emodxcclgbtxqqcnysflemstrshqvqcbwhh'
ClassName: 'jypfbgzmxffwihlxt' WindowName: 'qukgxvudyaqjwuxiihcenlqoaikm'
ClassName: 'eypahlpxlsgwcvkpee' WindowName: 'cibqjsrdpnmczuzdbdtccnp'
ClassName: 'sxukbukrwqsomvwussxlrconbjfwvnxrcg' WindowName: 'ldvefgzqeqhsevxxxmjcgancpwb'
ClassName: 'enzgsnbkkeiwcnk' WindowName: 'vvtdzvgsgdihmbabjazftkwtrcsuxxuhbwg'
ClassName: 'xbpxzmgokmhhdoxwjcdrt' WindowName: 'ohbusdnifgeeopupnhaparyn'
ClassName: 'qniacumyfzrveafythdqjjuvpyahwcax' WindowName: 'mdgafagtntiopgrixwqfxuqfkcdwjfc'
ClassName: 'vkwqemyhozjuxsinth' WindowName: 'irjqzzitpzkzjmfonqffhnqlkrqhdj'
ClassName: 'oehvkoprbvnsrrbufoyfbcvlibodanecy' WindowName: 'lcunrbdlubadjkf'
ClassName: 'fddmktzkiemeupqlvlmanihsy' WindowName: 'lerzjisaegmtvslepnbpyqso'
ClassName: 'aofldxaddblhonkagezls' WindowName: 'rpdxwoxcsulanniwlkioermnvnxswykjp'
ClassName: 'zhoyxnnwitijscahkgs' WindowName: 'aenliyqqxzmovhtomqeepoxmyz'
ClassName: 'dzqcdtubtiydcbzwivpvsfsukvlyuot' WindowName: 'uerszqhvdnijsyl'
ClassName: 'hraslrultminqnjxvqtrxhtaiqpgsst' WindowName: 'pmokdrisuzzycmhdusgle'
ClassName: 'ndvwkpxsumjvfiqkdyojokyohvito' WindowName: 'ryxdzoezmopcbmfkkzn'
ClassName: 'nqajlqqzxyspkzbqwttwdgozbesgjrhduwhoo' WindowName: 'vppqlmkjvaqpjnifgtpxzmsstpue'
ClassName: 'fnaiymimcblxxzgdfjrzvshrckycgvivr' WindowName: 'bbkkhwgkxojwmbhjlheixdguhyautnpw'
ClassName: 'onwqamtutiqlewdcoxsgyfosnxbjldviyfra' WindowName: 'zxtwrwzghvpdfkgslbuiklgfjzhcuidbkxqutxa'