Trojan.StartPage1.3990

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsi2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsi2.tmp\System.dll
%TEMP%\nsi2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsi2.tmp\System.dll
%TEMP%\nsi2.tmp\Math.dll
%TEMP%\nsi2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'qtncptehbrjijviaxbco' WindowName: 'nbmtgatpmmziqchrchfycruv'
ClassName: 'zmzlnanrrunjbciyuesjtwhey' WindowName: 'astssbeddqyvcxzwieq'
ClassName: 'hcjzwclfgndsfxzawhwffvriurkbqrhbdnyqw' WindowName: 'cgdhjjtupqzxfcqstydvtvwmrmyfnxkp'
ClassName: 'whtxkuyeasvfnstvteofshhvlhdapkzfs' WindowName: 'pnqyrtpudxtgxopba'
ClassName: 'ncfxwfraczezxxymbvlugakyjcy' WindowName: 'azheffhbtucvhlyilub'
ClassName: 'torfqqucdgzykuzbypfzvzdjpzqlze' WindowName: 'fdxquewluzakoheilxjiivsnlqtpuovodla'
ClassName: 'hanbaelckwiubffmmohewc' WindowName: 'cwodgqzuxqxkspmhbljhfsalbiuwmjtyqougiy'
ClassName: 'shuzmncomhtfrguewmzhdtv' WindowName: 'boemusvqteywhvxododpeuflsuv'
ClassName: 'syasmqqjxosrhdtngqqctbmfen' WindowName: 'cyfrshulujyjenfuxfnsmpurzbdcgwrvbrmuuei'
ClassName: 'nodjmhosehhbgaerpalyvtadtdtdohxox' WindowName: 'yqjpqcsxpzrvdbzgvtstcvfbfmusu'
ClassName: 'kjwqxyaqxlyutbwbwlfetitchmmcmv' WindowName: 'rsseqsrvnqqvenkghkvgtkxfueovorschhphnjg'
ClassName: 'vpawwtzbgslcqxauyjobum' WindowName: 'dxagpuykunfospbxmtipmf'
ClassName: 'jgvbbgmdnkyafeyxktudfxexlblgrpsebeanbq' WindowName: 'spscpwqvkiqbhxmwfjrtoldcyxnv'
ClassName: 'bljbxusmchujppr' WindowName: 'nzgdeacdiyaxlbmrxqmyhzpxtoemqpqcolxvvj'
ClassName: 'anipvgjsxdxhitvswzdvydpuwuztnwbbp' WindowName: 'tbdlneowgopcycgjjesnxfooereapstmyuqzx'
ClassName: 'ahkhtuivqkjhyupg' WindowName: 'iirovnbeanleepocjtxkrbtlxzpkew'
ClassName: 'vtamdjphnffjitzetutizi' WindowName: 'yqftrulwrlbzpiwullgisrtnbesdzvfrp'
ClassName: 'liobqcryqdepnwwtcmzzyambqnuoqkojylxucg' WindowName: 'titvvmvqfacmkhlbfvacaivsruiirqzfxys'
ClassName: 'rjckvkajmiecefcfrxanpgaiycfudbzlh' WindowName: 'raoawdylehfmivgwjefvanbzz'
ClassName: 'fyjtckyrwuqrulbtzvzarnce' WindowName: 'jdczssiddctvsikc'
ClassName: 'dmborgkluhrsggrcfjriztbenglyehdpz' WindowName: 'lmcgbfjlxnofqzttcyuec'
ClassName: 'bcayneubwdwchzlsg' WindowName: 'giolsgtglnfugtjopwoomhzta'
ClassName: 'jlcyugjwgsmscdopjzckblignktamy' WindowName: 'ovwqwrklkdulnxaqqlqavjzzknksftweojuw'
ClassName: 'mypbioerlfiuskwfbx' WindowName: 'iityiuhtovbwbirnnzlnxsxkiabasfnzk'
ClassName: 'mbtlevylnykfifsbzpha' WindowName: 'xduhgyzdednstzhtznkg'
ClassName: 'covjfldocfpedqcadvsyhhdy' WindowName: 'nnxfradfczckeqtznws'
ClassName: 'zynntduxwnzeaimcwsrbftsdnimfwcwrcy' WindowName: 'jcoobfkfesoyvzttjaamubxtdshgkquj'
ClassName: 'cuamnkjvumbpkqagsliljcwntey' WindowName: 'khjxqkutrpktxdepbzprcrjjomjega'
ClassName: 'nvrfstgnsrhpkimdmqssumvtgecoptxfctj' WindowName: 'xnylwlgbjhefffanpg'
ClassName: 'tieyvxisobgweqehnqncaazntjwhyrketet' WindowName: 'znwzininwryrmllpxwbzwklyriffklkas'
ClassName: 'avmknrsqcwafrcaubd' WindowName: 'vcpqvsbpbhgrfppezdmuv'
ClassName: 'wlfzpypabjazkgrobqvlmwtyhyaanvgajzzzqn' WindowName: 'inurxycssbyouwydicomkauaxvamanlggooyfa'
ClassName: 'hqcwsjjpmvalwxlhovqsm' WindowName: 'evrsdhujlwpbqheomamteentravllncvwttnh'
ClassName: 'wjaskxiuqpvcxfelllymkbfzdzvydifskkfbi' WindowName: 'vknloguorxnaouckliwxkfcuzxzrvoiy'
ClassName: 'jkwkaaoszzjgklwdlnowaucfjnmpyhkvrpyid' WindowName: 'uejoozzwmrwpwgzckewdnpfcqjwvrwi'
ClassName: 'zrhdhpkfblmjgtaqicn' WindowName: 'vqwbbjgrboexluuwhmryjcmjozjszyuwfg'
ClassName: 'lqhfmcbxfacsidooggxmxktcqtuetfyffq' WindowName: 'syoiiddtsgxqoxincozspu'
ClassName: 'btexmezxukwkxkyukyzwibddfdcrur' WindowName: 'xcwwdhyepeftjsfkhko'
ClassName: 'loteieikwwqpkophjd' WindowName: 'lcykvcwgzuvjaomjajbguutufsfu'
ClassName: 'tdmglaqkkdggghbibfm' WindowName: 'dhpkfncqdjbitetnunwewlxqzycuzchlamstvpr'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'cqflyejuqyfxioatgfrozjtmxwwljgtkqnfus' WindowName: 'hgklhwoxadyyewgpvizbcywprm'
ClassName: 'nytxqptlcyeybrmjatnerpf' WindowName: 'uujlkdzqaglmupvnf'
ClassName: 'yqceofhvavahawhrgbbxywllv' WindowName: 'ymqzghuambjlncqn'
ClassName: 'iozmguawjryuxlopkfm' WindowName: 'ulquzimpyalnxindd'
ClassName: 'vidwnruiisskufkdmvylxsnccdyfb' WindowName: 'jcpgrnpaboxbrvjrmwczvkeygg'
ClassName: 'tiufzizgoyikaplewtldkexblwnfwkwozqj' WindowName: 'hmztluogagzjjoyaib'
ClassName: 'acizmvpfsdcvhzjpzevvooofwcsktjvmbn' WindowName: 'ufntlkwuzzqyzqhkorlusgsmzpudfifcjk'
ClassName: 'chndigozeporzkdmsmlfqbmqmbbeag' WindowName: 'meavkzzcdrhyzetjhpjtufwerlxn'
ClassName: 'wzvhbkbupqmyivyiv' WindowName: 'ofocgzmthfazvhksnhagzirofyzx'
ClassName: 'sfxslyfbkkihmomt' WindowName: 'yjfsbsvyiqxeougd'
ClassName: 'mghjpbmqdxjqpxutgzjrhihrlqow' WindowName: 'ijgbmlqjyqtuuamrhplmtvquesfcvvepephibd'