Trojan.StartPage.59691

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsj2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll
%TEMP%\nsj2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'apalpfsvccnejpmhzkvnjdoryi' WindowName: 'ztelxqrpwznuenjckjptrjztaydypacb'
ClassName: 'hzkyxvabctlcbyx' WindowName: 'jahmvsmfqejsjiwwngfpmwmadmmsajecezfxg'
ClassName: 'zjrkuhkyqswkvdhnvgqgngntnxlaqgppmbk' WindowName: 'zqsmqbmcnxichbzhubth'
ClassName: 'sbqrulmcmjymgxzgswcwjjejfqmbqlhjqvh' WindowName: 'yjahdvyvghljbjjsx'
ClassName: 'srmwvetambswsorntyhtrlp' WindowName: 'bxkgcnprmnsxwljfcmoazhfnwmkyyrlyvnuhn'
ClassName: 'xtdnbcfcsukjdtydizolabtdskcusgz' WindowName: 'nkemeudxgzosbnffzluwnktdllkerfdzdeghvyr'
ClassName: 'lbwxpnmemwfgpoavbrcyepqid' WindowName: 'lqfksnbtjvsdldheffmioogi'
ClassName: 'qqivemyvignrpchxwoxdbdhuqlnoaedipnv' WindowName: 'pxhttqxrfgmjfyyiuogtkmfva'
ClassName: 'jeshpxueapfwliqqudohovjj' WindowName: 'rnhocbnkjzdzdbcuijyrd'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'pbtizpoovlzuubhjoolfvbhtzsflw' WindowName: 'wpbkdxwolpejkqxvnfxxc'
ClassName: 'llrozjdyngmbdcwzqttqhtoufm' WindowName: 'jruagcgyfhjowqivymwzfufwkbaavc'
ClassName: 'lhwnoxpbomtlkyapggjdpirqinrecskrbnbodm' WindowName: 'lqmqvflhhcajuenelpligobtyote'
ClassName: 'brilwobvwzczapuxiww' WindowName: 'sdoigddezdaklnnnnmiohhjpbgiqbcfps'
ClassName: 'rhaogsvjgjadjwkvvexgnp' WindowName: 'muqcpcxwwhztgotqulairt'
ClassName: 'fmwslcvbtfeduxuwscvpxvgqpvkvlkqw' WindowName: 'tepepunqmjklawtsgoamertpnmmiy'
ClassName: 'kmdhzctpxejjosisduphcotboasfwuhnuzcgvgx' WindowName: 'dgsneigxbajncuvgldgkcrldmhzkaeeduisfjwk'
ClassName: 'rhkauvyreuzahhwjiveoeoxwofpo' WindowName: 'lapgkvyycszntazhttuc'
ClassName: 'wagrhnectrqqdqhrcgbbotcuihxogtdodzgxdp' WindowName: 'sogxnxqzltyirzkhyjtnwesyqdxbq'
ClassName: 'mqyrwbaaiidzadmrjyfwxq' WindowName: 'suixvarbxpbvlpprtkerezfdfpmwxxh'
ClassName: 'gfegnozqxndaysitpkgdjdrwnepbkdh' WindowName: 'svzrxfibrfcovepskxu'
ClassName: 'uoolfolqrgziswvttnjkjrrexfhjypfmo' WindowName: 'cawxndjsdrxxsumrlfmwee'
ClassName: 'twllhtwjnukzywlcybqicylgaiskbvwyithhbb' WindowName: 'ujwpmsacxtblooxcgsipeswm'
ClassName: 'nopgnwrfmdppnfxabzpfjumwfkayivuxni' WindowName: 'ykvuilgunikfocucd'
ClassName: 'nfeclyrlyycbvaekibbgoycrxdtavr' WindowName: 'asdeouquzwadzydwdthjhlmzqgnfg'
ClassName: 'elxfhurccfmcigrnmcwkrqsqrxgfrl' WindowName: 'oammsdonrxzlcebgjzrgzruszbi'
ClassName: 'pqbfccufawhykpwuorvhkcbqwnvnnpwryr' WindowName: 'pybmnmouxzrfmebzzwfuegtcpnuacanmfhaaxl'
ClassName: 'utbvrcishejzpmtqhecohympvbid' WindowName: 'dwtmglqulgllrbqhrmovv'
ClassName: 'ismponmcrewxkakwvasnxbomdviiqbi' WindowName: 'xzomqyxuusqgsvuiznffwgslgjqbkh'
ClassName: 'ficrzcfusczxrqwtiuaisi' WindowName: 'xttijjafcjmstiyudfdgjxdf'
ClassName: 'evcmdqlcmwhfwpfdgvltvrwhltmzaaht' WindowName: 'cemvrndxapkjkwaasnfxco'
ClassName: 'ugiudvshvafpnqcrgzutrxjgf' WindowName: 'qzfufyzzbtuiejcnwlfvpbmgqzcaigcixiclqi'
ClassName: 'xhwxfitkhyuvwdspjpbax' WindowName: 'jzxubgfsokxfgmfnfplrlanncb'
ClassName: 'qwoptyktfufrzplobktwvumvbewnd' WindowName: 'mfuqxsmdlbizwwfujfezrhoj'
ClassName: 'yjcibommnpeainzstknkyfcsscqbjvr' WindowName: 'qqveijccdapolbznftowmpvgyvw'
ClassName: 'tcqywvocymqgbehtbahzrvoetbucibiztqhk' WindowName: 'qgufdheqkinhovywthefhj'
ClassName: 'ebhfpajkcfiikccedgm' WindowName: 'nfvcggoaxiikphkkuonzjjjsmwbx'
ClassName: 'ieqztvfpiaktjjwryjnwxli' WindowName: 'hcehtnendqvbfshialu'
ClassName: 'hlxvkkpfnsebkghhcidz' WindowName: 'krhmqhxfluprnjayxuwlyva'
ClassName: 'qdzuabooaxtjeegrbpexjsknzwuwbhtnkqf' WindowName: 'qpkwbthbdszlxhpicaspkkncbhdbhsiruw'
ClassName: 'amvyoyzmkwcozpcazqkqffktcntzwyoom' WindowName: 'bsxxpkatjdbohzatpixdtuatutkoysgn'
ClassName: 'wnjcjiqrlrnrofxarkozghqbbmnqrbzverd' WindowName: 'zsjxtpwcvmntxxdhqdxajnmpiqtnxkywx'
ClassName: 'cezldxzeaigxksqfed' WindowName: 'aworedmtlobxezgtomjcug'
ClassName: 'fcjwmubgtlxkqqjxezxqzrusatnj' WindowName: 'ieoxmpnqcvaufttsurl'
ClassName: 'pufbgohwmffxijkbnqzah' WindowName: 'zxmihukmuoezqjhvpxhqpa'
ClassName: 'uakkouahuoqbluezpmpvupybphnwxvcfzlfh' WindowName: 'eclxiiqkyxexjwdnwsqeloaqdntfpnzm'
ClassName: 'fwxtweuwxhottsd' WindowName: 'hqqyfznsovjsbaplxydqmffxcff'
ClassName: 'lkowfgzbzaainjtlenbvlntxinerkneoc' WindowName: 'nontnbnklostixnmldryujbkvwdurmsaoxudgu'
ClassName: 'ghequzqpsriditcstyjhcznwqkgksmcpgfaguj' WindowName: 'hfzhmqlwovmskwucevozswetqyvxeavmdi'
ClassName: 'kjmaxcxgzrzfxbg' WindowName: 'bathxhxdjaovihwpzvwzlt'
ClassName: 'pubfoyhmjsvusofqsrcrywnhipiyfkdwxcsmon' WindowName: 'mxqzjqghmcetxwnmiadvfpf'
ClassName: 'axiicqtaicacfqlemibxurdoltnqerw' WindowName: 'ggwyajnnbtekavfouthbcjesnxouoioo'
ClassName: 'bdbnziqzhsayyraibeqajajylldqfr' WindowName: 'ymleaqxtgdxoesnbkgptlbdgdlttsqiiuhyonq'
ClassName: 'worfvcpeikzhmcgxwdlhlghstwcqng' WindowName: 'kfgwkecsbyslqfelmvvfcawfjamqyxocadnomwk'
ClassName: 'upcdkhlvuvhfqwtqbbwhxqsypv' WindowName: 'fectnvlybjldaiczjigfxogiysaylj'
ClassName: 'awvgbqnxxsnixuapihsbszpee' WindowName: 'wibzqahymaayomuqhadcqsafftfsppeoulpmkci'
ClassName: 'yqveofqooxzwrheikwkhbdqfvseskgywxrsulr' WindowName: 'goqhnwsdhhdqrmmjntmxovyrtercqumxzqo'
ClassName: 'bkssdxljuvddgjguipqjhwtkcv' WindowName: 'fyvsmscwkgbdwizjzzde'
ClassName: 'byuwhrcahnpcvsceozwgq' WindowName: 'gsvjqboyvvhwdac'
ClassName: 'pkwdbrtlmbkzrpp' WindowName: 'uitabtaqwazqqvrphmcnvxctm'