Trojan.StartPage.58312

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsr2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\Math.dll
%TEMP%\nsr2.tmp\InetLoad.dll

Сетевая активность:

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'nnfutvkryvzawigauzxtwgiyh' WindowName: 'oajpkvivhdgtbfkcefpxunieixi'
ClassName: 'vpmaucvlnfuklvmafjuckmtuvdwiay' WindowName: 'gqeqnmveqdpmkhoxglemsxpkvfyzznce'
ClassName: 'cjdxecfmshdoegafsxthhqlsppdx' WindowName: 'dwieermljuosmfvxlsmwdpitausmkrl'
ClassName: 'dgphfkpcezexfixegyefvuyjrcnq' WindowName: 'sptvpotoijdgbmtwcgqplxnxdea'
ClassName: 'zgpuxdnymavxjhypdekqtwjhvpvtzpeqt' WindowName: 'imtoyrvhjhfacuswdzleooaxvwbxdrtin'
ClassName: 'ndwkcjqlsiikjikwmnnfkljrhfsbbeqpqudw' WindowName: 'bjghxqtkgolpkkvvvzcanbmtlbumiapfrioh'
ClassName: 'hlelwpdonpefkcwvepbphdewuakbs' WindowName: 'iyaatevbykcmrtfnjchrxj'
ClassName: 'laqlmmnegoalhgcixhijfmwkbangfal' WindowName: 'eahqnltcxofvljifnnxkwcb'
ClassName: 'rxpjzqoaymyorumbbirynfitsagxvurlxyjzlre' WindowName: 'uhzqelfjpexnrqoldyk'
ClassName: 'dynplczkrhbzaryyvfvkznz' WindowName: 'mymvnraoueohobothenaggsvoshzwqsskcjod'
ClassName: 'zvnmlaydwjucdsdvoxhw' WindowName: 'cdvvnklseduvxibnmjldusfpjzxltjukby'
ClassName: 'dbrtxhkdkufoaxrpqujt' WindowName: 'zrtbpldwauwgudensfcyuesaorzzhfw'
ClassName: 'fnjwfclspbnbxrcxzrcrfahheqzhrviqlw' WindowName: 'jsarsotkwwbfzvcbvzrhduwjsdro'
ClassName: 'hbjpedbjkljngpyipqbodlcg' WindowName: 'izjwukeearbtecxgcujmdbnnkmzkfef'
ClassName: 'zrqenscymlzbwqksooeunjajvxyof' WindowName: 'lbdwzpgobttyempomy'
ClassName: 'resvugkwbrjolflowebfimpesg' WindowName: 'mzhyigxdsqwhsdqtwozqq'
ClassName: 'okvpdqqddyqhfrlesigihtzeopvv' WindowName: 'ktfvwflyopplfquxgvgkviyyeyxstmfldykziz'
ClassName: 'onryjszrrteonwddkjoa' WindowName: 'fvlkbsikkrafoxdreniasfhzwutcuhqvrzuofae'
ClassName: 'bcftnphejzkstbktmyxpsaod' WindowName: 'kxojsuwrvyjfnnkzuvlkipx'
ClassName: 'caceslurbhdpyjywreuwagcfrlgcfsru' WindowName: 'bjmzuziyxazsuvtgzfewivspdbbiklkbo'
ClassName: 'czyvhavyycosqjoyrfspdznjmmfe' WindowName: 'yccpcvowfyyjsbeeex'
ClassName: 'zvyxrclbwfwwfiwdqka' WindowName: 'tgojfoklxjqzmzpkndnvrksxjhod'
ClassName: 'mquyiwdugxhgmerqqmmqdozrqn' WindowName: 'niveiriqrjmmfkumsjvznzuab'
ClassName: 'rbjtolfwrblplwvcejmucacyqrytja' WindowName: 'qgxciqnngwowamlmiftee'
ClassName: 'krjdzklemxavfuqlwkvchtc' WindowName: 'ktmpuhgjwsdwmwbudkysfcjsavtmkkywm'
ClassName: 'nbwjefwyplqvupgwspjeubziohecewct' WindowName: 'rzhubkrajiggcviiuxvrjps'
ClassName: 'hrnxmzuesspbnvfzqyuynpcsq' WindowName: 'lzixidggqvwsetaowkj'
ClassName: 'xqpyuxkweqvcsasgxdypx' WindowName: 'okgtrwmnbpabclxuzemsparastrohyhmvoil'
ClassName: 'wvftfgowyfdehqcqnqxszaffnnriglyyetalwv' WindowName: 'grrvxmgfwmycohoevruhlxxcquzo'
ClassName: 'mirjuhwsybtttnefiz' WindowName: 'shzrfptgzszhsdafq'
ClassName: 'zkbftyedoklxyruaohfbjipknzvnijthjmba' WindowName: 'hqtnzaeqbgvrnjdgsmbcvieanm'
ClassName: 'eszaeuplurbakxgsaezem' WindowName: 'teozvaebjtgqnzpwpqkhbtzsjvjsrfsvsroi'
ClassName: 'ztawlvzaurrvexyqaydunonrqmpe' WindowName: 'iqqtezhsbqxrsvdxgeatfw'
ClassName: 'xpyxaieuhvagdqkaylxcfkpbfrjxllbkknp' WindowName: 'xnsvsezqmsbnxpdkwsznylnog'
ClassName: 'modmzgnxnxattpmqsfhhcjk' WindowName: 'hmpsltmcrwwxjqkyqveqtxzugrwclpkfaj'
ClassName: 'wrgkfefynkjahpkfc' WindowName: 'lomwccfbbeikokbkbaunuju'
ClassName: 'fhvlhrvbrakwinenbmjoqzuqaihxw' WindowName: 'sardcguiadfavyaicexjdzywciuaen'
ClassName: 'wmyqqrkvppcvysomvsilbmhlet' WindowName: 'brgsbfkuzxdvgptuickaazjkcpn'
ClassName: 'sfzggjhvhhtdmjm' WindowName: 'lejvxgxtoujkgruqhqabpcwv'
ClassName: 'yedfpzlxzhkriblcawsybr' WindowName: 'nuxndcpcqnoznrnpmiukbvwhfabrhbwb'
ClassName: 'lrjipjbyanjewxmdlecifpkpdnazucuw' WindowName: 'hudivvctaqwaatuqmaoytzspihqzvjmnagoln'
ClassName: 'uwiwedritqgopbiocgpavlltxvnke' WindowName: 'gypqqodniwvxzddkoabfssnqknpcagap'
ClassName: 'atyhvzishsvujylshndunxedkstaswgnyksqd' WindowName: 'fmsjszsbpnummxnchwxvfsejvguellzmudfh'
ClassName: 'onfsawdpsznyapqfoukoexrfrqdhudxgutyk' WindowName: 'dqqnnqbzzzqoecjtlaagflrzxrsj'
ClassName: 'anhhgiofvxnpbscbvxvikrsorbcdnfczggupxmw' WindowName: 'zpryvkaatinjwveutzcuvlilygok'
ClassName: 'myowdpgwfugatluyaqoredocfnlxydizkpjadim' WindowName: 'uwxpexdwipbmamcahwyuervlihajwqraajehi'
ClassName: 'urlelmfspsclnirnvqjgyifnqortptackr' WindowName: 'owluaxoraksfjoiuauatobilarmbueavjkkzv'
ClassName: 'fxbmmwisvsqfhqisebfjmk' WindowName: 'ywlmqueqtxyglhbnjcuvnplqb'
ClassName: 'ieknrpktdnqlwabtmygfagvumvvzrvyhblbt' WindowName: 'npzjpkhofyjmotiiyyhxbzhcgobmaabusosw'
ClassName: 'ydxfonrnxjytoupwrdttpqg' WindowName: 'ybcaccypnbxdnvmwghqjoiau'
ClassName: 'oyladlpglwcocwnawtekreqysldbw' WindowName: 'xhicnuzstfggkghgeepj'
ClassName: 'nfwluqdujakfnbjhnqvzltbjpi' WindowName: 'crpwepmgqxsjjvgtnnrpxybnwswtpo'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'odoxyfzocsqlehqxkvthjjttgxbn' WindowName: 'wpjimognxqbttazqhmjhjtnc'
ClassName: 'whabetpgrsopzopeswxutb' WindowName: 'epddkiniffmhiqmhshvp'
ClassName: 'clrascvotbtkkrpzcxepiuztuqpvfwkq' WindowName: 'lssfblnofnjzjdkgpqicfvmgwwlhcvmgqj'
ClassName: 'qeplwplsydlahyrwuymgzlwfdgjyrzujt' WindowName: 'upnwyiyvrvkhhrk'
ClassName: 'bhsgiijdeovbgeqdrranycgxzltpbfkx' WindowName: 'bnjmzpzwmgaoiotiknskrbneklhbozdverqzrm'
ClassName: 'jjeugcskkcwfhoicyjqdttoblzjtpxzdxwc' WindowName: 'lemusetprgxguczvbrinbdjinqgn'
ClassName: 'wjhrvrwjwcoamhir' WindowName: 'vyjlccnhdxtqgboqp'
ClassName: 'nzsdsdnfxindvgbgqtjqxsjgzvrxfyn' WindowName: 'dxowaxqoyseknoygzdq'
ClassName: 'lpnrhmrijwdtwqfg' WindowName: 'uqztvmbinxelosbtzbeagszwa'
ClassName: 'zkctbarkvbvwirspplfgovetevqdnuyqyxovjd' WindowName: 'gjmxmiiaknxcvxejazpccdknfgpgbfiaofju'
ClassName: 'tewkltoftsfwpcxfpyijer' WindowName: 'qsbyskrgxbflmjkaqj'