Trojan.StartPage.58874

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsr2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\Math.dll
%TEMP%\nsr2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'tmuxgyfoaxacyyfvlrqtanglkipnlogt' WindowName: 'oryfoevklwddeseabfltkcqxfmuq'
ClassName: 'tlkjfzaruqyumfskoqivktduluk' WindowName: 'pddfgpzxvbujouiaur'
ClassName: 'rcooklaayvilzsxomuzftgp' WindowName: 'hcqwljtrcalwkpnoowhuykkzpqwnrocpgxadrb'
ClassName: 'pfycvluclrlnmokjo' WindowName: 'hxvlanwbuymthglwuapkhhgjgrvvgtokk'
ClassName: 'ykkshrzaecezdrqcjxghzxkprxzslkj' WindowName: 'phjolvkoalintddxrfsrks'
ClassName: 'pahqvnlffhcqkzewyzfjjjvbaivngt' WindowName: 'qbygonuhcfpzunjweygtylzp'
ClassName: 'zqrisolvojvkovbhlxrqst' WindowName: 'ytcvekfjvmhfloxddhuqsgdn'
ClassName: 'cqwcbhvigydsaskoflzlzajtp' WindowName: 'aghkxuzvzqkhteytdwxlljdb'
ClassName: 'dnqbinkonwoipvsrcwzdryhridoyjljisxvefu' WindowName: 'cvvuiqxgfptlljtldztvjdcmvtxmccdf'
ClassName: 'fwwaiisgqmvmpythkloeyomcygrjatdgwj' WindowName: 'ggnrpfuyruwgdhztimtstmqm'
ClassName: 'uhzoiomyztjwjrskrruqmegtkvy' WindowName: 'uiahrkugaxdifcszzvkdjfima'
ClassName: 'csxeothtqlrdhnuqumlnqfhlpdbmqlqt' WindowName: 'ulvwwqvnretbosheyktkozudszlroplucfmz'
ClassName: 'vigeuoroxccjufzyawprynqghgpxedr' WindowName: 'agcktksaskrfsjm'
ClassName: 'hgmvodoooopwduvgjod' WindowName: 'pvvnwvyjexsqbycukrtanoakksdeir'
ClassName: 'ebccnvhqzcofslzvgbyekpnncmsgebkxrmlanv' WindowName: 'mfbuzcuiroewndwjpnmhfuvrejesdwjsrfeabd'
ClassName: 'huxcovhaaicvxhzjutnvvm' WindowName: 'yqrdewtvjfufddeu'
ClassName: 'snyeafeghgwhbkuxlrclghtdrptmtwamymsk' WindowName: 'bxrvfecxtciwdnlaevcpxhdzdjnexyw'
ClassName: 'ojhbqcmrufsexhssmwpxnuwhqplofrlpapmazz' WindowName: 'tnyvmdgxktzmacevefhzqbgfijbbuj'
ClassName: 'qrurrnngeeqyghdfjzhrdvskr' WindowName: 'qlpkmggrabwtgwycvwrvbjojlwpslkfepqel'
ClassName: 'leuarwetxszgiamovfwdysnyk' WindowName: 'yaxcwvdywiiydunst'
ClassName: 'ctjctrlaneipfmwveaomfbjmgxjmzrzotpzyx' WindowName: 'szbszktemwgvaomfwyyrmqlgdjreauomfm'
ClassName: 'zgoihxekgpmofjczybhfqiaeyqtnaq' WindowName: 'ficiaoqbzogvhnlwjwjmozlgaotjswwbtldib'
ClassName: 'yzydyrxtusxwmfvjskl' WindowName: 'loreotkrhbnvknhjlupbrrny'
ClassName: 'nsygdiwluxcjctfvkvb' WindowName: 'txjivvvpqwgyfpbedmd'
ClassName: 'wjeayekxcyjcyznegevmbhirhrtbjbb' WindowName: 'wwmxcofqvoqweuncgsxvggszmmmrek'
ClassName: 'ksalcxlfkyjbertuuv' WindowName: 'gwxbijfpfmbzvchmjvfr'
ClassName: 'wsundagizvnovbnhdtwjoctmijmnilzsf' WindowName: 'duqpzmajcxmehycsbetdarkbhbstlwpcgfychgk'
ClassName: 'bwwkjsoufbsoyskutnka' WindowName: 'fantterqiwtuzmlpkbqfd'
ClassName: 'cwrmzfpulazaszzwembuyzvoymlsq' WindowName: 'tpnsrjvdwfukwnnzzhwdrroyelfqbymz'
ClassName: 'kqjcgivinhgqzupgyjqbaxspkdfzy' WindowName: 'rvfrwmrukyxlyfdyilgcynzvlceubqdtplp'
ClassName: 'tbthexlfumlmbhxiuzrewibgcwvnd' WindowName: 'fbipbvrxygzorhza'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'jxudtsiatuwlniifxlgcw' WindowName: 'apbrbwixmcjxlbtifrvavjbnfziicsckinr'
ClassName: 'huekyazwzyvwyxzxvepakp' WindowName: 'xwsbzhwtsgpofgvhewcwqxwslqhejpitto'
ClassName: 'yvcciwcywxweskoewkgrsyxkbpvzwpfjy' WindowName: 'qtshgdyxptozusy'
ClassName: 'fxojpxbcxdjjqnhihqvppkbn' WindowName: 'qroplsdyxdzhocwqeopzeyozbknxvctyq'
ClassName: 'cifznbzznrbqaayfj' WindowName: 'roxxbnvgwzvxdzkdx'
ClassName: 'tfhbdiqssppoiuu' WindowName: 'smbkhpyrviqksblmnruireuxfdtbnjwri'
ClassName: 'fitfoykvxinrgdzmpoplhlkkpimahkcvuxxlehj' WindowName: 'adenjhjlctkahxsmvbqwfew'
ClassName: 'cieblajhsnfuwmomavwnewkiclkznfqikpbtvlf' WindowName: 'kdqbxxwrupyniafhiqooremrgunwr'
ClassName: 'zcmjqxixieaqafxkbewvikszmqsalmgpxv' WindowName: 'hgebycsyepkxqcmqssvrhwkmmh'
ClassName: 'ewlwipipdquyjfg' WindowName: 'ysfjrcoypooyjqnoeplp'
ClassName: 'bmkajpfmxvypvctnifwvxzvmbxgkv' WindowName: 'xatnvcrllayhgvhstqkv'
ClassName: 'fhbktdxjywcqsuktpoprh' WindowName: 'uyunmkigjdgdkqwq'
ClassName: 'patorjpliasfxgbkplsyrlnoh' WindowName: 'wylnacfitqhcnqbbuinanpeumpjvzze'
ClassName: 'flzvlxjresakdkmtwskfwtfasrvom' WindowName: 'aeeylzvqiccqpzaxebamrizrenvttvjywmwd'
ClassName: 'ycizrssjpjvourxayokos' WindowName: 'oxutmbnuvowyhidziqeyinssbsrmmld'
ClassName: 'dpbuoeubzafjgyvpjizylnagqqhmmesujaif' WindowName: 'jfgufqamtbkmlxilluwzxntgvmzmd'
ClassName: 'pfehruxwvziktsxskdmbafu' WindowName: 'uqyfmrspgtkeikrbntcewosjchdjvtbmdtc'
ClassName: 'gsxiwxkymxsehqnjgthsvlkbp' WindowName: 'lvhjdjmzymbjhajgxndtizfwpokvrxsafzklrv'
ClassName: 'zmvobuwhzjxwpydndkvukyivzezxmobj' WindowName: 'juuzxzvpaqajzlrtgnw'
ClassName: 'mlaigrocbtejozttvzoqnzoqrxxodtnqctw' WindowName: 'cpvgjxdibtxfuwstyyxvfbqcqdey'
ClassName: 'wcpcqlrrgigqbiewxkd' WindowName: 'fqlhvofrjmrzmky'
ClassName: 'rsqyzqeulaizmlwwb' WindowName: 'pntqbhgnqavqopxmx'
ClassName: 'gosumirpcsqtjqdikeeazflywmgwgiau' WindowName: 'emwkwsrnylbeyezvyxcqixataotaebjrhe'
ClassName: 'vhfgllkobbypemjaduuconbtgbud' WindowName: 'vnquxxquvwbnnucyatcgyvp'
ClassName: 'chzkpurkymrdoddfbmfwjvoycyldyqnq' WindowName: 'nxwepblfzubsrnjjmqzthksohpkuqtkfof'
ClassName: 'ervfwiydamkzhjypkpnyrgbaiwhg' WindowName: 'cyzwgyyrdejdktqhhhtzwcaxd'
ClassName: 'nfycjvxxxednroviikxqsltwsyz' WindowName: 'havmsvqdxzenxhyujdngpvbvddxkgfdfxpzvhw'
ClassName: 'ugwaquyyitvmftahv' WindowName: 'qrdzneuntcnwnqvivnnomdslndj'
ClassName: 'etplrngolsezmbfosatsb' WindowName: 'pjbstpwtiiqxebjgcls'
ClassName: 'unwfjisskvucmmtthyztpu' WindowName: 'ycksdndrlfhrwdvnyvfsdhj'
ClassName: 'ucfxvaugcitkmbnghizpxoxlrcezlkmn' WindowName: 'abnsabboubeofbsxnbobtaemkmshgptcdiryyoi'