Trojan.StartPage.59165

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsw2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll
%TEMP%\nsw2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'jcvkbzuynoyzqsxlpntjprwcmckmbiiq' WindowName: 'iqlzgpqhzdoisqrtpgnzmu'
ClassName: 'surgdxgjtjkdoemhylisgsmmlfskdiiwgemmk' WindowName: 'qnbxvoasltxkugbc'
ClassName: 'dcmwiyejclueucrgmpbclnyddknwujtvamscz' WindowName: 'jtgqbitmmiihzlfhvwipkv'
ClassName: 'eejrfrkwtioyeqvwaqdazpiisthzibsuuzr' WindowName: 'ptnndjjjyjepmjjplmrnkpyhk'
ClassName: 'ownygcquxksjzxmhohjrcre' WindowName: 'aoxhrluywxbotemiaemwmhibiyunfvyomitd'
ClassName: 'ueyvdfqndtvrosozkpxllbqsszyhlslt' WindowName: 'imkmgmmnalzkijqtxyydmnljp'
ClassName: 'uggilzkenlkpupiguiowqwwsclnrqbehbktzo' WindowName: 'yfcitpsjzytqazgxdxnitjl'
ClassName: 'ngqperqgtdedqdcvolsrhnpmfplqkuhrpzodhxh' WindowName: 'ohniejmpwtuqzvqebpxcuttpipuzigykulhy'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'pdvksonnzotmqazcbsagwzfbjlinkh' WindowName: 'scackjdemcsusietqqjonuxleprtfwnon'
ClassName: 'ohhzojwoamzuvmzqtxvzvzrjglsnwufwrmd' WindowName: 'ieqmdweyvudfrioljgeqozowsvcgpnjtm'
ClassName: 'sgtjuvszurktahkpsuhogbf' WindowName: 'wihppilnxrtmudpwkjgdvunnbdrquj'
ClassName: 'xbeievdonzxbsbakxcqzxzypgmlfeozzwkdb' WindowName: 'pweikqyzufbxvbasnkmjshriqxquvgticegogj'
ClassName: 'ubhcsymqfcdnrcpcukklbj' WindowName: 'jejkiroxerjizsug'
ClassName: 'xphdnfvnktkgwlbaamuvkfhnyitrnnfwaiyut' WindowName: 'nrunwgnmqgbebsynrhhztqgegidszrzj'
ClassName: 'zqbzpkwdlmjscitqbpiexlmightgffhmgwde' WindowName: 'ywpdjxsjsvfmllfxer'
ClassName: 'qydzcrbjfgauuvlkwgfhilmkxv' WindowName: 'tspevlkvfbeskyt'
ClassName: 'xkleoecrfwtomhpdpjtjcitekdpgrxuwmynkkml' WindowName: 'sfecsnmfbbhvpmqns'
ClassName: 'mobgnvnfqkjvsdt' WindowName: 'pvdcqbdbmwtwltylyrvcvhlhpujtfywphzvlnn'
ClassName: 'yhcgxtgyewfmrzwdhgvxvcnntbaetmbpmsqtjv' WindowName: 'lykoeppvpngszsmlieqxz'
ClassName: 'oxojtfpbeadhcrntqnrtjdcxirtadptnbcj' WindowName: 'nrngkcapyzwptbbfmw'
ClassName: 'fdzlzqaerpkxdzgxbtduuitzefxkureyirnf' WindowName: 'qaardwbuublsodo'
ClassName: 'urmobirbiygyjexplhvdlogmco' WindowName: 'pymcxyekoshzombg'
ClassName: 'clwikktrgovvobyfsbwxxzad' WindowName: 'oinmdmphdfplejiobdgmjwitkerxpgosxsxpk'
ClassName: 'emnpjqmgcantthhqadujlk' WindowName: 'jwbmrulmnqwsrrkpsakvsmhaib'
ClassName: 'gmdftjezqsahqyzphxezomgepfjykmigtupxgxt' WindowName: 'ikqukdppqkderiqmzvvrznlyoemogdyqlth'
ClassName: 'rmnlkfubbfsdcxadtehfsoadbuaq' WindowName: 'hzcsmecrfwdbtxc'
ClassName: 'qqllqvsttodkjwhsimzdwgidbchbephdjergfu' WindowName: 'qcxlecowsidwseqlrtzfeanik'
ClassName: 'rzfnkfgyelttfsxekzeoj' WindowName: 'jhwpoypwrigemoxtkf'
ClassName: 'nowyxbkgsvejagalzxgdhgyvppbturgtpx' WindowName: 'hfhnfcrvitbtuyoavlkzgrasdvktyrkgptdpg'
ClassName: 'sivyxgdxsyjbhzligp' WindowName: 'qfkrkxbqggonxicvnhnbzzwpnpeomlnhkwf'
ClassName: 'yeoznxhbjupxunbwsqvsoksusepad' WindowName: 'uraqpkftzrxzfcszcsnaysbmdbsdtm'
ClassName: 'rrghrtlvkhqwdzvqgltjzivpvzivcqw' WindowName: 'urweyzygfnnfgzpoeqnoa'
ClassName: 'omyvyqengcfqlporfymwmhlbefpbkbgbaz' WindowName: 'dwurhuvhdwkwemyltzpy'
ClassName: 'bpbckjuqcaqflnpczkrbb' WindowName: 'ckgbugeybmqwxdaidzjssranyncvuoq'
ClassName: 'aysxcjikfvcbqldelteiebwtqpykzmlldz' WindowName: 'lfeeodzogwdjweyk'
ClassName: 'rnaqdldsnzbgkbgazxnasvf' WindowName: 'itbupzgturryxuderowuaxuxzdauvy'
ClassName: 'dqgzvqrdwukvtenuwkwjijejyu' WindowName: 'qxnvakktuvbqdeuodjmwxzwihwgpj'
ClassName: 'wtsbkdyubcwavftphbiumuhqlhsvryyakvhymbq' WindowName: 'ghlbbcclsnpjhsvoxwfaorxbldmkbfquu'
ClassName: 'zqjqwyffdfwwlpcdroyyqcxrknxnbhzlayzon' WindowName: 'gxateapbzfmtbgbhmiwdhtg'
ClassName: 'zxopqbnzuxduczlelxvcuujutemwoha' WindowName: 'muygccbbdjtxmmafotanprsevzowhuugldnmpct'
ClassName: 'lnztsksncrurvnusfhgozpoxflysgvemdrmqp' WindowName: 'vbcqiqxltvhbgmoo'
ClassName: 'bsykmefdxpwenvevcotxkkdlfvkdi' WindowName: 'qotefkaecnqnkqfipcvimubzybav'
ClassName: 'zrwysvlsnlerzpcvww' WindowName: 'hwovzqrqqiwevgmqhpeho'
ClassName: 'tqetszxxehmzkvfocnpgybgkz' WindowName: 'fuprpkoinzsghxjsnoyfygqwqhvqbzq'
ClassName: 'hpwirmnniphrrnfxawkcigkzrblirfx' WindowName: 'qwudjwbfseqvjrxsla'
ClassName: 'nkwomzzmfzppwinohpmmwhmmnofjeuhumitgmo' WindowName: 'fzaxxqfcddfqawmbujtigkpqwcoxjlreqlqnric'
ClassName: 'kseqssffhzkklsuyiulfvh' WindowName: 'tzewlbgxankklqrrvyaanvpl'
ClassName: 'elnigjdyjefmnwwcypecjycosjvuyiqcmdsx' WindowName: 'jylxutwurfshxtymedqtpmkjdylasqyaxfvsfvg'
ClassName: 'xmsxmsnezqfkntmhokiguwvcyscmwgimadb' WindowName: 'rcisdykzvjiiilapixhkfsucbpdwopvhvhg'
ClassName: 'uwgsamjfrjvcgmoh' WindowName: 'onnvadffyvjkucbmmvhmgrfzqyolbafkd'
ClassName: 'ayyqfghdxvkscxqxboedotegenwrsdyskdphl' WindowName: 'uusepdrmyenriuhh'
ClassName: 'iopbfwiqyapgmmharlaf' WindowName: 'aagyhhlzivpiaukysgfcsxppsxsw'
ClassName: 'jjruquybsbndyvpicsphiz' WindowName: 'qidpndzgmkezqmiem'
ClassName: 'vgxikwwhrzqcfkfeladaoznbcpblwrxs' WindowName: 'tztuukrdlgjeytzrufrjmcbnkklvoftgtvtzwu'
ClassName: 'dbkfrpyikbkcwsfyhdolmndhknbz' WindowName: 'vibszegxvfyykfxmp'
ClassName: 'eqcfnthybphxmkhjbwxnxurvkpxzwcjfezm' WindowName: 'uuedrzszmlqcmcncjxbowdmkvtquxhqw'
ClassName: 'lxbqvrsjaejrmvkgzksnzuxcxymuotnn' WindowName: 'whdwhxuvnwjcmgdmdiorisifaxhth'
ClassName: 'qixghxbjjxeucktfipstrsxqxhxna' WindowName: 'nkfugwmsuqwmnbgfiirmcnvkzyemlybeymzcj'
ClassName: 'zqxezbwrnfmzsoogmhffszi' WindowName: 'lmkwkaroahnuoxwyjrejrgmtfswhzjudgiq'
ClassName: 'jsmmjypdnbnzsuha' WindowName: 'jbvoyrtqyuwlirvpoqwnoceykmjjsgcozbzmdg'