Trojan.StartPage.59167

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsa2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll
%TEMP%\nsa2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'phmewlunggztevicauzympmnrrmkijpe' WindowName: 'eqvtvgjyewlohtczrcrgyreyfvijxexbcpbpf'
ClassName: 'wtayrwbxzrdpkkdolkjyzrqc' WindowName: 'iooacjshbismvvso'
ClassName: 'nsifczvdlanmqhnxydfkwadqalnpd' WindowName: 'xvowezrgoshguxxqsphwent'
ClassName: 'akvxwcrjkopihqrfatjmqzfyjbvremkjhcn' WindowName: 'esgauscrpsgfjpocwobtobfmguycawnujdwhn'
ClassName: 'aelwerimjkpipxfzjgrqeeopvwvtgu' WindowName: 'edwbdnzzsagkpwinmficsqvuufkvmhf'
ClassName: 'yjezedprrhxnrxunjuobuzxhazm' WindowName: 'vgftmfguiwlimsmhmzwacuea'
ClassName: 'kkryzyqofpulxymqvtpukyeflvmicspfuyvst' WindowName: 'ljnnzjgysiwzddshomoijeqvbrb'
ClassName: 'dnhuimrcninatwzkocalkjwkizthzskth' WindowName: 'maqvthhpthzdnxsmhpisbsgn'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'xbskyqovmjaaxfxmaeooumoblfqrju' WindowName: 'gutdswwlczghcyqcmyoulx'
ClassName: 'uzplepmtunhtslinkzyclohkksczpjy' WindowName: 'lqhifvspjpjykpvmojlobjdxikfaxtjcoqk'
ClassName: 'irmxwngvqgajrlwsnogjf' WindowName: 'yucspuojsfwkvpvzgkuvplityc'
ClassName: 'jxipfzkijxohhfrlxyjfhp' WindowName: 'hsvvrysxloxpkmoebibgtbkgowctupahfywnqfj'
ClassName: 'auxiyuwbxadxskfniewmmzuuhk' WindowName: 'ysgiibphuesotdbnaycdwn'
ClassName: 'fiaiqyrdcwmpdfrxjbt' WindowName: 'zfpsspgyyiiehjflkh'
ClassName: 'rkruymresshdqtbmvbxy' WindowName: 'ssjbzvtdclqrdvufawghpvacpvgxavjeytsme'
ClassName: 'gjllmjlnzzzrqhjjfpaipthkb' WindowName: 'yjvxeowjwjobrjegnibtfeppejzlv'
ClassName: 'jnahoirsysodmgdoxyobgfdyfezxmckg' WindowName: 'tnwtzctebrftrsdysavowttnyscsuclfd'
ClassName: 'jzjxuftnrfgksjfbadzxueasdlzmz' WindowName: 'gxzumybwjaqjnxzbrvxtwuxbcpwnxbctiwziw'
ClassName: 'coismeqwtycvyordgmficwgjqyjrfjbjcvthcga' WindowName: 'ximyrxktwrpnfkub'
ClassName: 'sohqyzlfdceaqgvanxorxnzoxjiaiembcgoh' WindowName: 'acwmyajbxblsdykosadjqqdrpso'
ClassName: 'ingbymmvcfuuazkjhwocer' WindowName: 'yhlwctnzvlrnduv'
ClassName: 'qvqobqnyrkudeexzvxzmwcbe' WindowName: 'uusbjwykjafkufnafcajereavwvgwxuufxohza'
ClassName: 'dogsmwpdfwxlack' WindowName: 'sfjyyqtkqupvzzanwebwyrxeykmwxyahe'
ClassName: 'olwkhpqwrvtgrmkkui' WindowName: 'denhbiuaooqnjnulmmwtvwyhhfltbe'
ClassName: 'rhhomxuusrwlduqofcd' WindowName: 'isirgumvkzmbinetgqf'
ClassName: 'vluccomthzldtssf' WindowName: 'kcfncgoqpsefrpreivhevvxrzet'
ClassName: 'pysylesfjqniaclhdjbkepacndm' WindowName: 'kgcscagacdvejpwekbgrmcf'
ClassName: 'fzwhkpjtdewxuqkyivlsrixstmrvsrgrdgxhe' WindowName: 'bqogoiiuhuwcsrwubucnuwwdesaxn'
ClassName: 'samljccfxniexoiw' WindowName: 'eblonvzvofrujkrlcfy'
ClassName: 'hjhtoqssaqxytgjyoxdgiyedoat' WindowName: 'lfiuyctfhbptkquvyosslgjk'
ClassName: 'qdrzeevwgzluznywgbvgcjurlyjibfbiyhuxsyb' WindowName: 'bxvivkjnlegrcnnqjmnhmwednohf'
ClassName: 'ghohbzgnjyufvsbdmfklorqlru' WindowName: 'johipcimwqjzepbvpufmzlmvsb'
ClassName: 'pfapxbeulmifuop' WindowName: 'jetedhsqjdqhqhtvcgppcgefspbogoxihhj'
ClassName: 'ibkrjlptyhrczqllpddyri' WindowName: 'qznctxwwfhqcnwyzobdivyq'
ClassName: 'ugnroulolmjphvxrqcfxommaewqlx' WindowName: 'maqgpcruuhfcdamdtet'
ClassName: 'uzgxjvqtkoffssgetomscb' WindowName: 'wnmjoeioteiymtmgrqrc'
ClassName: 'wvacnjyrnhgvadteyjjykyp' WindowName: 'ekodmqpnnwqphyks'
ClassName: 'totqiebamzljxbjmzmasejfvr' WindowName: 'xsclsqjmpmtvfiywzhtwqkkxvdu'
ClassName: 'rlhyrggbkbphszsebytlssbhckhmltafie' WindowName: 'uzejyfnhvaidxducgekuuhmixjdmzpaadmmphc'
ClassName: 'tyjggaqcoisbquxwvdpkdy' WindowName: 'uipjfyneuiymzeangyg'
ClassName: 'vdnwwobrekzsumjbckrgureigeixgtu' WindowName: 'mvrmnzbgwpiyrovlufjblmye'
ClassName: 'wjowtufoqedrtgdzktchitaqzhpdaeah' WindowName: 'bzmwvoiycxhkaxaljnblmolltnlo'
ClassName: 'oyhvttyzwglgonpjvjtybvlngjesjqxvlf' WindowName: 'axkckxvskyvficqloglfgnxwdvxmbtciv'
ClassName: 'srtslbpgomjhyzmsfisqqtczzyiqvyexvsykkr' WindowName: 'iwdoskmdifzqhlxvbcrwczp'
ClassName: 'geyppwnbgsixouzfoonvu' WindowName: 'hrvugwqkflxhuwlyafxuiuj'
ClassName: 'wdxpaupckivbiizycrprrlfyukhzhxah' WindowName: 'xtbhhqggwjaartnakijyypplrdr'
ClassName: 'ormeyrxncutpyrphgfubxrcws' WindowName: 'hnuwxelaytzycovghfyhr'
ClassName: 'vuipmtarqjtkjkwtakullyfzngfcqyeptd' WindowName: 'mnoribxnbcwotdwawkmwufgjegwmbngzqf'
ClassName: 'bartgmhdzfupabekdpwyuomwdhuodinjtaep' WindowName: 'wrfqqcwfjkiynzcxyhdszlgqixrdxqtejksi'
ClassName: 'tmygnniqjadvpjrancil' WindowName: 'hurcngoyjhmcqzrxyrado'
ClassName: 'xsvsivclhvqwdvxedetcwkalbzyemhqylgx' WindowName: 'wztcoohjzghndsgyactfpsrcrcklbrxdlvzug'
ClassName: 'jmgkczzmschsehttjmxxqnajgihqqbgmnn' WindowName: 'wecmrwsvnnpjdwznnzeupkxqyityza'
ClassName: 'ohyjijwwrsqmwjiimgng' WindowName: 'kbycthwqnpzmpjmykkckjzbusclrlugoookvwh'
ClassName: 'gtexbbutttqbwxddrbcgoemjzcwyjge' WindowName: 'bfkpghbqjgirkhcgdbiypysmhtg'
ClassName: 'uvysohgmgpqszxqgxagsnozn' WindowName: 'qlbcrjwtffwkamvoggdvavqftocviusvnzixpho'
ClassName: 'djqgmmfbjyzfqldltnx' WindowName: 'celgpuudlrkmnqtdnlpntdbbeqhflruwptwm'