Trojan.StartPage.59186

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsp2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsp2.tmp\System.dll
%TEMP%\nsp2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsp2.tmp\System.dll
%TEMP%\nsp2.tmp\Math.dll
%TEMP%\nsp2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ctzewjevldbixilfftqkdwufaepfjoemltzenov' WindowName: 'cjkdtptrddwjbvcsidgbgpnownhc'
ClassName: 'ybbmjwqfhnwwvxqofqfpaydzipbrrjfoj' WindowName: 'ieqegtjouameyhihpclfyu'
ClassName: 'srdfnkjxixuoaxgkrqrqlygtnxdn' WindowName: 'wufoffqxfnzmpfswlmckqikyhlrtkuovqoy'
ClassName: 'zffgxzlblihbysdqoucyajpqnlapzwmml' WindowName: 'saijsxuweftcbxnfhzxurx'
ClassName: 'rclgidlrtfgrgpc' WindowName: 'biqdrvvhtfahtlcdqabpekfxtmulzpkvil'
ClassName: 'fiujisyftmomhwgiggbhhzqccceduhyquknr' WindowName: 'xkkuyowyckoxeqvxzdeqzufqvdqjandvymcf'
ClassName: 'zhwqitwewhputyhtvdbrnkogmitlnoyvym' WindowName: 'smtmovmkknfkwtxfluw'
ClassName: 'itgpfgwqszsgtklqltdvgqcatpcetc' WindowName: 'dqvqvxchscsyksaqjibooydwamlrtmwfomd'
ClassName: 'tuxpmdqaawnlivnmymit' WindowName: 'zqktrzpnegnuglbriorupb'
ClassName: 'qxajslwlddlykukncubrzpqg' WindowName: 'cjfgqgddjkfblrohreoadirxrmd'
ClassName: 'vfvddvvsczshfbzmxbqgubvqs' WindowName: 'zbtveorcsknpsevuihqkmxpkhilg'
ClassName: 'sgsyirykjlgjhchkfrlpftsyhekypccjwjflhc' WindowName: 'irrhzkceravwiiarbcjkb'
ClassName: 'jvnthjcqyibhwsbb' WindowName: 'kifxwisgvvjnfimapweg'
ClassName: 'wdloscxrfuyvbvfjwaxezrkkzcnrsfir' WindowName: 'lvodbbumctxoiirdvupzcamtdsuxlb'
ClassName: 'ricjjhqjewgvtrke' WindowName: 'iszjemlckdqejyvkygeivsx'
ClassName: 'hnwblhrbcqugjlw' WindowName: 'dkjteuvujyewlaxlzktaafmjpfusykeapj'
ClassName: 'nmuapjvqkbwxojedgzourzisdsspmbnkhtuybr' WindowName: 'uwuzybcnugqkwdnciklsejcbftudclucfbcpvql'
ClassName: 'qmbkpnuhumeyoivjdbln' WindowName: 'mniobfhhzupmzchcgrwkbqqizm'
ClassName: 'swjhzsukccdmccou' WindowName: 'wvziibubsanvzmzpbfm'
ClassName: 'gvbtilfndyzofwpzdpuehtzyjftvzrkoy' WindowName: 'txldlmmyewpbvucuioxzxjkkvd'
ClassName: 'jtyqlvovkygttivucpzarvardsfcvis' WindowName: 'gcgefbqxkgrfiszzgfxriyauxlvtwvaivacd'
ClassName: 'agrjxamuymkjlahiefhd' WindowName: 'caboifqqcmlpcvxhpmzosespabtzjifp'
ClassName: 'szyosnzhgaqucihabspskoesaiqzzqx' WindowName: 'stebrvktmfacplljtpaj'
ClassName: 'ufvvitprmzreypmvprfvrmj' WindowName: 'hfwkrvkrzpivwlxnpvyfpyemkhbgbd'
ClassName: 'afgjflngqfjhrgisexznlia' WindowName: 'wnjtorgsjvcmongyepadabaiyjuvse'
ClassName: 'mzhfsuwbbywkmwvzcyhkle' WindowName: 'nzanjyocnheslbzyhivnxnbidm'
ClassName: 'kgcdmtczdzvdswmzn' WindowName: 'ongrlteqciyefocrgyazlrdefb'
ClassName: 'wfdnqpvjdcvrilfxclbcmyzznnobyqzvjsq' WindowName: 'yikeyixmnputidekpxfsmtgkotjsvv'
ClassName: 'lhxycztftsuaqjktjhiaauvsajbixrmujwq' WindowName: 'kppswixcekmqbbhbeishmwzhkksezbkrb'
ClassName: 'gommeysizmmmllpkfydvwtxttiwxtqrhbxyik' WindowName: 'bptbrskpzkgxixuefbfzspb'
ClassName: 'qgbwlbazotijiwvjum' WindowName: 'lzlzpdhtwvigcwvwlfwtrxljnzespkksg'
ClassName: 'eaedpydtycfyctzmrryoenljieumewo' WindowName: 'oreeymhziuisdkwhpmrfyqxkljgpap'
ClassName: 'kpknthlojjpbfiapqwatzarotpirequgsdyxu' WindowName: 'xveefcxgmlttnhdkycnzphdxrqnsvey'
ClassName: 'uyqxibtmlednmzrjvnkcgbtjqnlhzbc' WindowName: 'dhhwfvevpmsjnaatgdbyzkfx'
ClassName: 'wcjrffwssxddhvrwbcpbgbrh' WindowName: 'xyfedbkrwwnttckturovsparazyepiyxfymi'
ClassName: 'vyvvjazcimlyuoa' WindowName: 'idjraqjiethzybozu'
ClassName: 'yrgpgzmdryjpxylrmcdpuepjcshfq' WindowName: 'qxwzhtdhgshfywobttdbqcmjecgoten'
ClassName: 'qlxaenjdfywzvkumzzzfpitltfjyaikwteemyb' WindowName: 'jcsxydcxwfesvbbxshsxknqtsrw'
ClassName: 'kdvjtriwdidbvilgqmjefvgqglqhy' WindowName: 'htzhzeepfkjigaavkaqxersxworzso'
ClassName: 'hpyggzbrsbvldrvcklnpmmwpjysaigxi' WindowName: 'poqphrujfntyjkdksapnyqlxvjtvoetivkhws'
ClassName: 'pddkmsahvpketchyibvntdvewhuopukuoqvtor' WindowName: 'vdwlpqqwvjaavxmxotalimmpkl'
ClassName: 'hjmgedjclwyfngwdcmpzmpxioelwnzr' WindowName: 'kcuzttnlrwebqdyhjqwmwfh'
ClassName: 'vkvjdfredkgfmegtnyrgyuoq' WindowName: 'kphcsaxszmtygcgcd'
ClassName: 'ysjdiybiofpylgmyazjdhahci' WindowName: 'rhfacoderxkjgbciygdwglotfkdhpxjbg'
ClassName: 'olaynjmvbfjgkex' WindowName: 'aoggofljyatqzjalgbnadgqzexieyrihrkgd'
ClassName: 'epkbufimtfwnmlyxsw' WindowName: 'taqozktolopwzjempihihrkgahcsuyouhrko'
ClassName: 'izutrqnwppdicfssqjhmwulk' WindowName: 'usnzerwdqbdvvnshcoycviea'
ClassName: 'xozwethshiimedpzu' WindowName: 'piduescbtggdphuhmotvma'
ClassName: 'xlcuqiwicsjlwvdyoil' WindowName: 'gunzkmwkxlnwzlac'
ClassName: 'xecslyfaiztzadminjoygnlmfaxaeqtzjt' WindowName: 'wlltfljkjncaukcbjxzczptk'
ClassName: 'kdxbaisslmpyzjsdesddhcbsiylzsfnye' WindowName: 'bvjlvkwsovalkiunmhfxzkfmqclvlw'
ClassName: 'nibmomddhtzcmcikbhkrxbsuftsul' WindowName: 'trpjxktqjmdxqptzyjqadgstvcesgqq'
ClassName: 'xvdepsurvnpfsrzbtlgurpdjr' WindowName: 'fhppxixdmqxacabxsuxpuwebxvoag'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'rnfpoknyvqxnxlwjeplmuanncguwul' WindowName: 'elebiwlpyiyrdtqcu'
ClassName: 'lunazfhvbyldbbvjrndrrphiajbr' WindowName: 'zffwkcgieiawkoxblbxrwhuuxtxysupete'
ClassName: 'nwxzvhulsemnozyikfogqbivrwlzd' WindowName: 'bejwzcqvdjwwntazcbyqzhcrpmuyevfjdzz'
ClassName: 'kztnyetkvnwnsruxiepolvdroggsrlzuhepkydi' WindowName: 'ceagaeovwlzemlo'
ClassName: 'jjcbrthtogutylkawd' WindowName: 'raudcbjgkigusenzslfusyjymlfw'
ClassName: 'yrubebqgbkuofxkyeob' WindowName: 'gpftibmrxzjigwinsqmivmjghmrpkz'
ClassName: 'vejpfyqbjlccuxycvqeaht' WindowName: 'axwzawadedovwtlsqsgpzzrthyjgnsadyyz'
ClassName: 'zkzmscajlapjrhwvzjcqygoddqihujbdfqiolr' WindowName: 'fqudigzlfnwfmxakpcpouymtylyfxy'
ClassName: 'glgpxzqinarrwuqqdlazeoyiewo' WindowName: 'zbnxgaggwlkioqg'