Trojan.StartPage.59318

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsy2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsy2.tmp\System.dll
%TEMP%\nsy2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsy2.tmp\System.dll
%TEMP%\nsy2.tmp\Math.dll
%TEMP%\nsy2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'cmbzgytoosulziurtkvkfwoudmbsrrxgbsjns' WindowName: 'hpodsrusewwgkwfzwol'
ClassName: 'ldqxpcisabizjijfls' WindowName: 'qnpdivmwyerrdavqiaxzgcfqtunolclah'
ClassName: 'qozusfgvmvpgwjxvljoffygeigb' WindowName: 'fovbewugxbmttnt'
ClassName: 'kfnjuznfeiawwphxqmzspzwwhr' WindowName: 'yetrohtyzrchmcdxqj'
ClassName: 'jkncngpmugfmlcwla' WindowName: 'fffzmcupkokjvhljm'
ClassName: 'fihpitdwlzoqunhmttoiqtlnxec' WindowName: 'bdtpwulkkzzpfglaky'
ClassName: 'qapivxpzdstkadyyvzxvfo' WindowName: 'lgudsbfjqglfqpstrqfltlthods'
ClassName: 'wwlcxduisxgeaevswj' WindowName: 'axqqebisoxbzaarthybztign'
ClassName: 'asfmuxqxvqskilpkmkthbesjn' WindowName: 'nrwkoxeilwvohdejjgpkycyeqojmfnedaeuj'
ClassName: 'fjacfjpshggudnaekqgepvcdqdjlbkerbe' WindowName: 'iyyocxcbhpjycaf'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'dmrqgalcjeryenvisjhvgzadrskzmmlkzee' WindowName: 'jhnsoxnziligtvxrjysbfawisbcmlec'
ClassName: 'ibxfspncjpbuzbowiofsgcqmsrplbp' WindowName: 'auuhabieatbdldcourosko'
ClassName: 'fnvyvriolrjmsxiqqqgqvzptcdqtmbqim' WindowName: 'lqyhsrfgnmppoqkopznurezgfogi'
ClassName: 'rgruakluefzzpzn' WindowName: 'efazdpwwlrmahbjnarzejgqxfqqlvtss'
ClassName: 'hrhqbcjpstrnqgjjjryxob' WindowName: 'jlhtvxlrzrvodyvvzsmknuqyiszrayfjnztglv'
ClassName: 'qptziwdsnvyhoxbxyrfuglsofu' WindowName: 'mlkrvkekfeqgljcpaqfmtfluytdguzvejao'
ClassName: 'zzksyvzaxebyokecbyv' WindowName: 'lsigfkcssofgsihak'
ClassName: 'cgxdjobztvttgduzxgu' WindowName: 'thbahvogzfjpcatdsy'
ClassName: 'alrjsmmiulmcidxdyqmxlru' WindowName: 'wfcwjjrbibbyskcuqcidqmchikzeaiqznaefwyc'
ClassName: 'nayftqlozqvibmfvfuvhpikewrpjyhhfapvxel' WindowName: 'suphpgetuklxags'
ClassName: 'jgtqncokzceufesxrjseywphajj' WindowName: 'vglvrhvtazmkqvukqhgrbhofphjjwnqrlv'
ClassName: 'geoarldpgxkfgvybxrhfcjillxcnvjat' WindowName: 'rirmnjctdhopjxinoqiukwk'
ClassName: 'mlrnsmdadiwhdymnxndabmrkpagytkemnbyyfv' WindowName: 'gpzztuxfamjbmaektjclezwwdkkokpka'
ClassName: 'scwlztcomlaawzwyzuxvuiekcns' WindowName: 'fwkmgqnivhfgklgrrwwbm'
ClassName: 'ihjkalgkyecozpcuqv' WindowName: 'uvjbckawaberlxvhoflmcorlvycs'
ClassName: 'bwrlocxjbdxerqigkpspmwowf' WindowName: 'ucyeubjabvefshrwjaczpenxtqrivrdjikqsa'
ClassName: 'iihpnalqewayiubxos' WindowName: 'dbuhyrxwkzchncebthcj'
ClassName: 'utzgnyagtggxoyqwsdfjameeufkstyv' WindowName: 'yfrdwngpfvynorlljcdttw'
ClassName: 'zqrmnfdaqrofxxxyklhl' WindowName: 'pukdetbzxltpvnth'
ClassName: 'rxbkiutbzpauqzvzapcntn' WindowName: 'qphcmupmumeagmdsdyqw'
ClassName: 'xohtofxsslvmpdqizhzxqune' WindowName: 'oqnfimdupxcwddphrsspfpvw'
ClassName: 'juljtajmcbyddkdxxzorxyuerdmqgvutryrnvn' WindowName: 'gbtmmirygxszbaxydkgdf'
ClassName: 'wyspigbrwhcvqtueialhykjbbdhbobu' WindowName: 'qhzwouwlrypgwlqbshajwq'
ClassName: 'jhesmijeqixcbcwkfeju' WindowName: 'jmtrribwtmbusmkzi'
ClassName: 'nanveclyjddjbmcxmvfsg' WindowName: 'ytkqffuoxekdcwfryz'
ClassName: 'fifpbowuzvnlxumvjxwfbzmucctxdrreih' WindowName: 'uuxnqogdseaqblriafuutyimrkxlxbwv'
ClassName: 'ysvolqkswcmcldzgsvwqaqdelsuacbbfqwvzpq' WindowName: 'iqjsnaoknxlclelrjwmooobowbkxgrzxajpad'
ClassName: 'burcavrutvnzpbbytiaandpgovpxrpdw' WindowName: 'tcmygnxxihdcemf'
ClassName: 'qfbfrvrqvnglmne' WindowName: 'tddbgtmvvpziaunhsiqumqeog'
ClassName: 'aycyapyipohnlqreklqhndyf' WindowName: 'sajuaogtvbxbutqlmtg'
ClassName: 'wgddcjrbbvugikpjypopcn' WindowName: 'wxfikondvwbyoedonknv'
ClassName: 'cczapqdzvcixrcnlvuiwbna' WindowName: 'zzenzgzxoxayhhqwffzqjqenrsttk'
ClassName: 'hnipojtkddpshqg' WindowName: 'onxvxtjkvivkmdmaasfywltruawoydxih'
ClassName: 'dewijnntxwqohjgwqlojofxbjnc' WindowName: 'kbdcpokvxyvedqidmifyflxygturyoz'
ClassName: 'xtxsfytjtfnmzdcrzmcrqgbokvpegqceuj' WindowName: 'bvpevvwqbihodcp'
ClassName: 'lpjlcclzgsofumw' WindowName: 'idbctmumlebryoexxzyihmiamj'
ClassName: 'pmoigriosyehpkvgqwkushjjxzokmyghubehbql' WindowName: 'kenqeftduzwfygcwebarnmsgalajvumensp'
ClassName: 'ojpotiwwuszduovidlqrcfxiu' WindowName: 'wdwojkkzsexrjjjbzxnylvlxrtkkxau'
ClassName: 'apytfopzwzwkmspytlzxxnyxqtsdsqrd' WindowName: 'hqtlznfjtgaoctjgjusdyxquhsxzsgss'
ClassName: 'ibhebefepphhhojps' WindowName: 'zfzjaapiaxswlcwpagaaxicwjwdeuulruvpwp'
ClassName: 'ybmcgyldclfljlyt' WindowName: 'lgkqxooltdjvlpgrnfvtlaefmnnjzddsuostce'
ClassName: 'cltmyvkhwzbcwxolgg' WindowName: 'salmvlrobkufkthoyfgprxgz'
ClassName: 'coajhdafwynedfq' WindowName: 'gptyeyutzaexyhjwpgfuunabjdwhu'
ClassName: 'iaafscplkmdzualpubdvjoxbxsxpmp' WindowName: 'hdmsqitgmvhrlulqdoycjgot'
ClassName: 'lwuszkhqlzwjufzwxqopjbrwulsmiynpiryyzlv' WindowName: 'fkhsndwjmbmotuhywatpcfxiuwkolzfi'
ClassName: 'vwpmrqeaxytdogndtswnkjcr' WindowName: 'yhbymvdcvxmovvmqudbuhivasqgrdlzieis'
ClassName: 'ljlbxdsyxspgjcru' WindowName: 'exfbusvhypmcpharr'
ClassName: 'ruhmcvrkapsapdrpdrrgadjxagxo' WindowName: 'jnbmdpmnoildrtynfo'
ClassName: 'tknpvtybbhiwrfxbmnezotprcrml' WindowName: 'zgcrdbvtdmvntkhwkkyve'