Trojan.StartPage.59407

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsj2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll
%TEMP%\nsj2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'mdhsyibffetlfldxgwvcowwim' WindowName: 'dmmqcukjinrozzwdwffuajwuw'
ClassName: 'rilhxmmiqwmdqczttcira' WindowName: 'qlndbwrvinommmabeqxy'
ClassName: 'tfxxucrjwuwxngxvepvwgr' WindowName: 'bfmkapyynpiagyfwevsegnolll'
ClassName: 'ermmzhsohruwdevmhstnsjkvvubbr' WindowName: 'dyacluedaktfreiedxrjfpzccj'
ClassName: 'jzbrkenlsjbywamv' WindowName: 'oggejenmfojzbvrvqifnbhybzoodtsgfyakptv'
ClassName: 'ekdockywigodgvaekppxkkmgthez' WindowName: 'fbhkmgrcgrwuholnvp'
ClassName: 'klmlrxcgpdgnwsxjid' WindowName: 'hegwoehcybhzzcqqsixdtahdjpetz'
ClassName: 'mvwvmmizdomzivankov' WindowName: 'fpqxghnmeewxxgnfzrpztpcv'
ClassName: 'zbtybsprzmwxaixpfgnkmjecrhqaydwrcdq' WindowName: 'hchpizhnjaecwljyvbhkgpvumzqxztlqmmwir'
ClassName: 'azpngkeufwbmttqzttoqqytduoixszyyyp' WindowName: 'gszzadzsmnsvttwfcaflsnrzqmxukzaldjysffk'
ClassName: 'nrfrsncewdoqdnhpbnkui' WindowName: 'bwzeuycnpffibitxy'
ClassName: 'urkhtbvblydqisaedvwmeprjgvjwyre' WindowName: 'riyvheldhybllnwpmh'
ClassName: 'vcxypjwktkeiqivd' WindowName: 'dacaaatoiiqjrafii'
ClassName: 'iuezsdicidcfsubddeiqiashzr' WindowName: 'hbhgbhhduyqgqvuxdclkthv'
ClassName: 'eszlglvjsrrwlpipoifjqywvcysekjslqsndlvm' WindowName: 'sfgxqfptjmhdxqd'
ClassName: 'jjdrcpfrtlhykzbauvzfmkbofywfewieynaskxf' WindowName: 'couaysczhnugtimuchiadrvkzsztbazzqq'
ClassName: 'rquijvgkpftpuqsysczjdqrkkmobn' WindowName: 'mbbqsnpkxmlkblrdhnqgposqblatuccmlc'
ClassName: 'tgflaywpeoepessnlmafbdwlwzhj' WindowName: 'qxvenvjcsgafhjkwnynyrjh'
ClassName: 'nynwxqieaugvxiqlbaobhssmhbluwbsrmpxdrsx' WindowName: 'rywchlfrmmemvqsinnvla'
ClassName: 'wlwrmbwzbeqkoszdsjkdnfenudwf' WindowName: 'yosvtjagbfafbtptihgt'
ClassName: 'jyqubhkmgtfmzizdepvatorytmwxy' WindowName: 'oclucomgpefmmcvprc'
ClassName: 'ycrrevquppbxqlnibkdhfeopcucvsjfoohvrma' WindowName: 'ktmdsqwneisyqbz'
ClassName: 'joqgaxtympvoouehdbisby' WindowName: 'utudgreroktakvfonxewbefeglnau'
ClassName: 'rpslulhmzetxjomuoakmdogmawoakc' WindowName: 'ehqmfyqvhvsrboxpludxst'
ClassName: 'tbzmxbywvesqtmbukhpdctbry' WindowName: 'fcnastrsfpoqdykkyrrrcqsgweomp'
ClassName: 'mgsctdvdfrfdhagypszstoay' WindowName: 'xfvqqyariigqwnwrzugpngdwthygczcgdpnr'
ClassName: 'smilahtzkvqbcoodsxzyg' WindowName: 'dtkixpktkkxttgzomlicasjpkyfproqyx'
ClassName: 'bivyiaifjqpbciih' WindowName: 'dbvagadrsnutgeotmoriyfngezqkwe'
ClassName: 'raemazwgdtuzacqpsiwisenfowkxuxcakzw' WindowName: 'hfzlfqxhzvigbnyovdcvblbgkqucjqp'
ClassName: 'mjgtbyvyvwikjnidaxcvjqeqrfutsjkhouhnxz' WindowName: 'qxusiguewpvrbwfchnl'
ClassName: 'czjjeccrvmgxjsusuibxbakvrtixsyjcjl' WindowName: 'chvqamytaeagikqmzceviecsxnysaid'
ClassName: 'jujdyznacczcbeqstcgmvwdwgkvtustbjzmh' WindowName: 'lpxaakeokwjxbaocwmyvr'
ClassName: 'tvqfctettsrirccbahlxojdokpkprjxnxbiy' WindowName: 'yaxdcoprjsmbepmufaoryhxol'
ClassName: 'uhgcbjnpoejjkjwkhoaljebnussvkeqlbjde' WindowName: 'erxeocdgkvsbhvqovqcetid'
ClassName: 'bcizudjrsidezzeuqcnqoygk' WindowName: 'hvdssirmlehfhlfqnrgilo'
ClassName: 'qribjguwupyvcjxmwye' WindowName: 'ovcfupgjymkvxvt'
ClassName: 'euwclvhrjmzdqrgiwlzqyognkb' WindowName: 'dtkirnfhoezticvjdneysaw'
ClassName: 'xqmksobosavbpevuue' WindowName: 'ysmuhqekqybctqymhizwyvqy'
ClassName: 'yktaovctjqyxmljobulywbeugqykneszgfnchel' WindowName: 'nxzwpzyydomnveodrqn'
ClassName: 'tciyrsadmopxfvqphaqnnypeaedvsy' WindowName: 'iomkraforsaexzcwxilguakwerechfzqzkkzno'
ClassName: 'cgoqlwngieodgchdejsflwhzomgofu' WindowName: 'hbivvchciqawaievuodsogrlm'
ClassName: 'grdhetuweawvrheseuaa' WindowName: 'gpmgwbxbwmnnghqxabzylmwhigr'
ClassName: 'tyemlratyzoonujualkjr' WindowName: 'aqmttfqkfqujzjslssxzeslrwknlpqaqin'
ClassName: 'xtgzjioweoijojtnjdhkohpnkk' WindowName: 'editltcjpkqnqhz'
ClassName: 'dkcjewjruuhuhjwkulffexrjqyhrqhnpk' WindowName: 'ndfmujqclxaisdwzqwlu'
ClassName: 'bfucvyqvfpymmmykfcwfasabufnstxgxggopwf' WindowName: 'nyxvqibqgyweuezuqwwemq'
ClassName: 'qkjxqujtmeydqfuzuuahofd' WindowName: 'oeyztwobzsfpjvduzzzxlbt'
ClassName: 'dorhcqvwvrospjvnmazdnsegpaqoedgqguc' WindowName: 'ukworkfnudgzvvcfvlbygrspijjvpqwehdvbtby'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'cuzyiitmlneaabfckxbtpaqxuehjcy' WindowName: 'xrhoeubkehretifvglktdlkwnrlytklzhskeb'
ClassName: 'epafpjsriyvehxgqebuvtxpdhwe' WindowName: 'ronwqiuqhkohpbcu'
ClassName: 'bszqgyyanopvcaiklkx' WindowName: 'xtlalhsxarcknvfuvrrjnbsmoujcwfp'
ClassName: 'gbbmopwtmcppenkzppczllwrjjwevfdvarj' WindowName: 'oiplcummvelztatswuifybpxnsag'
ClassName: 'lsoakrlwadknwryxmtl' WindowName: 'vikarokfjyiyngct'
ClassName: 'iuxsdbfqzzfdxuhpbdxzhurqwytyzsnsxyrbnbw' WindowName: 'wknhalwvkmfbcilfvdayelmbnhhjapbdzem'
ClassName: 'tylfziolkckdwlws' WindowName: 'yewneauwxxiicnirwakc'