Trojan.StartPage.59387

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsp2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsp2.tmp\System.dll
%TEMP%\nsp2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsp2.tmp\System.dll
%TEMP%\nsp2.tmp\Math.dll
%TEMP%\nsp2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'hphnqgtdebpzvnystiiwwyivbnjikxbsljjjmur' WindowName: 'xkiqgrwdclfbtwvpgtzxmriiwuanqztecmo'
ClassName: 'vxsepldiyemwoapjjqarzw' WindowName: 'isuyagbwgyzspovoifyrqjmjmbngm'
ClassName: 'jdqqwtioyaqgdllyjceumydspwfu' WindowName: 'ffxdzwuviopbjsywhzreubwkigdlpjvobkxdz'
ClassName: 'swuzorlkhtlvtffb' WindowName: 'xqlummzozwkesohoj'
ClassName: 'ahecamqckdjlkhyydgdyd' WindowName: 'gmsbbyguirtzxzxydwjt'
ClassName: 'pqqqovjlxxiupbnpehelovrwveckwjtomduan' WindowName: 'prswpecotfigtzeutorlcor'
ClassName: 'igonzfztuqmukmli' WindowName: 'bxupngoflddemwijzsr'
ClassName: 'nympqwzctwgzjuaw' WindowName: 'wnabdlnsxbfqaociyxhumabivjkmtmysz'
ClassName: 'qfddxsvldlvrjnondekqita' WindowName: 'dghltqzopyiitnjtudhmisfiein'
ClassName: 'dxqldtjcrdkwwfdzgkftdcbfavs' WindowName: 'lonlrbmzennhhdszelpdsstqqztaprdxngqatrd'
ClassName: 'melbtpvhuzxzcidsyfcgcqmwc' WindowName: 'vapiilsnqtllrlr'
ClassName: 'kvadzgqwouxkqpxobyq' WindowName: 'ufmsrmqmwdbipzlleyqbtnexpenuxtfbmj'
ClassName: 'aytahxxxpkkhopnkmggztannowdrydoznow' WindowName: 'roplwxqnbhkgewmwmmvqiz'
ClassName: 'pshryfknvesctphetkjmxhbhskzvcxv' WindowName: 'unrniznzaapdspyhabudqt'
ClassName: 'ldwaikpltapiohkfilrlrjdbzejpqtv' WindowName: 'sdaistyrzhxttekytjumhhxnaapwnjkft'
ClassName: 'yfgojffptpazeuiasgiarhrhwmzdgotpzp' WindowName: 'noytiellfvsotkgkleqjzb'
ClassName: 'wnmcuvwfhpqvzatqmlhmr' WindowName: 'wkmteuhmtctswdraks'
ClassName: 'yytngaipeybgzph' WindowName: 'mrgvuqvbgfpvexvptftden'
ClassName: 'pnefgaptvkrhebnckjdtthtmxplbqigxmgph' WindowName: 'ughjqmrpjslgpipyfddwkrvyq'
ClassName: 'bvkxapehunlcxxvyaejdgwpwnwmhiqtibit' WindowName: 'rtqrnfesfncyitlxeiy'
ClassName: 'rrtwoilbbwmpgpwjvxotikgmwulglbj' WindowName: 'ilzaketlwkqiuwcmrkwgdpwzixgdovjlibkcnwa'
ClassName: 'rlzssqperclhvatebfmfm' WindowName: 'hwubbhcoajwcaohzofamoeunrri'
ClassName: 'fwisgkvgtxwlylsvurlmhrxrwnksmaflvexsz' WindowName: 'oinbmtceelgrghhffcugnot'
ClassName: 'aexxujnaizsxggnogrgie' WindowName: 'qcenlahbiftcgrmoyhsmlatdhenxl'
ClassName: 'oawobdwkubelppccgme' WindowName: 'tssjbullbruqwuwwuejqmklfnx'
ClassName: 'efpddrennhzhjehubpbjkctvrumxnvevanhvg' WindowName: 'yooszhrhfctyfwjchvephdssuzrrmgdy'
ClassName: 'utthljzelazleoqqsgeyd' WindowName: 'mrusmhukaolsqnkyibffseoz'
ClassName: 'yredodguzlmsjowv' WindowName: 'xwpvcakypofkplhmzetujztowhlw'
ClassName: 'xptgrfcxounoqhvaessswujuthibnoewxkojr' WindowName: 'bxevprxatqjwrkmvx'
ClassName: 'kdodaaptvyluzajxspuoakbklhnamafi' WindowName: 'ljkollwokzcaqjnujv'
ClassName: 'litarvvcaehraavdinuvatuwkztenlwfru' WindowName: 'taazturwfwoaluluvejlwhkdhhgttosgkqjzr'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'wtcnzbwttbsyzghqlnegymxbqoftqqjrm' WindowName: 'hmdvncvunbedaqjtukfklgxw'
ClassName: 'mnsamthkdudbwnkkglaaimsrhnythcfhnbn' WindowName: 'htybeqzvcbmkizatyjnapiudfazuuklkguisccu'
ClassName: 'sxocdyagkjsakgkxuqmxzati' WindowName: 'ltxtxegstmrqdfcv'
ClassName: 'xbyvnitmbomuzrlgdczcbzagjulp' WindowName: 'qvuqtwxnwgpgbikiqzpkcmzqdxqmf'
ClassName: 'tgxdiadukofpurm' WindowName: 'owzeleriawobujkgxtovefwjwjrrtwta'
ClassName: 'uvtjhojcfncamkgqncee' WindowName: 'mdegjzeewjtwsdfpogbk'
ClassName: 'fkxqipscmdinkffhwidmdykmtoijw' WindowName: 'rxbmyumqlylnejbtagouvdbynne'
ClassName: 'ziriinpzmdkeooxvjxytw' WindowName: 'qfveawwnqrpiysblntmihjatkbvxkxhszofsz'
ClassName: 'fdiytnaktgxtccekql' WindowName: 'wqgpiosaxtnsmprpgziokxigjfcbejbg'
ClassName: 'aeosgahybtikjxhpbjmzydbglhuwap' WindowName: 'iiukwptzphxumdzaf'
ClassName: 'csiojxdswfgdwqxovu' WindowName: 'sphyecvasvgufdspcjsfeyhc'
ClassName: 'tyobxkvuzfnylragcdpuvg' WindowName: 'nuozefxmvbekjtajfc'
ClassName: 'ukbohjbfukgpqajfa' WindowName: 'ztjqbtqbivqmsmrwrzljdrfgdy'
ClassName: 'kgcimjvzpekhypuxyx' WindowName: 'mponysgywkxaenfals'
ClassName: 'kkzrliowipnczofwblbcpxxcvkbimroi' WindowName: 'rtsvuaehsaznjolvhb'
ClassName: 'ixteeyaefvlmwzejzvvptiozkfly' WindowName: 'urvkpaboletxhpbwrsmojcrpnavjavv'
ClassName: 'lztzaxtgjhboboxyxi' WindowName: 'wsdluothbbicqjywokzbemidzfctgkd'
ClassName: 'puaziihyhiuykribzbsfrlctvqmqqyjilnnx' WindowName: 'folnzhcfedwvgpruksuwzwsexuyciqoslvtx'
ClassName: 'vclupstlxrtxkhfmkqnrplhvwccmuglxeibcvzd' WindowName: 'aljprqriegxwhoaadoabtgjrhudubng'
ClassName: 'bodwdutxsujozpxhrrnpwtfsc' WindowName: 'rjtnazlsoqhshtkg'
ClassName: 'sunnfaziuiceqsbbsxkriju' WindowName: 'kjpdqmvkoeluxrtsxdqwtjllvhluxpo'
ClassName: 'tzlhjofmpfyodihwipxkrtzi' WindowName: 'gdsjwbktqzcislerjqdysycrydhbbfd'
ClassName: 'kblzqyxszevxllipnxaxwat' WindowName: 'vlupuoxuvrzhrdnzc'
ClassName: 'xxidoflohbheappzagytkfkoncqhpfxaog' WindowName: 'bhqcfiwzfymtsdjlhxmexuyclwewqeobblsx'
ClassName: 'ornyakglxsdmdkyejjtzixood' WindowName: 'fcqjhlhegahlhzvitzptufnsezgwrcvox'
ClassName: 'mapankhmtrmqakerifurnowfgjuivjcqqymkc' WindowName: 'esohplbbnoqspsfisqy'
ClassName: 'uqjwvgavsgejfmjvqrfwej' WindowName: 'yxhhonyqrrdhjgdnxuawhdwh'
ClassName: 'ghndbceqeabstbbxpajcbewpntqnuifj' WindowName: 'fdvjnhstoxnnhqdxwhzscdwoltzagaydh'
ClassName: 'umyvqmkzidwgwztzovmoakifijxlwkp' WindowName: 'syhfmaqqiljcfssfpyxbwnkgbeylepdjzdt'
ClassName: 'bgeuryvscnwwczwnfnjkcgqpwphpqcm' WindowName: 'jfczndvhinskrcbwnausbubciaoigmgvtwero'
ClassName: 'bqufermprmsvdninv' WindowName: 'yfucyezubhljpibwrnercldzjvppruydau'