Trojan.StartPage.59415

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsw2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll
%TEMP%\nsw2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'abghlczlfqvrclandtvsxkoewxxxz' WindowName: 'jwmjepjkhphguywfzxxd'
ClassName: 'uvzkvilosozydgctpwnlhslawesunmqahqftf' WindowName: 'kiqxmxorsxseuljmnoplqoyjpgnccbxfhbfwc'
ClassName: 'fypebtpakaryxlkfcgciiehggavwkxbuzuzm' WindowName: 'cgoqzuzayuoqwydzlzxtzryylynanglem'
ClassName: 'jjixveeocqcjgkdowkhipdkjsjwyjckkenza' WindowName: 'kvdwnzwfuodmayulyylponcutuupuypytd'
ClassName: 'jtsbeswwncawxrfbvpqgnckdheczekucv' WindowName: 'tstxbxbfqicerwecczwtvxjngrhtjwjxfgolju'
ClassName: 'avdgcjuyxszrmyvje' WindowName: 'rogbtghljfqvhceg'
ClassName: 'gbpasgenbemmdxj' WindowName: 'hjwdueeasewvojnoxcsjshofaffcjmzwerrusah'
ClassName: 'ihdqsazzjzbnrxrmiephlr' WindowName: 'yvmybpjhdqcukkyljqekwhxguiqfmwivb'
ClassName: 'oadzdakruzvkpmlrtgxct' WindowName: 'ucimgzvyhgimsutkiliq'
ClassName: 'bcxzabjncfrcbwz' WindowName: 'ywabwqdkwzkxwmqgtljgzppxxlhyrofqbckxtw'
ClassName: 'nhkbdzejmfoecukglhmbvojlgigzgfzlee' WindowName: 'rbxhzgkhcepfhheqrvokrrqhif'
ClassName: 'vblsoswkiloolitfmniibhz' WindowName: 'mdwlysenbkwjkhmzbvicszhtcqg'
ClassName: 'unuuyhrzceeyphqhmgooqvtktu' WindowName: 'whfxlnjoqbabbwmncaevwjdyjnurk'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'fcfowcbibqivwei' WindowName: 'etmckmqhbuhrkmxcbforjxxg'
ClassName: 'tuhcmulvdktuobkl' WindowName: 'mlvsjelqqneywkhvkjkkylqheepnyzta'
ClassName: 'posxujwonslsatrkuccwl' WindowName: 'jfsdvyfbztpyzugfkyncznuhpaqcythotvd'
ClassName: 'hbpavbmetmqmxjejsrhdzskojbjdfkzs' WindowName: 'pfzimtnnzatzepumdfrrfelg'
ClassName: 'yqducaypwbobzclvqayqyvnietv' WindowName: 'ulvcavcvzrehamukzexiwbbfcdsluveoaknrg'
ClassName: 'ekarwqwjaklpvcjagwbdcjwc' WindowName: 'ecdzfnfcvzpsqhrpvjxxhs'
ClassName: 'mbncabnhtzdzxpieualmhjfwkqtaba' WindowName: 'nqhlhixapyrlhikbl'
ClassName: 'eyneoezicmmlinucvor' WindowName: 'esppumxlscqvlwlgbdvuaa'
ClassName: 'oxuckadtovbewvev' WindowName: 'vpjbuhrvrfucgslyqdvkdifs'
ClassName: 'whoysyjbfpnzavvopbsoxxkh' WindowName: 'kmhbkocbtkkxducpyyy'
ClassName: 'bihumvhmlauineloyztdouwqwvggpmr' WindowName: 'ftluntklbrppitjifvklluqnpiz'
ClassName: 'mrzptnirwuephifjmapnrxlwowmowp' WindowName: 'jrbkllzxrfbejzoikpvgnjrigvauwk'
ClassName: 'hdrnsvsdxmjeddpyrnrirorwxm' WindowName: 'dvqjogjwankgnfjelgirekrzbs'
ClassName: 'icggparzkjzccurfnftjcrwrooliwcvw' WindowName: 'ivywhhhkegnqmmwilnagplypxgowmkx'
ClassName: 'csqzvjsvpcgdnlyfqka' WindowName: 'puvytbdqmwwatnuuipitcvcpzujbm'
ClassName: 'noamieoxyloabrlqjmw' WindowName: 'ottycxessaklsvviazpukysuv'
ClassName: 'eoregnyilmzytntmfwttursibitri' WindowName: 'xugnxuhuwtqyvjlmrdhlucqbieiizfdid'
ClassName: 'eqxjizveaaylbjiaijtkpvxjbwsfnbqggo' WindowName: 'zgqrvfsoiphikjvdksomxslwvyw'
ClassName: 'rripodauarjpkqaecqhocytpcbeczhebmlcyle' WindowName: 'crdhizmpgsbfcvlhcmrbircpydbsjqgvb'
ClassName: 'pmrvpleehdyzramjhafwtrkdpdffrkph' WindowName: 'dzdbsoeiqbbizvfpymvuptdcekzauuwqge'
ClassName: 'rozchssrtmxruvousvhlo' WindowName: 'efuwnefohtmfcisghpakmpqrmfjsmot'
ClassName: 'zcyvnpomktzecrdzfbwttnkatakebfohrvyqx' WindowName: 'imhnunmyyvrebkyjgpsuszhynnbmfgu'
ClassName: 'vnnjafngohdggnofkssn' WindowName: 'ubmuqrqbtmibpbndncf'
ClassName: 'wqntursqsonohwilfvjmttvioceffmnhqrqwrzs' WindowName: 'xkzpygwbvhmrrnzvmmuddvpui'
ClassName: 'qmbiplfsnqxqrwyfq' WindowName: 'kwxfqvpbuxijklinrjdq'
ClassName: 'lacovfbnjskdywufogkbcedvuwys' WindowName: 'gaxhqkvxpnrjxuawbxiwaksqirvxjaeg'
ClassName: 'ygadqsuepfydtndwbj' WindowName: 'ghxlzzawsipldrpwfilpyuje'
ClassName: 'oodvkrprfnikpdeiszbnjbkzxfyg' WindowName: 'vrzxrcrwxwskcpwuoiwnadoiduxaadzyeafq'
ClassName: 'jazthberqqfbfgnlgirpky' WindowName: 'xqnndptgsxyelpeqbihtsuwxlw'
ClassName: 'cmamzmitngbncomud' WindowName: 'omujyoklhbjwzenrs'
ClassName: 'cdguryxjwjhqxbvisk' WindowName: 'iapykakufpvhrwspeuqd'
ClassName: 'tciauenythzqbxm' WindowName: 'bqoyxtgdzdgzlcdxekcfddbwlweozb'
ClassName: 'zjhorgmtfoxqmeoalhnsfhxdhu' WindowName: 'zpyfqgzbxqiipfrzdqgjkpzyrm'
ClassName: 'jigqhaligtfusjtdyhutpcojnfbxjcqggn' WindowName: 'fvwgmlbiutdbrvcdlathhk'
ClassName: 'fhmgtqxxwpvioaxkpwzgjyvloniuogabissl' WindowName: 'vbckglkvoiyvsuue'
ClassName: 'zylgpycdhavwweltvajchywwevhmgrspqblk' WindowName: 'mtdrngstdjspsaonrngnpfqhbmecbokeoql'
ClassName: 'inybcfgjijixgvfzpywknjstfcdrcnemw' WindowName: 'pjgskpvjnthllmgmfulrfuq'
ClassName: 'mptzjjrhqwwdfkrrbcaiyqswsizw' WindowName: 'evtomgwnnbhxnpsemcqikqdpvxqfihwlpsulrx'
ClassName: 'evupirakhmmlmeisrjppheiepekmexyfun' WindowName: 'rlhrgozdturgmzvpnlrxkzmxpujknlwxgsqjhro'
ClassName: 'htyukjnxqexuxobbymkauhottsuabvcfhmv' WindowName: 'cjzbdninhfpgetxslubohhzsn'
ClassName: 'wyjxhsbmoacuegchzyjpac' WindowName: 'bnezfoveqfronzaobhhkdfippnd'
ClassName: 'exdujliaokoplgggku' WindowName: 'rpdowfpspyvvenzzzmzutd'
ClassName: 'dqsuhlknwmejlllgocdwdhomlwd' WindowName: 'uligavuztnqstyxrjabfx'
ClassName: 'dvfpjpkjktajvtopenwwawwjohu' WindowName: 'unfpkmzvixwlvtn'
ClassName: 'wkeivtufjlufgcgfviubcgvowzqtwgjix' WindowName: 'mrxpnczojecfmcezsygrolamioni'