Trojan.StartPage.59506

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsa2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll
%TEMP%\nsa2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'amftmqqbxnrcnszbwlrraalluriynosdqwmix' WindowName: 'tmrqxqjlhlijaxyuavxyuxuh'
ClassName: 'hvybsflfystqlzqzxyvzmgooxfqs' WindowName: 'hqehlauudueixpoqfvcjnrryapufozwjjjj'
ClassName: 'fmvqvovjkrwjivrabajkk' WindowName: 'hryhkgbmhpcsvth'
ClassName: 'rcvwhmfabwoqsuzmvcxrxgzjizma' WindowName: 'ytmqebclvfftbqnzkwuyqlozmxokhnpjzdql'
ClassName: 'bkbunrabglfzbpuunnpgnwzuicpllie' WindowName: 'xyghbrydxyfjqeduzcpoluskiirdjctksthkvhy'
ClassName: 'skfsyzouvjzijpdeefdjpzlckwxomzyfoot' WindowName: 'bpnxfgqbnscltrorgrwnmowcpqyjzftlhvpuo'
ClassName: 'cecmoighprmthqbnggghu' WindowName: 'nddttswqfucgfyyigssxdow'
ClassName: 'evmerhnfnzamzpsghprntsbjkqjrxbkrugroz' WindowName: 'sciyjeefehkyrugbs'
ClassName: 'ydsfjugcrlgombp' WindowName: 'zmhitxqamkfmdnwjytojmzlg'
ClassName: 'zfmgfuiexwvopugs' WindowName: 'felbvkzwwcykqjdhnxvcgelcztx'
ClassName: 'ixxgiygzssjjtxrgkazsq' WindowName: 'ovgxloqjebsxakiegjotsrjlvmhxpwxgraon'
ClassName: 'rzfwfhhmhlgjitjosiz' WindowName: 'szjdngilkbotqgatfmeyqqlbvgezxgklff'
ClassName: 'fejeuyggiqbyawxauepstxutigcygc' WindowName: 'yodntzubbdcmxsrq'
ClassName: 'eefgwwyfszmhzooebbwrt' WindowName: 'nnbepxcpteiexdjjoygaqdpcqkcsp'
ClassName: 'jfxeqyznizchtoe' WindowName: 'zdgxdpalhctzozplqyguih'
ClassName: 'loegbinzvttmqgrsymwl' WindowName: 'mrkwdbrivadbssurgylxzgvxxibosjkov'
ClassName: 'siwvxzolsycueqmbhue' WindowName: 'agjbhdsxcubdwtldkldolnrpmctljyzvnthspx'
ClassName: 'jdpfrtfukasalvejc' WindowName: 'aaqowhopnbkoekkfilzyyitnmtfxomh'
ClassName: 'csomkwnxqgqmwgr' WindowName: 'eeupcflfgrjarohhxmvfcurwfiihvtdn'
ClassName: 'pklfyehongprhktwomsjtzigpdvmvtwy' WindowName: 'gsoetmwuaeogtmzijiswkeitepmpaslaz'
ClassName: 'hpifyqoqludmalbprpvncnvm' WindowName: 'ddzsmmcbeeejpsy'
ClassName: 'fqyqgkojoivrekwfvrfwywxjfnrdqejw' WindowName: 'ouxxcspirsgbluayujlt'
ClassName: 'rstkgtobhhdhblm' WindowName: 'uracjwwwxdohthfowlgjzs'
ClassName: 'nuglfytmkompxukjicarm' WindowName: 'xymqybomlplrkopuvzz'
ClassName: 'lqxhamsarlfnwohllwcmelckdczhhjmg' WindowName: 'qhpcqkiimhzrmapwxjfsmalqzbbivyz'
ClassName: 'lpvyvkcpezonndozrdmbc' WindowName: 'brjbtlqmejkhmpdrviscvgqqpkwjr'
ClassName: 'cryyfehgnuoyjwrolcahwze' WindowName: 'vjrdcqlmiyqzxovjxkosjzfsxliydsrb'
ClassName: 'lhyfqhsguvannqcfnmololivflb' WindowName: 'iyyhphyzwwfqigbjawgh'
ClassName: 'txxqyrtdjjoljldhqzwiqfmtaufhxcyt' WindowName: 'qzddzjhvrgbvzdwe'
ClassName: 'tjlpjybxahlkyevrqtjzscovnprmxhvzpk' WindowName: 'qfcwhavtgfjilozhoscupi'
ClassName: 'mwyrmgwyhjandumyeoadbmksqjzekppbuqrkuid' WindowName: 'qqgwquxaquhpjhxuazoistyis'
ClassName: 'paabanzzkencluyiiwwdrrnddjdlrtaujxhtwde' WindowName: 'xdmdckilasvtarubqvkwuzqfwzqxdam'
ClassName: 'nfyjevodiyhkujjjnismlgal' WindowName: 'xexmogmjctgrfmajbnqlxuhtwzzo'
ClassName: 'wmbdoldswhwlwdwcxtdjvapjbq' WindowName: 'nqmmyfvyutmtkwwmbydas'
ClassName: 'vbdlzqxuduyjalwnlmfphbvkjlgcqhtdlfipdh' WindowName: 'ggwvlfcqmrdksqnbpjhlyugymbcglncouxfry'
ClassName: 'bdaaqeyvflulekvmkv' WindowName: 'nrlmvfgpkrfotydm'
ClassName: 'ntgclmljlsidydxnxhvwlfzukzuvwon' WindowName: 'jzbtrtecqgqbpbtj'
ClassName: 'kipbpltfersrbbrrkbfeialrcmufjubpobf' WindowName: 'xgmatovvgsnuzklksrwzktvdikxrzasypkzjy'
ClassName: 'erpemualrbjoodlomnuclylncvmxqqtkhsjfnl' WindowName: 'rwvsttzlxcjzakcpisgnykvl'
ClassName: 'hewcbszcdxnwrvcofppis' WindowName: 'onpvzyhxboqhwfszjtdow'
ClassName: 'wciceyfrlsnuqrgmadtyppevbcuzoduwz' WindowName: 'haelcfnczexllpxgq'
ClassName: 'mmvmnnrofdcsgdqvgxcskdrwswvndu' WindowName: 'nchbcppvdkcmlcfqjodgntrmmalzkhnxfzttgkx'
ClassName: 'wuuwhrthytntvweicayoobapjmusgnzhrnhnfm' WindowName: 'oriajbdgzvmfsfkcj'
ClassName: 'rqrdyzsrloeshudlzhpcmnzcpjujlvqporp' WindowName: 'lnalkcmqhuvqseqfek'
ClassName: 'yydcorawmebxyatxvsvscyvayxk' WindowName: 'gasojuixtidniumgzkqurbqksnzolum'
ClassName: 'cksakpipvudyntzausaoikkbkbc' WindowName: 'qojxadbcdtnehrvfltbvpsfhrrfwcxnfben'
ClassName: 'uyhuqxkbxvlcutqdqlodcdwqymxeermzfdsv' WindowName: 'mhoeztvvwapocnxkycrfqtjoyhnthboziszvu'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'kesbgwjxvywvaxavhkksuoqwrsc' WindowName: 'ekbgbgpdmsqbmypymbxd'
ClassName: 'dycbicxfyrznnpcslvlhnyookwunzqxk' WindowName: 'uqeqsrcaqphxxhjizvssjirga'
ClassName: 'qoqfygtexqfvajkefivlxvadufylyuoguzxkrc' WindowName: 'dlgoaffrnqjhjfsvxey'
ClassName: 'eybxjkivgsibttfegr' WindowName: 'prrwzchcxlygktdrmxoffcghlcfnbnhtcvic'
ClassName: 'jrilqzvaleqcvtgi' WindowName: 'cdottdkoeczztpriexbwcdttimmkmhjtycuf'
ClassName: 'ublxecgxszdemzsxskgkjhxofxwlccere' WindowName: 'flsqrydfxatsnymkqtadapmpoyeodtupat'
ClassName: 'ymrnwtgqyufwvdkckwdxmhwtricxm' WindowName: 'ppccvzqdwmkofukuffqlecjckywyqawekyc'
ClassName: 'rwpihufthyhbmzulqec' WindowName: 'olmlivomhsawrluzahkm'