Trojan.StartPage.59886

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsz2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsz2.tmp\System.dll
%TEMP%\nsz2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsz2.tmp\System.dll
%TEMP%\nsz2.tmp\Math.dll
%TEMP%\nsz2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'xlxgcjhhaqrbovpqmyzfqxcu' WindowName: 'kucaydhfkmeebkapjgyqjlnrxopxcmonmzfn'
ClassName: 'riyknkzrzscenmljszweoqdhhiajc' WindowName: 'otjpnowllzzkxzls'
ClassName: 'tczagipxlcnougyqqekrmwe' WindowName: 'jmmtjabeeozrlnfsirzuqqj'
ClassName: 'qxgjfhfidqsmjtaajdzgcmynmv' WindowName: 'ailoabhyaunacfyuqtmt'
ClassName: 'oqbxpptjvettgzhy' WindowName: 'ofentmrdgrctofoaekazwuxnpg'
ClassName: 'anrayxfzisxnvbshdqoalpzquwinvcwelhwt' WindowName: 'kpajeadbmjjcquvlvg'
ClassName: 'kcmffpxbyeisywikiamwpthecmkdpqk' WindowName: 'bwhjusyjgwgjdugubutugypxgybieyrygstfsm'
ClassName: 'vikahjiqjfdpzwalitdhweohi' WindowName: 'qboulykuhbdbywejmfagrtmurfa'
ClassName: 'fkmrnxuwcdlsbhpkfljklqlpzfuu' WindowName: 'sveuktrkijldggjs'
ClassName: 'drvuvoztbnpyvjqvgz' WindowName: 'cnupmligjsdnazfzsrxiztltrdvtnmeioisdpf'
ClassName: 'vuumqtwnribpmqlfftquncwcfiwqna' WindowName: 'rwlervyzggqvkzaswi'
ClassName: 'ulnpolifitqwosnhsmujuvnqcqyivjzncu' WindowName: 'iaziikjixiepqoogdvpgzknqlbyvbal'
ClassName: 'ubywucanvkigjdtsrmdamryaorbjsgitvij' WindowName: 'vunqcybiodvqmxrjjqyhzppthnbzrjh'
ClassName: 'qivxqqozbhmyhohle' WindowName: 'kmygwhptnfnxpkijgcpnszgdftzhldqat'
ClassName: 'lzpqwcarlfhjxxupfrduyxzpqzhrqwbxb' WindowName: 'vqnbudnikxmkmlmopgc'
ClassName: 'sjvuerbyfoubwekerflrkwuktg' WindowName: 'jnslzqxemhtqgnmctebhjfnunskevveycxxiq'
ClassName: 'nsyvbjeolesjbzqgpkaadcpafjreh' WindowName: 'egnuvckzyaooccrxwhaajnkhbfi'
ClassName: 'nrklazquacxxtynkmcdjkxrhmlub' WindowName: 'aobnlmmwbpjojkljpvng'
ClassName: 'spexshnichkldyycqojumooqyhlrnfjqg' WindowName: 'rzliodffbznrhlqdmqspy'
ClassName: 'uqougfrkqahgbbadspqgfvhldldv' WindowName: 'vzqxmdmiyllaeebrjqshpxlrntplqnk'
ClassName: 'inqmbechlyvlrvsbamlatcldjqbvifeu' WindowName: 'dghylgxhdzureokeoclsaartmeliximknt'
ClassName: 'sxgdnguhtzwmynybqvppoirhjmgatkcmieobsc' WindowName: 'kjgehqswdoqcxpa'
ClassName: 'ieptunneveyqqnfoisbvip' WindowName: 'lnqcmixiloqrktpnqklss'
ClassName: 'njzgxylcpberghjuovjxbsktwuhrrdrjvjsohmu' WindowName: 'cbbckynsilvezxbrtzxinjfrbyqexyk'
ClassName: 'yzezabkscaukrhsuglmqtludajcbmovqgmnqq' WindowName: 'jfguosfrqrvykdwehkqpsrbtu'
ClassName: 'valnetzwqbhfobstb' WindowName: 'abctjkztusfuodzitzhdpvivieguuvus'
ClassName: 'whmckyfoscvvfyjgpbawhjjscuqkicnwbpjljwh' WindowName: 'thzagstbdpxdjrzattpf'
ClassName: 'emzyyhpxfhrnmhxiqvvqrtfyprskilwramywt' WindowName: 'qrbnjvwsaidkoitqzmwraikmynxum'
ClassName: 'cmkxdxrlipvupzxpelwttgkmuzpbnuryynp' WindowName: 'artafgcppclgzvfsbpygwqfmvamgs'
ClassName: 'zkaojxgqtvhsxiuzscunxdekmtlznccsojnbbk' WindowName: 'lbfodkhrgdxdzowyrolzuiglflktxcddua'
ClassName: 'bmkncuvcfeajjwquheglftol' WindowName: 'vckivdwkoezdwcaiymqfjwqxdetq'
ClassName: 'ifatjfebrunnyuuspmvdg' WindowName: 'znqivugwtbehdvcvhmxefwccaeojs'
ClassName: 'qqsmkvnnxtpjeklmdhzgmcbpopcgmrv' WindowName: 'zupnpxdaofoyvnrx'
ClassName: 'gwioqruvkgphahchnfcx' WindowName: 'kyvovyemwdbogxivsyiuppeniqqqy'
ClassName: 'ytnvtozovpybmkzenkpfniwbcqsohmbmhx' WindowName: 'qiorvcutbfuktznyzlybemmasmtnfpmbq'
ClassName: 'nltzkjeizskbteqfnrmnme' WindowName: 'gxojcfumtmguobhoouwy'
ClassName: 'esnrtchmspakxmgwt' WindowName: 'mdekelxmosceiuaqawulqqfaki'
ClassName: 'qesmesceeqyslprqiwnkn' WindowName: 'xqkqknttxcwnunjjdtpzxnppjsvan'
ClassName: 'ohadiudwajbpivi' WindowName: 'rnebvxonwrhwnhqxstuvqsmem'
ClassName: 'uadnqkpcebyfvnm' WindowName: 'hkqaryqwphajynisjentwp'
ClassName: 'rmneoiloqwgormlciuimsmaqrqvamdmfbrbr' WindowName: 'ztmfgmcmohxfvzdxificpiugspkg'
ClassName: 'ylkxtrloinmzaktfrcgrrwmlygtcecj' WindowName: 'plahztbbfmyciwkhvp'
ClassName: 'bmnonhrfbaqskzblkwlcwavcppkirzubmipf' WindowName: 'ojhkzyzohcxopkbpirghbjxelnvkbvlwnx'
ClassName: 'dgvosmijwjntzemfvzvyehaxxkzmrzwdgfw' WindowName: 'semhxstlqaznnflndrv'
ClassName: 'bfyiuwhuzjgnjithmzspqc' WindowName: 'ycobmixgjrogimwykcrx'
ClassName: 'nvtqknupitzipdtdwecotwvuysysllwuk' WindowName: 'bnjehlbummkrbtozquyummh'
ClassName: 'sirsvzpaqufvudvcrffgjoqfnkxpjvyk' WindowName: 'hjeuyvedokdeqmeafp'
ClassName: 'lwpcuixoekavobsjszzka' WindowName: 'yiacoybcsyiihsllcv'
ClassName: 'qgxsvoeshtdczvacmuvwsxrtlab' WindowName: 'tymzeembypygebmyvifwx'
ClassName: 'frpgajsjycvxxnv' WindowName: 'trkjbiiorwszsdbbhmvmvk'
ClassName: 'dyopdtxruyqyvtnqysdma' WindowName: 'ktcnmgecawjezpupqowbklabhss'
ClassName: 'aktxtdqcgqttikzfhrfioxynlvwngdttmswxt' WindowName: 'jaevpiptbxpvyaziqsaqesixadfmogbmmjmncqe'
ClassName: 'rhrqhakxnxncfvimnpsssvlljbsnqizud' WindowName: 'lnoxixmmhqoydrywumodrekokvilg'
ClassName: 'imqrptwgnvryxnrvqvqwpreeftufdinrc' WindowName: 'rwypzixyoudrvhxfffvpgiekolftkzt'
ClassName: 'loqghhafjevwipcylczakkebhjstuakwjn' WindowName: 'scwkciqnzatrjdcdxtigprdovxvgoyhymvb'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'luibvigjaoqmsnpgojiowxiqflafjfxdwvfybyq' WindowName: 'eadvfkuggwobxrvrjhbwewdmci'
ClassName: 'iopmrqxfatcdupifvib' WindowName: 'jyktlrxzhqftrurbindep'
ClassName: 'gspnatdyiutktglfhpedc' WindowName: 'cmcshowuxtfexkcnl'
ClassName: 'svhvfirijnortiylftimwutvcwizm' WindowName: 'rpbumnyoneqjskav'
ClassName: 'eodvvoqprbzzldaqjxwyoadxcinecopmck' WindowName: 'oyhbcirflphldofqecwtdeffdogpcwkxnig'
ClassName: 'pdcjsntpbtljlxkprzwarjlnmdrdix' WindowName: 'blongpqrncohqbablhsozoumaulgczrelbxjgq'
ClassName: 'rgmduvnivmjggkgcgighehphwfkuxaupulfo' WindowName: 'cvcbsnyrgzbbfaulsgatbdqvsinwt'
ClassName: 'xitdohremmdfhjpik' WindowName: 'tynqaqcpgapftmpvm'
ClassName: 'osgpfsacisjpnxeuhynlgghipizuafhlqucmwxu' WindowName: 'ujpgusycfeyxvxa'
ClassName: 'bgkjkxuvbgbicxiltxfcly' WindowName: 'mhtstywbbyhszqyoye'