Trojan.StartPage.59144

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsg2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsg2.tmp\System.dll
%TEMP%\nsg2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsg2.tmp\System.dll
%TEMP%\nsg2.tmp\Math.dll
%TEMP%\nsg2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'sefwqrdwpyqekzkxyidn' WindowName: 'vnfwruxeuuyttdmrwnwoqmxladdprzzhxgopf'
ClassName: 'vdwsmgzgrmkvezpy' WindowName: 'phayrqbrfgftwcgximyvejabpzq'
ClassName: 'pwkmqukvczmnpdrkvctharapg' WindowName: 'gatcxjauggykngsftnktvnowoonjjhwskgmpdf'
ClassName: 'tdqnxtkaebgrlecvpvgyx' WindowName: 'mgmglkwqoktnlpxqxjxkjiklfdf'
ClassName: 'ynoyjnovowexfnthkojsehjbkracgyekhobs' WindowName: 'ivphqxulfhyhnyoucrlb'
ClassName: 'qeuwaickinsrvdf' WindowName: 'ezgznptgiiuggtpuvrounbqwrdmcluoseb'
ClassName: 'snjkzyhnjgktfmp' WindowName: 'uatnclrpefvhoeqvpbnvydexzhfxabiwm'
ClassName: 'mltgjglcsbpywxaxoeprebesecdwzxbujadngq' WindowName: 'igdlrgzwndspfeli'
ClassName: 'djzqmljhnrivpcwwfjbfbbmhkkvxssqj' WindowName: 'yitxsdryozghatvhgkszjgbcjzrouycdznsyb'
ClassName: 'pqaxhxnkhnxovhnbrwtrfegdjnqeb' WindowName: 'kngfukhosslrzcbqyldzoymxwflcrdu'
ClassName: 'rnoaesmtenmzvpuqatqbjrrstllwfac' WindowName: 'wfqkhzvlebjsfhjliskajbzi'
ClassName: 'swheevxlbdkyiomwtjjxrucntzzax' WindowName: 'wgzabcqzhpodkkwfjkkogefpqgrqnzs'
ClassName: 'zqukcogivzuwdnrfzkgdexnvbzgqcro' WindowName: 'ijxviwdxmhihjhwvqhzgxlysayqdm'
ClassName: 'ifmmsecojysunpqpbn' WindowName: 'yjyvwrnbqojzluqu'
ClassName: 'zllgviveopwfaktagszsivvpffzvwibb' WindowName: 'ubbvbddxjysbvpmljouerv'
ClassName: 'hdtyaxigasxjiol' WindowName: 'nqezmbnetjxgmqbpt'
ClassName: 'vtcictpjvmwlnqevczqy' WindowName: 'rojxwhkiumqejfchqlyswtbpdtihvsrwtcbwsx'
ClassName: 'chhepqedabcqxifwmgplycdcoax' WindowName: 'cvfmoetzbpjedrrhl'
ClassName: 'xppwxdgpxtyzbaaqlibregfm' WindowName: 'cmiovmjivgvwjexebzanyqoevyeo'
ClassName: 'zkugumjuahfwhxrzwrqfh' WindowName: 'fitobigamqazmynxzyxwtzommhwnd'
ClassName: 'frqvijlmxjzebdvcjdfvandcli' WindowName: 'enwtpqatsyqtmzqvnidfjjlkk'
ClassName: 'lkkepqhwpyxxrffkwvpylrcpglhmxbaacuqky' WindowName: 'xikucxubyeqvhyodsttdi'
ClassName: 'ntwwxxdneloqsuxutacjorwvlomewdeg' WindowName: 'wsdtzgrxbhedgusgdcoakjuypqtzjhgmenyc'
ClassName: 'owaxwszgbpyreirobdqiiouukvt' WindowName: 'yyklunpmllflsztkqwdvmbxycfzueptlyuvuwiz'
ClassName: 'adcjtbcnhyyzpcpmvsziyapkot' WindowName: 'adzjobxrbjaexljia'
ClassName: 'kfjcbbgkezrsdwomygzfcfebrxblbvdbgb' WindowName: 'amcbbgxbflrmhlujadpawnsz'
ClassName: 'fbjtgdztwojikqzecfkhzxvbhmabpsbywwzwngw' WindowName: 'maxdozwyirdijucxwbwnadlksrsgyjdmabokdxb'
ClassName: 'hryltfwpeqelbaqjcvfmxubnnx' WindowName: 'mwjjinhnbisgpdikewpxetrekebrovszewnl'
ClassName: 'nusrgoupevdobyqifkjk' WindowName: 'sshlncbfzjwcljtavdzrv'
ClassName: 'yqqcqdjdvshmuosiinigjimwjps' WindowName: 'rwtwlwyxwygedqbiepchqaxubvmjfahhvy'
ClassName: 'acnkfidgiinibjcrwfkftapyj' WindowName: 'nggltgywydwsdajtefusruktn'
ClassName: 'cfhxvomebwbqgvbcoqrrfgntdpqbicdbbng' WindowName: 'wnmjlxhyfxcsusfacubdejrvcvvlxweybhzj'
ClassName: 'peafvllrmedmiwvfchc' WindowName: 'koaropruhfefezrotplfaqeafuezxax'
ClassName: 'znalhcfwoqswzwarjvavx' WindowName: 'axjdpnfvejmscbueubkazkdz'
ClassName: 'hjcjbdzqpiidrev' WindowName: 'fqiqyffdfyxuuee'
ClassName: 'vobgtcigtffttvsztngcpxnyvemkse' WindowName: 'yvifcqorasjoasc'
ClassName: 'cnovtdyvhzggqtlshrltcbdpjmfm' WindowName: 'uxhjhbhehwhmbdahzzzlbvdmbhtj'
ClassName: 'mqiyuklicirfgebjmjeokostkdkvjm' WindowName: 'mnpzqhhblcwmqzwpmstscr'
ClassName: 'breypdyexighplprfv' WindowName: 'nldgpygfqqxzuoocqfoxnymwxidopxdsxva'
ClassName: 'fdpjkxvxjohzkjpqtskuphiywrixfwhg' WindowName: 'dmwimkaojlifque'
ClassName: 'uxwyixzqxngoxywdmagmvcl' WindowName: 'awqfcorcxpzyliusdqsvufqlylrqqqwtjak'
ClassName: 'gbzuhgqpduodukgdgvxajttnaxgltzc' WindowName: 'ypcckjzyeoqhalaoewfbil'
ClassName: 'smzlopiykitztvotqziskxl' WindowName: 'owcqlbqtqzgxtbmhdvidikaxjaootl'
ClassName: 'svqsmgvcbbsfbzddjcyqmvwzctth' WindowName: 'ldcewthjqksvgbpejpwacxt'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'otrexfmfoidhhqkylskdcboyv' WindowName: 'ppcixvnqtnppthwozazkkiu'
ClassName: 'kmrmvhgrtxwkyzpoolawulmhifapwdkodegu' WindowName: 'etufihvjrqptzbtrblyexlyxchysy'
ClassName: 'rjeapscdgfbluijdvmsqnkoqlfdxz' WindowName: 'hksnqeeremntlkpgxvplodwiafg'
ClassName: 'lxryvrwvkkrfxrnze' WindowName: 'mtbgcbfsewxpwvosbnieqhupgzzdtziwdvnf'
ClassName: 'ybasxymvtbjnzbdkmlotuhprixbnjjxbp' WindowName: 'zpdutvtoagpyzokuywhaqilgtdpxosizejtrms'
ClassName: 'vzyvaupwjwpqbxtyvgxbrrimgoqbbyzojfxxsuu' WindowName: 'aczexpcastuchxjcedratu'
ClassName: 'cfereutppbzsbydifrjjadbgnxqcqltzqxjxal' WindowName: 'hvyjzwpuwsukwvdoxcnouozbjgfv'
ClassName: 'egzudjxibrlfjtjrjk' WindowName: 'worndeltfyaxvfkwtgzfapghi'
ClassName: 'rxkjvyvagznljbyabuokcqxwdabgmwpohdzineq' WindowName: 'xfekotbopkzthyuqqxojzrykggbymbqupxn'