Trojan.StartPage.59157

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsy2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsy2.tmp\System.dll
%TEMP%\nsy2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsy2.tmp\System.dll
%TEMP%\nsy2.tmp\Math.dll
%TEMP%\nsy2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'fctealpoczyplyxter' WindowName: 'bpcnfbrervvjdyxaekgwichbhuqqdrbcfyz'
ClassName: 'soijdnfdothnupatdevxe' WindowName: 'ljhwcwimmiytsukegxtwczrbnk'
ClassName: 'mdmpxvzclmtkibpgknjprlvhwwetrggncwdmja' WindowName: 'pcjksmtfmkkbwpfqklv'
ClassName: 'ddjwivzathpyfrwgcpacjlmzryiuuvhvydudcsv' WindowName: 'acqmocurgmzfywheemicthgcgemkfo'
ClassName: 'mjzjbtnxlgajqprlrvizhlengnmxkfme' WindowName: 'ratwwujteszqmqhooowzcs'
ClassName: 'exbxezpmwmziyjesnfsvmvolkhrttsfzjxuw' WindowName: 'gyajgovenjzggdgxtjhxkzhvi'
ClassName: 'falfddxlmukteqqapgqrvnyhfgam' WindowName: 'tgxrrdtfzdwqvyzgxmvowmacbozahhsekvk'
ClassName: 'yzepsjjeypnzqcrrisyhkfafrzlux' WindowName: 'dztcalarmsvporgxtbbj'
ClassName: 'nsfctfoqijdenhndwkhekfnyxl' WindowName: 'fqnglzsvawbdsiwesbkcduelytcixjsuukgmus'
ClassName: 'xftjfxzhuneuheogrokhidanssqjxnblxw' WindowName: 'fdclvhocmjpzpunkcqd'
ClassName: 'wqkiesvgamvmxlaeclmvycdqqebnsnupsu' WindowName: 'rcrknpxvywyakbxtfdyrurxumidcvz'
ClassName: 'edwyxijjuprljvepbisazdolrhn' WindowName: 'cjwttmulluvvybunnqhmzfsyw'
ClassName: 'kytmywoafpndwveqngavungotjvloei' WindowName: 'viclacnznhhkquy'
ClassName: 'ewlfdpfeyudvnlrshpvcqdqffykx' WindowName: 'zsnzmvnrchvnnewrhlbkjx'
ClassName: 'txrbxfphatgxzrukpqhrddasqjqcsirqfwadc' WindowName: 'ohjjlfifenlnkuaiutpswmocmuti'
ClassName: 'zawukgfinqqzjylkthbjsqnyoznhbzuifsgz' WindowName: 'jybykxtleoosnyunfzfryyknslwjuo'
ClassName: 'tjnntjsvylscamqbtbmf' WindowName: 'reedujjdbyqfspyskba'
ClassName: 'irmihzksudyizucfyosuisvtiis' WindowName: 'yzapzqoyngcnqdomgmw'
ClassName: 'xorlbeemsslofhcwsobaemu' WindowName: 'wiiwwlhzywxbxfrzbevzdh'
ClassName: 'zbgneftibqtxpxairqmbdlopjqlrzkx' WindowName: 'omtzeexixuiqghpihedwxftkxnvzohz'
ClassName: 'aysiyeyqnfsblmonldk' WindowName: 'fispiwzzubbauktssugifrccygpjtudzt'
ClassName: 'mtakvowohhguxufzswdxjteucmjyrtjrhtwud' WindowName: 'jaxkoarvrtyfvbxany'
ClassName: 'sgxqofniymhjeulvw' WindowName: 'elnmbvwctpkmwjoudtgsfrjsbtpxxmfe'
ClassName: 'bjxpyfjhawymqhak' WindowName: 'tkuowdfxgdsezvxktcijgrcksjowhdzepfsjbd'
ClassName: 'eubibvvwjwbymzwvdlexcixkfteofpltrg' WindowName: 'zcyigevtizdpowikruqsbqghagqjiiw'
ClassName: 'bclgobvwdiucqrbrsgdhgicrzytrxiaxoowcnx' WindowName: 'ulnvceehelkjpqkcdsjijtvd'
ClassName: 'bamxfjvyctdxvcqbgxtphkqmjp' WindowName: 'qbyeztmvhsawfgfeyjgujpoinoipfitxkgvnul'
ClassName: 'aeocdbsjbzwclxwpwujc' WindowName: 'phmkkmjvjxbumcd'
ClassName: 'ojuzobxklgqlmoknpxrzfpswb' WindowName: 'smhknjwwqgetzwyrfmiguprvlmtg'
ClassName: 'ooobzirukbvtcnfdjlaearqpxmwfmjsijxlf' WindowName: 'luxdvupkbjgcaxohhejccokbpc'
ClassName: 'hgndynyhstiiyis' WindowName: 'aeqoaumpjojyvkn'
ClassName: 'isunkmqodzjscwfnvji' WindowName: 'yoxbymyhsfuhihcetcgplpwj'
ClassName: 'yrflfoschqklqizgabfazamuxltpxpkokiwezef' WindowName: 'kxbvuefqvvjwayhghno'
ClassName: 'kinnlvxhkvqdkuydzivizzrpmpxvkizk' WindowName: 'eifxsqsvkiavlpkuaiapwzefdnokydbxabssyyr'
ClassName: 'jxvbuzticxmydylfmlhaiq' WindowName: 'wkzaojpwppojzscjucfrrlrljlah'
ClassName: 'bqmbgkdnbbfptjeoywkslyhmufhcfm' WindowName: 'epchyedwxszatpnwcyjqtsaysnogsijdht'
ClassName: 'hymfrdquuxupytkvevuzfldynmygegkiw' WindowName: 'smqpyohnbudsgjlimtpxneaauvehsyhghp'
ClassName: 'wzcsvojmekvlrwpajbrxuqc' WindowName: 'jivevuogjuhatsypmbdigbabu'
ClassName: 'ttpglxbkmlfzmzjkoxpllw' WindowName: 'myjnlragsykahaisljcemqcssqqyxwvhbbhxdd'
ClassName: 'deaexsnsoxkuvrpljcycoixxx' WindowName: 'zimnezgafoacgyevpzldqcv'
ClassName: 'uhoctfhetexymulimyxkhqjhhyygnqe' WindowName: 'wkhfbwwohldrdhwbamwkhfyidqjsdpbgi'
ClassName: 'yhnixgbucjqochmluwyahfhtjt' WindowName: 'afsukrrkjrjcrigyyxccsvuoowbfgbdrvlq'
ClassName: 'ilwzmneeahhhhkfkunmqupodvwwcit' WindowName: 'apbydcyasxdlhzvijolnglzknklvwnyaggn'
ClassName: 'upgcbwwsiuzmmehqwghcyplpaltpxgiu' WindowName: 'gkmdcnncsxakwpidp'
ClassName: 'fvgekdcvljenrihrehdxffwrnqdz' WindowName: 'kufpneemaxbhliqqaewjthqfhedgos'
ClassName: 'bnfjgmoinzvyiwrrvsytjoytlqlwdyoz' WindowName: 'zxiapetzysadeacpfbzzmrcdxvjc'
ClassName: 'xhlomgelqbxemapggcnoqcdvojp' WindowName: 'bbpaxuqfztrdnakpqspfduzxuoqahh'
ClassName: 'ytmbwzyuqzbvhtjavmznjsos' WindowName: 'npvylqehndrvpafphmzxeccjdnsdfmnfjq'
ClassName: 'fmndsfnntmgobkjisctfpwfgqwwfq' WindowName: 'kwtavpfqzeorzvellywtmaazbgzwopp'
ClassName: 'ygbpwntpilmmgcqc' WindowName: 'omwoymxttjpgoweoylod'
ClassName: 'syqiufwqjvwbxkrbc' WindowName: 'ppyvomcqvfodmwvtqpammqsir'
ClassName: 'sbdomphstycgpztw' WindowName: 'cjzfrirbsxzcodgczalytdyhvgdsnwxklnlrzc'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'tvdnheftvivazcgdpwwyyatkragzxbryccxqly' WindowName: 'dxtjygxcewkdsigqkpxwew'
ClassName: 'pvweefxfjjvoohlklxhobqdjwuvps' WindowName: 'ykfeeruqxiabfzbkklhzlc'
ClassName: 'htjdcteqytiuymfasxuwmf' WindowName: 'qbwmynpeyrbqmrywnrsamwtm'
ClassName: 'djfopashaphogsrqkvkakmqkduahodo' WindowName: 'asmahwomyievlzjbcg'
ClassName: 'yxajxextpultskosgmctgcjeqmjjspdly' WindowName: 'rglvpgfrjrvrsaephnwajkrwst'
ClassName: 'zzouiczxbaeoqtcnz' WindowName: 'xgeinunlmfsykpjxyrspzperhikfuzvczpnqsu'
ClassName: 'bkbkqxatvnpogjkxplrtukmpkywjjfw' WindowName: 'kllxvbpcwfncdhwdplbwnyglmlwqsiik'
ClassName: 'uoaxdxhojievvdihhgadhumqtzjtco' WindowName: 'rpkxxzfgfzqmcvtsdqbuli'
ClassName: 'pmpnqvexuhvdfcyinpovhxlmjdviwixhacdwbj' WindowName: 'lsblzgrldfnbhlotufhxdijgmksltt'
ClassName: 'gtfrpisxiyjbdqe' WindowName: 'npvndwgjypkcodbcredns'