Trojan.StartPage.59249

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsw2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll
%TEMP%\nsw2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'xbnuukiuomavsyvhmzmmzkfgvcrnlni' WindowName: 'eantrpuiokptjguqbgixikgggzullegprf'
ClassName: 'mherxtmjotpqreckfheu' WindowName: 'xtarxyqkancosbwnyap'
ClassName: 'esdwrtidrakvtjsumggqp' WindowName: 'aacbhgkkandgncqf'
ClassName: 'tdhghexuruufrujmrjv' WindowName: 'rbebnrrkhctwdwduaqbxvuwdssbdfaiwbvzemv'
ClassName: 'hfmwtzzbdfkccuidqqakaslrhwas' WindowName: 'unznqtgvwqnyjwsiwbfjxzyvw'
ClassName: 'nzvpgkdxkpjmicnpjeksvcjjkiczhbx' WindowName: 'vmawjvghdmndngdqsllvsqlgbbqibdzzj'
ClassName: 'wzshmwhgjdyppspiuavkkructyxgiuhuusu' WindowName: 'tcdxwmemrqcmbxcsgfwkkd'
ClassName: 'uhcxzbugyhjzxlgki' WindowName: 'mbzvuthksesbnisaiopqz'
ClassName: 'xtibbewxbgsmlqmifeghuqtlvbkliplxtbc' WindowName: 'afxbnkklwqqjmkqqmhgcuip'
ClassName: 'xfkfuzlphrfbscjguuxftdfrwivtmilgxcgptxq' WindowName: 'sodsdzjfqcircxngbgekoypar'
ClassName: 'qkbqibimjbrsizfwwdhugzv' WindowName: 'vxsdqnraxkixbwipnqzju'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'excbtmczdvpqyujutcmhortwvjnrmqekdugng' WindowName: 'tkwuwxkeahhcxyxrhnllkpmjfuu'
ClassName: 'pifsudqrsdsmgekkupclfanb' WindowName: 'ipusdmwwrzftjiva'
ClassName: 'euilpkiluidjpytqartdkq' WindowName: 'kiksvujzthhifwhvkaxtwzbmwnzxgbxjruyda'
ClassName: 'vjvjjjqqjzwijsehljcn' WindowName: 'uecodhhhfsroyavsvgayd'
ClassName: 'pedvpoehfgbbukbwkfqwwtaowujkku' WindowName: 'gwtjtxrucnpbabvp'
ClassName: 'smafhrmhkiixqwtxzrohwoeqlrpmykqvcp' WindowName: 'gacxvidhojhoyfdnfprvfab'
ClassName: 'huoqcmbwsbsalmkuuydr' WindowName: 'urmcuzsahrbmiqj'
ClassName: 'cckpbotsfhmfdtcvd' WindowName: 'hbcdzvvyvkbljxsqruhhpsekevizssdx'
ClassName: 'focfvyqkvifxqowxdsu' WindowName: 'razmnuuwscwyqeuvpegndtderhhav'
ClassName: 'qrwsdjcljzsjvbhoxbky' WindowName: 'jcxnmzykttolekc'
ClassName: 'vlswvtaegdvakjbzujygaztzjnhxjiroahq' WindowName: 'nffrseoaubqqpqlebi'
ClassName: 'newivndmgayljbzkozkgpyibpndwqs' WindowName: 'cmbfdbyuordlpbowvqsrt'
ClassName: 'nuycccutxdttdii' WindowName: 'awgkwsqwgryqhkzebidfunydqcyymcutnle'
ClassName: 'ebjtqtoflgdcteyv' WindowName: 'mtxrwuwbmpbdimaviruotc'
ClassName: 'atybrrxqxziuhkqwrwewhpyrzydh' WindowName: 'pemllxijvaoaruccizfrszodzx'
ClassName: 'yggrkzqxlycelnjubeusrn' WindowName: 'wzsqqkjnwswgkqggtcoqoozidgpk'
ClassName: 'eoblyjryybevtpsfwmtscchfsxkmmsbymawuyb' WindowName: 'afaqhmfqvtwlrbesq'
ClassName: 'pfkclkniagqiayltu' WindowName: 'bilubyspdfzlekowkmnnpkynjdd'
ClassName: 'fkyxmvxeeefohfolrkggajdalqvjo' WindowName: 'gzswmvyxwlljnfdenrhubowl'
ClassName: 'pspobjduhoelxxqenem' WindowName: 'avtymedbhhlehhkvqnyb'
ClassName: 'aiwdgareypfkgsdlpwxgbpfrskhaabwmtioedn' WindowName: 'ajkbrxtzugrnibnwmffbgc'
ClassName: 'kvlsbqjmubogamafayvlyjuectiaaoi' WindowName: 'fncuvkpbvwmvvojzhfgvamjwticdnpshhdbop'
ClassName: 'qkxaqeoyqsozatvirlqunnazgxwff' WindowName: 'tnxzngwxovrarktl'
ClassName: 'ejcaqnedridnhojmfpv' WindowName: 'wkirmnvqfvvapvnzij'
ClassName: 'pkxrhvtypzfsvduidcsdgqxb' WindowName: 'pkyggddneqiiycat'
ClassName: 'ngvcvipwlguvooptxnd' WindowName: 'cfsrcdxkwlieievojij'
ClassName: 'ermyqfdjulpizcziouqwhjuet' WindowName: 'gxqbphwiryqmabcbdtjwuyj'
ClassName: 'mmpfomwxdglhiiuxmueadzjqxb' WindowName: 'phlvalfrxowaeirtvdghcyjxagfzylmjwi'
ClassName: 'jcjffzczuktengbavsfmqojsfyc' WindowName: 'vygsidmpepboialrjwpiyfhhoeoejbmhydqzpb'
ClassName: 'ssmbrdvqedoogxcepvoqhnkmvqptdxqbxicxr' WindowName: 'stnubswvdlkkbott'
ClassName: 'dkwrisfxljnxjqywwryggnz' WindowName: 'elcoareexmnoyoxbigqgncykgkwjlipahkiivb'
ClassName: 'bzupwstkyiqamwwaobgzm' WindowName: 'cmyttfilfnavdxvlojdwpnmnoxlkhxguugm'
ClassName: 'lderezvsvjamzftndks' WindowName: 'hejtpitzbitpsshtmq'
ClassName: 'jrqpdhgfhojihparqsbdmlplgiilawv' WindowName: 'hwzcrgcdcinohtheosstyhzgauiboplkmamrh'
ClassName: 'sgsgswfrzivmiesupsut' WindowName: 'xbvbdylcqtxrfmtcgusfaywfvtqyrxhbhkaes'
ClassName: 'bmfugcjfggebufzbpqurysvgfbsjtdebplpj' WindowName: 'uehrxeofyzfcgslpasrmpiwrxsoainrb'
ClassName: 'yvajnavmjgdugfsiomacrnpxhtsxbsigbzujx' WindowName: 'nkpggceiyeahodndtmzaqsewhmhldj'
ClassName: 'dwsbyyjoeerombdonqpucqmkptzywqknz' WindowName: 'nfwecmjnvwqsuuieyhoiiwnbtoss'
ClassName: 'ddcoqpgteksnqetegodvegviuhtob' WindowName: 'iwjtkgpjxedceqvspsbmejuqk'
ClassName: 'gwklxcejhsnkgogefgiacmq' WindowName: 'xsosgxmwmkovshsb'
ClassName: 'jrhurkprmfakqevjdszldcmdgouztyzlqeqlplv' WindowName: 'ogefpfoyeumyrapibc'
ClassName: 'qsavkqpgndqiqpdrzmgiuzymubazbgsbjf' WindowName: 'lzhuaflxjzpxgnhiugqmlcvnu'
ClassName: 'zhjzwdnfnirvngswjicbnzrhpzxw' WindowName: 'ojzjhaoszwvgegeyvgmdlnoubiflh'
ClassName: 'penmbpvkbuwlssvnjadxx' WindowName: 'ztjoawypokkbofquxcctcgiwzjiinplnkbpyu'
ClassName: 'auiigoyjnpkdzpmtpifsdrvirpsxcmchiflq' WindowName: 'sgyjmlyvohgkqweusxccufuhooccwaalslncjci'
ClassName: 'oshotqroeaauwfrhwoxswdoa' WindowName: 'ygepatfbegnafroo'
ClassName: 'yvvrywxlrjkbxsdebk' WindowName: 'vldcxovrfxszpzuquvpwrftv'
ClassName: 'fairqoueofhkfpmqtsontedykuw' WindowName: 'jyucvvfecfontfwaxgyuchircdeaovgixevywq'
ClassName: 'ssjygttpjwepdtjfnwlstkizgsmkony' WindowName: 'ecamiljizhvkofalgkqpcmvpqfjljxljit'
ClassName: 'uhianhvigtufwgjpaarjirlquspdi' WindowName: 'ocrrftpspznbptlqvrrkyskthrvunbxymx'
ClassName: 'vfieolwiwqtgekjtdqcoq' WindowName: 'hqrzbalvtfingutftgwpdnupaowciwugcif'
ClassName: 'zyqzqpjshfuiqkriwoiclwtxptqzimapqtt' WindowName: 'oitwflmotlkjakqi'
ClassName: 'bgzpzjdosnuqnjby' WindowName: 'yvvqnjpavsxbuizjvzv'
ClassName: 'wlgujkucrigimajztzlouahcvqs' WindowName: 'aqizfoqsradkossyqzyoghavmqgqtmmkrdxl'
ClassName: 'rcqdeboerqzkoibyrucvnzzrqiknewb' WindowName: 'htzhhhwavhdknlmitoftxzrytebibyjanaxx'
ClassName: 'aydqnbndmvltdvmwkedeqqhuxuosztcxehmrizw' WindowName: 'fthybojbfqufksfdhdlk'