Trojan.StartPage.59344

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsq2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsq2.tmp\System.dll
%TEMP%\nsq2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsq2.tmp\System.dll
%TEMP%\nsq2.tmp\Math.dll
%TEMP%\nsq2.tmp\InetLoad.dll

Сетевая активность:

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ziljbkdhdvqqcbbzxeswjaufyuejh' WindowName: 'kfadakwtpdcqxoyilxiljjizvmwjra'
ClassName: 'wlmiaerriwhhhacfiz' WindowName: 'wjxiglndbezegqxi'
ClassName: 'rxybscuompgatveetfnlgjcjpjg' WindowName: 'jxlgarozxqffxxgnxzxpwdjmgckdsrxvwef'
ClassName: 'rkwsakrgodrlkakbpdoecwv' WindowName: 'hoaqylfpuxoonljpsqiuytbuit'
ClassName: 'xsytqwfeddcccrrckubqrznbvmbp' WindowName: 'iglbuuztlhhzrqtbalsgamlvzrigaiyiwrvmgar'
ClassName: 'gjkjmpjrgoczqfeqeajkyubeeljlxegect' WindowName: 'nuxxqawectkvuvflqngdackzfffnwsddlos'
ClassName: 'yavysrktqtndytrqgjtwmzxvsbnxdyvewwy' WindowName: 'xvshtwytrwkjavqomhhnwqqzzsp'
ClassName: 'mufjsostzzqwuipsdfdxkpifeucsgkbaz' WindowName: 'svbdtmxtiplqirbqrnwtznmjknlgqqh'
ClassName: 'yjffbchvrkvxzycprrndmdpssqsqyxgu' WindowName: 'dekvmxanacwcvvgujllskzqifoasxnbmydjgg'
ClassName: 'svjwtioapinjulhkrygl' WindowName: 'vghdivljrsjaqbsegbktu'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'zlcsazplvaxhpltefqytakwhfmgcxhypsluog' WindowName: 'cjnzckxxnrqsdiscszmugtwjrdoacwkqzpnxs'
ClassName: 'gzzyirzjhsxjdpacewukbuemdshyxwq' WindowName: 'gucfqvdnwdqhbxyqirzgiyibsvjtmmeth'
ClassName: 'icttmiwhnqkooozhhr' WindowName: 'eqekccbdhbagkeu'
ClassName: 'xkvlrvqsmmftbraexh' WindowName: 'rzcqikyvqrliwxny'
ClassName: 'ejbtryrrsjpyroolbbuarh' WindowName: 'gogejxubqoziqvnzc'
ClassName: 'qsckmnwxefdlfipzfedltthsezp' WindowName: 'bfxdmwbfonoljvyisggeilpetlqyy'
ClassName: 'uydrzmlxhhjgbuaohvnsilvrnsq' WindowName: 'rdcxgkmvimnyqmzvtplxdvnpxfcxktunri'
ClassName: 'tvabxhpxkuiowylwqhhvpz' WindowName: 'dpgmenctispdqbtenqytryfowwwvcdkkxxmtj'
ClassName: 'iivlucgjytzgoqhuzdr' WindowName: 'eiakqblzpcrlrfijbmaybgrffdsokkqwbvw'
ClassName: 'nsyrveskphngkvjnfeqjvppoeywzjvwpjub' WindowName: 'wcqepyixakenripwxdsmbthlvbsvlvjiopqixn'
ClassName: 'ufopsnezwafqadsosdvjyfyzhcmufjyjj' WindowName: 'qlwcjcwldbsxhfz'
ClassName: 'ekvzsogcbfomqdnkjpnxeixiwb' WindowName: 'dcwpfelbnnpyzjilocgcqerkeksojeeu'
ClassName: 'szbugboggmyxgtvmoktjvfnnvqjeucnymvyflkf' WindowName: 'xbvnirlfutndegrndaxauxciqbjnabusribyz'
ClassName: 'gmpxmnmyheooteusmtivkikoeoxalydqu' WindowName: 'algpefgrydcdpglxiwjybkx'
ClassName: 'zxiitomhqtmmhfdkaiiupnqsfztxiflxwsa' WindowName: 'gohozlsdwuvpevucilzrkyhuinrgnvx'
ClassName: 'raviqbnjzeadjxeupfdjymoisglzzbszswbufnk' WindowName: 'sbthokcxztwgblahjb'
ClassName: 'ilgamgndjpceuflvl' WindowName: 'pgmtcsvecqmwyiqenzgex'
ClassName: 'wrpsomjuaduvftyqxdytesujklmwmo' WindowName: 'bqzmdrtltpgadspwpvvanv'
ClassName: 'frkpyhansdjqeutvqigxhiprkorgaz' WindowName: 'bhskyyanmydicrnbfipmvxsyc'
ClassName: 'ggvqzcipdgxmqkxwkkogk' WindowName: 'vubjqyronhocqxnqy'
ClassName: 'opxsfehvhqwzyurdfvaza' WindowName: 'nuagmnpbzseodsewefdmpd'
ClassName: 'zfhrpnjlmclammdefzaojnmgarhzipksnjvt' WindowName: 'ueuvugnftgronanfdlixzkrrqytvcjmwbrsyalv'
ClassName: 'guvwaevltruubpcqdojefderxeujuzlelu' WindowName: 'crkuqhzcaxzhqxbkobmuqqzepfn'
ClassName: 'txhbwirzjopiirvfib' WindowName: 'hcwhzrdcxqsvqbuzxkyetl'
ClassName: 'cvqqqabsbnrfrmcmazjozalv' WindowName: 'qctptqwvnihyoxxhsvrdccbawhtj'
ClassName: 'haldjailzixyyclayumgxwqqcfpc' WindowName: 'kzyggtjxypspmffjlhgjlfhbjdlawbn'
ClassName: 'sjslxkxjkbwgnhuxjtkuzhjfssx' WindowName: 'ovrxcljbuaeyvwlkziujdcnwxx'
ClassName: 'ysianjmdwamzmfvapaoakijvryeufwiaovec' WindowName: 'zpavhehcepjjhuvdevnibwxjhqj'
ClassName: 'zbponwfvhprqevnieonp' WindowName: 'sxbjkhpdunijhdyezgeonusrkeebyusxbtkjlph'
ClassName: 'tjbfbxtzwrlhaqjrpdx' WindowName: 'orexetjmouyhuphwpxxdcxpwlwwinepsmiyzcfs'
ClassName: 'bffubphfueoebrmiqwbtxfal' WindowName: 'gpswyptowhkykqethburqupebrvpog'
ClassName: 'sqsggtvmvrpfuvelsvfuntbafj' WindowName: 'yfsspielqflehszzgcziavugd'
ClassName: 'wzmxnkrepgznrumbtjfobihlvremqp' WindowName: 'ihwbtqveetlcapypnjbkppktrqahedih'
ClassName: 'lgtfwqkdqxqndixzx' WindowName: 'hkoprkuzyxdhskghkreyztr'
ClassName: 'rcnqersrhdzztgvujdvfprpw' WindowName: 'yqauxblcmihjdem'
ClassName: 'bofpkesvysheyckcuym' WindowName: 'gulxxyqnqricswuvepluuizeaq'
ClassName: 'fjddimfhhzjccrucrluecnppnjgaxwluvidq' WindowName: 'dycjonmjzutnbcpfzk'
ClassName: 'ddaqznandpnetcbmcrgxotxyekjgx' WindowName: 'apreffhasqaddgalmpcrzuldvdijyutg'
ClassName: 'ekjoougajmiyelgbxxydpzmezafytuus' WindowName: 'tmjilkinbdmwsyvgdaapdqrszovxe'
ClassName: 'afldqfohopxlkcuyxzq' WindowName: 'ocxcjpmuksgvloklus'
ClassName: 'tymlejxxdoegcbsreldrxywtbanfzcqgsebj' WindowName: 'qvwnuqzdfjnthtqhynsagomcf'
ClassName: 'qrkttwumiaivbihduxvwgjzpetmzpcygpogiy' WindowName: 'lzcztxwzhmlabxqglfseorzzsx'
ClassName: 'zpctpjguguyyrdwnidf' WindowName: 'pdbmjysazlisddasmvcutsbzyukzwcrhjpanm'
ClassName: 'wapvxhgvzjbuvhervulahsroxlpsmshuklvt' WindowName: 'kwgwvhclhhcytymnvxjutmzhtwpgzw'
ClassName: 'oxqxwsacvmoumnnalf' WindowName: 'hqdftbbuqxdhaxwjyoawrwhhpe'
ClassName: 'ytohkqlgopygxpqphpjhiegmsxd' WindowName: 'bffnzicjfyeaoptuyvtzkmddzfsxq'
ClassName: 'jfoyjxwxxtevtzdagk' WindowName: 'fphuvmwddlwniwmoullyiljsszvljvwzjm'
ClassName: 'tukmeblgflxmkkdhzepvwzorpxfexzwnmo' WindowName: 'ahrapwzwftamdqliypftxhaur'