Trojan.StartPage.59356

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsh2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsh2.tmp\System.dll
%TEMP%\nsh2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsh2.tmp\System.dll
%TEMP%\nsh2.tmp\Math.dll
%TEMP%\nsh2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'vgvqhpfitoljbugdxlrcieinzxskhskqhyvztkj' WindowName: 'lsjpicecmckflgrvskazuioiurv'
ClassName: 'kdwkwqbtmvvyjqnwdgxzfd' WindowName: 'igeszardmecxwhknhvjlkfnoylkhv'
ClassName: 'wbespofrirogzyoeaazsrkcctqbisehycmrkp' WindowName: 'gpmysphjtsvryaoguwrcyxzqxqd'
ClassName: 'etqougodrcokktfjzojafhxvlygdkygscmz' WindowName: 'yqrxdmeubdgkuqrbklfhirnveetgtxvmbwvvn'
ClassName: 'xntsjsgjrvovvgtyn' WindowName: 'azsyfotpymgeqchcrruoxxokvphhvqdmko'
ClassName: 'yoxoxhsmpapftktolsdzursypamsclzg' WindowName: 'ffgtywdqatghxyetyzjmxawydrsu'
ClassName: 'pslsxcdgjeigvvezphtskvjtworh' WindowName: 'gcdjmrzbpbfyrdrpgruvnbjzfsihjzgqyznbnja'
ClassName: 'ejozdztqqsdrzjk' WindowName: 'mkhvwsfckcdkowgxmlvubsvynntd'
ClassName: 'qglvzqqtdkcwyae' WindowName: 'dpvrehtvsxkdvegxdsvpxx'
ClassName: 'hykmlnzpfkawdrxcbmuiojgrrpnra' WindowName: 'cyynpvzxhujssekkwshrlaeeziuyh'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'xvsbxzhaiuxmcvjaygnqeilweg' WindowName: 'ywvdomtybnyzztcwvtkzgyaspuxtf'
ClassName: 'fdxrbczotucxmrknfqsrqhjgkd' WindowName: 'vbdxeyokkdjjlfpjqzfvuru'
ClassName: 'rslrwregietftteovvwpoopgemlcwl' WindowName: 'gaaqgysgnctynhxazo'
ClassName: 'ebblgybqqymeddpapptzzssltbnnjlsxveq' WindowName: 'mtnzaghzsmgoqnnjvughvdkbmqtxhg'
ClassName: 'ooemgloissggpykgxgtmtpo' WindowName: 'jwuzkvkwtodaxyiugpobjcafhg'
ClassName: 'rhwqiewijprdqmzrigxzdttbuwakjvjopuai' WindowName: 'pqpzwmqdrnyyeubcrjv'
ClassName: 'lczjlwtrcxqtxzrgwyrpcogrjozwzyckrsc' WindowName: 'demozuowcctvgdctsmxnyxnuxytyzasqxrtej'
ClassName: 'easxfkgguecigbduunan' WindowName: 'calizbxtmkyiouittifizvsdpcawzpikwkhydi'
ClassName: 'bpkzfeqjcucfbptkamrcrlccehxndtjt' WindowName: 'otffqroupfpbygximtmvjr'
ClassName: 'aaoggevemyffjujpyqgjslkpucdnbphxbjaky' WindowName: 'emsqscpecmnfqpmiuzxrocwag'
ClassName: 'kmcfnrwpcaqyvqecjfaqwigiaounjkjaadismyl' WindowName: 'iucipdbshnkzcalfixkwxwwvvpljrfnnksrm'
ClassName: 'tuyryyfthkgfqyzmoyokbwsnlfydzpxs' WindowName: 'kmxwkpbdqlwpyhwccjthc'
ClassName: 'bxvbwzvzorxdfpfgktsiotdcoheatcsk' WindowName: 'txlcuxaviklnunelokzfalok'
ClassName: 'xrxtfrxihqfbavsmtgqukqrufzkrjx' WindowName: 'dgftomoydwmcicjgnhbpem'
ClassName: 'hrbaypcbqbhhvmaosxeucmeypeimwkhkubx' WindowName: 'otctcdynmvdnjpfkrvgqoxlwhmedrbmrrdkmvmp'
ClassName: 'jwrbjdsmwraafvhknwvodwrhzjawzlxzeulphzs' WindowName: 'mdbneqzvyrmifhyfnehbolzlinuoyywnbnfk'
ClassName: 'unbzkecaxjjyjfxt' WindowName: 'ldnpvqnmcguapibbduswupfdksombqbiwqxwv'
ClassName: 'yyumckbpfixargpnybvfokeon' WindowName: 'xogxlzhncpuhdggldmxmjuvfmbhxwo'
ClassName: 'rxmctrknoqgezwnlykmpaltad' WindowName: 'dlokyysvmbpdznfpsuajlyi'
ClassName: 'fcipkxpdjvlohjmurnhdsadjc' WindowName: 'ycsbshcgzvuhlhcqtk'
ClassName: 'sdctyknmkgvmskiqpgzislpc' WindowName: 'tuchcspeisvqzmusrqwgigglrjvrszvhonjj'
ClassName: 'qyzcavtjdpjphijxajlyndm' WindowName: 'tywhtxoohrslzihfgmarowiils'
ClassName: 'khktihzzodwodpxyfzqwglyezcyd' WindowName: 'cqajkdgfjkwmoqjbduaogyirsxbakzphn'
ClassName: 'lvzetulpsazdmbejsqoobiletpmmqbtcaanoda' WindowName: 'flymochjzwhbyvdluhlzysynwa'
ClassName: 'ftwhavvanydvympsnrocbpqre' WindowName: 'rbdxwdpiehvoupq'
ClassName: 'jhmjbxmipznwqtaxwxqhdbvcplutvvruclvby' WindowName: 'wyfcvpegnhtecwpwpfq'
ClassName: 'eejxsuhkeynskfypdsqtuf' WindowName: 'yhbimgjmwldihteicbfothybrdbp'
ClassName: 'ugndnhbpidxekxyuvtmnqob' WindowName: 'iychfixhtucwrccaldkscmjwedshlccol'
ClassName: 'epdvwhqtljznadtsvgmhbdpmojigzrliprg' WindowName: 'azjhdfzrefwzbsfytmza'
ClassName: 'fmejhuekiycggydjbqkuyl' WindowName: 'dvulsdvyvulfdcctdtsqgwgtrxpmhtiwyuc'
ClassName: 'jtuqbmzftdoxowygtruvpfmpxmmipmsussg' WindowName: 'tcrbdsvjehsaunnpjrmfqkswufmgdhkvjkgf'
ClassName: 'gtlkrrcuriwibrzgdizqpbbwnfgosw' WindowName: 'idjlarvfkochojhoaiodyizdsqkplxmgmfbn'
ClassName: 'bismuzsvaovgqrtmikziomyvp' WindowName: 'cbbndtljjlanvdgudncphhdgtgt'
ClassName: 'hjhzzknozjemdlhvcaldjfffdcbckbvq' WindowName: 'iandgnmvftkeohwkjgggwcpswshdyzdskzzcimc'
ClassName: 'wkukicxlzyyoiiibtigefogzpsvqaccyej' WindowName: 'lalkvrwzuhmaezvlguyiajjfrongqosxsqkyn'
ClassName: 'mgrqcbqrehoyojr' WindowName: 'kqlxkrvbimgjswrwbfppa'
ClassName: 'fluisrlubgxnayruykpanpltj' WindowName: 'stmwlsrtjkbcxetnssecpxydobrzmstvkum'
ClassName: 'ipixlczzwvjlqcqatvgxwkm' WindowName: 'tslqunuxdfucnashicqi'
ClassName: 'dxrohkylhuisqwq' WindowName: 'kjsibmzjeztzvtbbhwpv'
ClassName: 'ywcqkrxiexxugxlgoa' WindowName: 'jyhjrjztoqptewkecqitjx'
ClassName: 'kegztqixmtavxwurdu' WindowName: 'vsumcubqbjdmxfvgv'
ClassName: 'xttlrqciujfiongeetrrrpvgr' WindowName: 'innkcvylyinscdxelsbwoyzltn'
ClassName: 'pnaqglzrdshftjpazmdeydmismxxdxglng' WindowName: 'rnsxefcbfolopbrsdzuurldrjkluolleugdl'
ClassName: 'xtwrsmfllllvekbsufoefdtnvuzmwesqzd' WindowName: 'avtpmbhpcdcsyfstsdgwhkwnctjdabv'
ClassName: 'lfyyhbfiqmzhusa' WindowName: 'gzkdxvazxnulkwyesjmijewcxnglwvvkfd'
ClassName: 'etrujwqrsvokdzhsuuxbirninwerqikrkyeiepi' WindowName: 'ingwjwukiyoauhhunffifz'
ClassName: 'ujmvkmvcjgjscjeoxduvvh' WindowName: 'xellvgiifvlckyiysca'
ClassName: 'kmunuecnjtilqmkrbzfxjnagctejlkzdjebsisg' WindowName: 'eimwdyxzdqsxcgonyhgrzjziq'
ClassName: 'lcgytxpbxioknsdieohwxn' WindowName: 'mupedlqvzmsmepe'
ClassName: 'dgpivpodxpvgmqornjhwlcbfstigwdwczsj' WindowName: 'suptntnyjuwmcrixyrm'
ClassName: 'zytwkaqesbhbkqlcveyg' WindowName: 'aetehbvsnkbgdptoydszqfmxxjhkfmy'
ClassName: 'cpafbunwppudhpvjrmixbbyrn' WindowName: 'sphymowoglxctixuajgwkfou'
ClassName: 'tihwoyzbhyxhpkbuv' WindowName: 'nhibhoacomqiryoyiajmgngp'
ClassName: 'qqudnvxdkbhzrwtjwrau' WindowName: 'vgepyyklthxwabidzuyraqdnfegzsdsxla'