Trojan.StartPage.59341

Техническая информация

Вредоносные функции:

Ищет следующие окна с целью

обхода различных антивирусов:

ClassName: 'oczamfxfwmzhsduybtyznavpaivpucx' WindowName: 'rdlvikrdnuqlzgsq'

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsy2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsy2.tmp\System.dll
%TEMP%\nsy2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsy2.tmp\System.dll
%TEMP%\nsy2.tmp\Math.dll
%TEMP%\nsy2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'nkgwqkirsmhqpeooophuq' WindowName: 'ezawtmvgyhtbtrfftsacjfmw'
ClassName: 'mnlmcfjstoetmvnpuwme' WindowName: 'asriqupdousdelfioi'
ClassName: 'tdvkwcbzbkjsdnv' WindowName: 'kiaroakaujdvbluxhjisxyzjlomtlxjzrbb'
ClassName: 'gniutvmcixrsstiqrgpssxjmzyfy' WindowName: 'xzmjweazylcqiicnqmfndeobjaosqcbrcrx'
ClassName: 'waatutsqrecuwxtgtlbvmxjl' WindowName: 'zuczvpntvwicwgrqfdfrdtkqfw'
ClassName: 'aevkkpjcykeqpvjzomxodltimswtcqukoateynm' WindowName: 'ntzcejemqzhjziwmgnipldefyfokv'
ClassName: 'wzolnlbjotmritherkspyo' WindowName: 'vixtzdrkmskljnevvatjzizkpxilqwajp'
ClassName: 'oabiwfijwjxikghxawplfvlmvq' WindowName: 'nctzvlodzktfxrbwkjzrlnpboetwqtgxzonpjj'
ClassName: 'zdoinigzpssuixfdunjjcmihrx' WindowName: 'wnxwvwigieaafzqzypsxqr'
ClassName: 'tqbrxgdlpxoeblmmnvyvpuxmvcypbpkhhdaow' WindowName: 'icchzjkomfiweyzyaxcvjnawqscqxgadkvvjso'
ClassName: 'kkrbltblqnkylqzcqhixpvzhaiuicotshxblvzf' WindowName: 'xzesrlupltebvjxeiurft'
ClassName: 'zbxbgjvzxjhdoezjbzpdwdagfjqzkthrebhdqad' WindowName: 'uzplgyjuwfghgqdrtjklnzgxsurptcmfhtri'
ClassName: 'splykhlvkqadlpkqswtm' WindowName: 'fspvrrxciqhamtmojnycv'
ClassName: 'fvctbzqlumdgdeogetxax' WindowName: 'xlsrxckxxognmwrfyyyiogbedddcfjrfoml'
ClassName: 'zwjfztvdhtezzwkmfpfdubpvoex' WindowName: 'kcvubahusvqbhjygyezuxiutghd'
ClassName: 'sqirtuwpmyvyfgslsyrmgpmua' WindowName: 'rhiyqbzzhxkqoqlpal'
ClassName: 'swxjlowhmfnsyartoabtsqhgbjvtgtazey' WindowName: 'ircywagbwzgbsscrdzqvozmopu'
ClassName: 'dspiejpqeolrmiaybwtfbfqxxqq' WindowName: 'oysfqovvbgmplcpinfnsmm'
ClassName: 'bjoigeltkmpzyxzdnlfyarqgpumyaaemciung' WindowName: 'vawwoslqonozglpebmpdezxa'
ClassName: 'yrtomhrzxvdgmhhmjnkmgzoythgaiwxamlvdiz' WindowName: 'jpyanlpcdaortdbiy'
ClassName: 'tjeasdtnvrnroevzmifmtkmjpxux' WindowName: 'ardbsyeegvdngoatytafcbkdpndbvnyxlorjsc'
ClassName: 'gbwiirmiitbgsvbsqjmpcnpcjtyqceggtkee' WindowName: 'mlsvwaiokktceesduehpoferkfagzrfcsuota'
ClassName: 'jodwyjotgyfhruq' WindowName: 'fiqbojgkiegrtilxzvzdjziptbfsnmspqsdlo'
ClassName: 'cbouxhrviozxrvlzkrgdxqwfbopck' WindowName: 'cewmghcbjtdxsdsupvfypltbqx'
ClassName: 'czysbzjxqlumeuoygrtgoljositxqzfeywtxylq' WindowName: 'uwtrkykbhunsvolfzexb'
ClassName: 'yulbnschovumwhew' WindowName: 'mivjrfrjqktrneoygnxwtsudttveenpsq'
ClassName: 'ggvliflgkqozlkmjaenrpdmpran' WindowName: 'knobunluzlwvgpsixnudnqk'
ClassName: 'ztpxklfhdnpdyfujkireotwqnlfptlbwfauxld' WindowName: 'eupdcgavybyxmnblywofqneallvabxtvjns'
ClassName: 'xjyqtocvbqeznvdeymbvazjleyvfcpe' WindowName: 'fpclmwlvucuwllljd'
ClassName: 'yayonsgfhyawbycbsjgstqbvei' WindowName: 'wcbbwnalynhgvytjjwcwhpyowgqnssfloel'
ClassName: 'nvqecfyghuzlvoszyviyahrwm' WindowName: 'pxxixyjxtewtvbyxwdzdvpvkb'
ClassName: 'mbwrhdndbyqytffchpbbm' WindowName: 'mqbqzkfxbwulixzabikumjovcdesmceu'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'lyyhnetbsmqrnadzhiijrkihhsfjsqmi' WindowName: 'ogmumurqqztqpslgflltonqvraureovcxj'
ClassName: 'vlmvivxawsymuedvzduwkuaqgbqci' WindowName: 'mcbilvfpwsmalhmytejqxlskpjdyuhqcjasiw'
ClassName: 'axyireyjnumahbhwzshajombvazj' WindowName: 'vvbqmxknaqlgxntpxzrmmh'
ClassName: 'geadrpyecjgkogrj' WindowName: 'cvmcdcpuitaabcrtw'
ClassName: 'hwkpqtepjybglmshxmrlnnqd' WindowName: 'rrtohngxdlkjdabbnrqnoxspad'
ClassName: 'grvhmuyifxxgfeqvwmqknklphxztec' WindowName: 'mudsenainbarjdzomdmjxmbpbws'
ClassName: 'iqrqygxxkojjtfgzdpqftdlfyqicffz' WindowName: 'xqqaohxpfmgksedzsrnwyzywtqojhgmjqdsmpvh'
ClassName: 'cbfedppzasqqlbvklyfghksm' WindowName: 'dmvacoqlhzkdtkpkkhblbkdfav'
ClassName: 'twaxdlxibntugfcfjio' WindowName: 'qbyhhtjndwiekkgowcqndyvkfvgpnigwcpoode'
ClassName: 'jcxbtmmwbxaqtwuriipvbdqortllxrayozipyz' WindowName: 'fcavhpdohvkcjdeua'
ClassName: 'ynfvudsadhfbbjeimubvzi' WindowName: 'kyndvqxeebaobyuseiaqrnaomfhs'
ClassName: 'cnpsmeyfgjqpusnxssznqbhkrnsm' WindowName: 'dcjeeeovfnbylozr'
ClassName: 'zuainpihknemdkpwgnszknbnankmfvasdit' WindowName: 'lmpeekejgjulwfnnmawsgxvrpiemdwok'
ClassName: 'oaykmjnuflmxbufiplzpmadriadtvzzejciqhtb' WindowName: 'ocrvmjoruarinrwx'
ClassName: 'bywauzpizhcqflvzkhhjkbaflgyweqxwlb' WindowName: 'ramzvhuhlffrvijakibl'
ClassName: 'jzkdzjhmuqgzfclecgluiibrbhkjwjrxkibpvfd' WindowName: 'acrowjvynajdsouhtcaujegdpwa'
ClassName: 'xjyhrvugynrnkptvxcliauyuck' WindowName: 'wuyqbhvnooobwxmxqvhrysacmnnwtgby'
ClassName: 'ecybwdlygpxdejdqualtwnwne' WindowName: 'ycclhwfbecnwsifafeelbnoylxllvc'
ClassName: 'oglvtdgytgjfhzhbptapscaispovfj' WindowName: 'puksmcnoxtxdnvsqiwroaacqcupqs'
ClassName: 'vmpafimwxbpnrkduakoshjsml' WindowName: 'xbxeioafwtlvfixcpgvsuffeutzjakr'
ClassName: 'bvwllkladhmyqdexyu' WindowName: 'lyyibzbxajdnaccf'
ClassName: 'uwtecmozwdnbmpubiwgkyicgncpasuufooqcpv' WindowName: 'sxljwfasvslapafdmdtbmeiirfvcnfcrfrvq'
ClassName: 'toctmmkkobernuodj' WindowName: 'lvctjnlbqutujhhoqhkfljphcjrenwjrkt'
ClassName: 'qgzkdhssxtorqsrsmxikvxyrgrlwzhd' WindowName: 'igxdburtrsevtiqhfyw'
ClassName: 'vjnoakjzwtbjuyyewqoqyw' WindowName: 'cdhrmjwdjzeqntohozslauoel'
ClassName: 'dudonmedcqewrftr' WindowName: 'lecwskisillxgazax'
ClassName: 'xmguldgecwdstgxagcjmtzyhrdvqnfuzknqzte' WindowName: 'rkovmmvnodltmxvwdjmwo'
ClassName: 'dytluxnhqjtanlvuuqc' WindowName: 'isqbtkyemgyxbvdmmnirgpyhgcekerwuibq'
ClassName: 'eubxmlljpafuktsihupdzfy' WindowName: 'onpvvpdefkljrjbzjavbrrlqeqynrqyrwmhmr'
ClassName: 'vgsiihpbrxuxbokezzyehgraapktkjiwlemg' WindowName: 'lpwjkbaksonoeyw'
ClassName: 'bimglwlijtixytlexgvde' WindowName: 'flgsjpalzkzsmmpgwtmcdyhet'
ClassName: 'pvfjqimspjchwtwyketdhrrwgbzyizp' WindowName: 'kymgbrqrtoirtunqzrmhrmobw'