Trojan.StartPage.59333

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsc2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\Math.dll
%TEMP%\nsc2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'agijvfexngwqhuaghtfvhspykkeyttwmeyuovyk' WindowName: 'cbuaymmatbpaongwxhanpxrjpnkwiman'
ClassName: 'gckvsellhluercdtuyjetcjtptyuzhu' WindowName: 'rvhmsknmwowcitkes'
ClassName: 'axpxtnzmdkspemqrykdnplb' WindowName: 'fqhrmirouqcwpginmacg'
ClassName: 'bexqhmooelzheaoqg' WindowName: 'mtgsfbfjnqvkybhbfwlqvdosujghnhvgkhlazq'
ClassName: 'mnarzhycuktrjuxhjvstrmcfwwexyjun' WindowName: 'dxhlluudtlhpuyhsmq'
ClassName: 'byefnfvfdghwhvitrqpmtjmrfi' WindowName: 'fxzgkeagtqbhkeyntgjilxyxtlimkazqdxprh'
ClassName: 'dzyvbxjgadandiy' WindowName: 'prcaqoterxtobnqpdomuhpw'
ClassName: 'zjmddziuphrlrzxstls' WindowName: 'uruyjbegqphfrhejwtmzmjxkp'
ClassName: 'voeptujdbqqqvjurutiefbnoiirogcqxfablz' WindowName: 'figugccahcssoaqdqiiwlbfnsr'
ClassName: 'erdavoukzigeivdhflscsugeql' WindowName: 'cllwvwgfchkggmnqnoktwkhodrckerloheae'
ClassName: 'hecearznagbahxkv' WindowName: 'zhsenvrhrmmbiqhwnkkkh'
ClassName: 'gznxnpldexutegabtecnhzcy' WindowName: 'wmvqbubbwpgsnsboohqcbrzzgimvsynmtdnyj'
ClassName: 'vslasxynrxgfgkjpafmmben' WindowName: 'kzwsymftrtfbbhvdcvojsipnyhbci'
ClassName: 'zdliislvssjyxrthgpofarwkxeosofso' WindowName: 'humtgfghlbmbgzgmaf'
ClassName: 'iutlmiqegseishrxv' WindowName: 'monafdqjsntibnuqchdc'
ClassName: 'ufphbmlncbbwlkogk' WindowName: 'nlrhconxvahkdcs'
ClassName: 'ezxjoijkvsomyqrqtvnklhupyrjrcqepgnfoyep' WindowName: 'hdvxhkbiyhfhndybspltznsltdxcilkschoud'
ClassName: 'ahxzwxkyikoefrjyypnprjgjyjazrjavxbznso' WindowName: 'raqqgkdviwkqmiouqoojthcp'
ClassName: 'eoyvacgacyxccetiyxudxcqprddyo' WindowName: 'zgqwkfkdztffwsxuzdfuskndneprw'
ClassName: 'ogrzwizzvoljxqagjajmtqqonuqd' WindowName: 'ntjbvwyeqmdcjgxaplfxnbf'
ClassName: 'mtvjitsgilgiitmbxnpzvonhcxiod' WindowName: 'tnxyxzuixqlrkunqv'
ClassName: 'nbntbymwvxpetjivxjcgswrofhgx' WindowName: 'lxuhtjtgncpxnbockxungf'
ClassName: 'ccdlzjresilqhcopvmakdvwnyfbdkldasgtro' WindowName: 'rqmwyvhqeqxijnmnepjdmpzksjrzu'
ClassName: 'aplqkbpjmfftzvasv' WindowName: 'zjrgfcfclhzaajo'
ClassName: 'esthlcofgzygijhpayfpvqoimtvcftowwag' WindowName: 'leadjbygaibpqxxyalrcr'
ClassName: 'djezjdfgquwnhaxdxalpqni' WindowName: 'obxobbpzfgchuvys'
ClassName: 'cswpkznutijxlfeigcqiimy' WindowName: 'rvbgocsisouzdrdewpfbnbqornprprmuwzr'
ClassName: 'wlgwrfxzwrnbmqmm' WindowName: 'cshkomrtbpijuvaktocekrziregsovusm'
ClassName: 'ahhqoimtnygqenkqdgpdmkwmeqvzcqasvk' WindowName: 'gogkhldelrumqgyxcxt'
ClassName: 'bgkfoyptoehxphsysnrqkhvugllcllppn' WindowName: 'dbttbinyhohcrrbpzl'
ClassName: 'acphmxnpdeqlohvkzw' WindowName: 'mzrhhvlgcseqakfnvsm'
ClassName: 'xhpqxcvwrofmrlxfv' WindowName: 'nlhoclmsxisjtoxibuewvkgdhirkg'
ClassName: 'dueglhlbxsakiadpjatqiooyuwyozydpimqma' WindowName: 'nesxfbpyriyauodbjcfknjobcivhxpnbaabbfko'
ClassName: 'uvyjhlchwbvkcueoanffkqjydfdcottxusu' WindowName: 'txojrvyamqfrmuibimqojie'
ClassName: 'oxboaejsneaetnsxpgtbhvsqsuwaatbyagg' WindowName: 'vhlzvngqwizaaud'
ClassName: 'fcjesfygrbzoossrsuysylwgjipxgf' WindowName: 'rdflbmsemhahtzzheejlcyfgkkybqxxw'
ClassName: 'dlnqpijfxptkpkctxjxmolzvabtgubjhnjl' WindowName: 'jakbxebgwwbvsjoq'
ClassName: 'ucjsfeeqhokporwywkpmufxhutuqitqjedtonfz' WindowName: 'hurphyeatwsufktefzcvqsfydpntk'
ClassName: 'skvocmvbwynmbqnt' WindowName: 'pxoxqxeeahwauecxtppxnttoqyilyiawso'
ClassName: 'vcqxkvfrrdtehjykvelamgocgedgvlmkwwddxqu' WindowName: 'toyebrwvjyagouvccyaztlfdnuuiclntyq'
ClassName: 'qqhzrqzrqshfzcyrvm' WindowName: 'gvycfspzakpnmknno'
ClassName: 'mqhxotwcfouluhatdcubqfhvqeyj' WindowName: 'luwhlloefcdrgvhyhihbgumlfxszyd'
ClassName: 'jeiqfcbesudgriyqydqjsjynfgsxkct' WindowName: 'ptpoembczjqpkxazcbawruafmxudsjyjr'
ClassName: 'cphhmempnhxmqpjatyxccgibgtcql' WindowName: 'gogiietqfcfgrfcubwyxalniusxbtm'
ClassName: 'adnmmsumhgjxyfnxfplqdqmtbpdcji' WindowName: 'gdkartwpokvzhkwomuall'
ClassName: 'yvvudejijgvyqnlk' WindowName: 'lfqnlveplslluapdcwhyuogvscapqtmxalqq'
ClassName: 'echvpkyhimrdygkrgxqbgghtgfv' WindowName: 'bkhplfzxobotwrtctwoqpqseqknmfdkxoxpoq'
ClassName: 'xbcipnnmbvwctjd' WindowName: 'nweibzhyyghvcdalqcfnxcdumujegdbkblywd'
ClassName: 'kjipweepznyzkzvhhxcqszj' WindowName: 'uqinimglqfzwatau'
ClassName: 'szfwsoukssnzvxrz' WindowName: 'ovvltxeanryupqhc'
ClassName: 'ttdtgpwxpvhqeogfmfromhxfpiqlowogx' WindowName: 'spvcayenqskzeapguuhlsbtjtgkzskweizjva'
ClassName: 'xkqdpyedjhdelhmcggybmwipxjmlav' WindowName: 'hmltqikdakeoawgzpm'
ClassName: 'wewektcedmqqwupnucqgdnskkkcvjveasj' WindowName: 'rgywniznkhhnofwcdbhsr'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'mzovedppkbvpwqe' WindowName: 'nzfowcdcbvolblcyxfhdvj'
ClassName: 'vbvninkkuorbzmyanwwjbmagoii' WindowName: 'ybxbhbqevujrqflbulxfydzinxhbexudendq'
ClassName: 'awhhuoqkipeymzmatlwxgbxigetphxt' WindowName: 'iyvxtdgggqltbfccwzknuzylqxjixg'
ClassName: 'xehembovofymlnrx' WindowName: 'vuofiqesssgygiakoriizr'
ClassName: 'wkhchmnzyjdkflotdlr' WindowName: 'rooxcgmklvfrddwlyhllzkhyzmmsm'
ClassName: 'fsipametkiyiiwidxbxpr' WindowName: 'hcutqbemyvkmczcxdxzcurwbsbmh'
ClassName: 'hcobnnosxpvsrddnvcisbwfwwazqjncww' WindowName: 'ycjvtjkgslmjycwthhztglfptuwmzhf'
ClassName: 'eearfafvhahsscjmkngbrhb' WindowName: 'aqisqqlscuzpcncygtmh'
ClassName: 'tpfdviowoltwsogehji' WindowName: 'yjkblvsyfhhldzgf'
ClassName: 'mqvwdgtvtyspnili' WindowName: 'jmcwehbpaghrradcvwcapldkwgifkptqrhl'