Trojan.StartPage.59367

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsz2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsz2.tmp\System.dll
%TEMP%\nsz2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsz2.tmp\System.dll
%TEMP%\nsz2.tmp\Math.dll
%TEMP%\nsz2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'kbfyvmreayouofblrybhjkixqfnxqgnp' WindowName: 'eirhwsqqmacglapmxptbbaajh'
ClassName: 'waxjopzayqcezturtjgijextvkysfmfgk' WindowName: 'hkkimgasqffhsaskuxemnqtdzsfbjvcpcct'
ClassName: 'jjweecosbahmqjqtfmrtazeqvbcllulk' WindowName: 'mxyiszzfnboinovabfcz'
ClassName: 'akajwvwrhvycssqriwhkvzwexzsuxble' WindowName: 'mtbcnbhbkiqwowextzaxvvjptchbwywdupqsenh'
ClassName: 'bhotilxmwkrgorarbbfimayx' WindowName: 'rqvayeuxowuepjxcokzuwqmdpqo'
ClassName: 'biargscbqzdllltbkastjiblisgzd' WindowName: 'bbrcoqfwwuqersqufriscvgjjxyp'
ClassName: 'nkziwwwwgapxtuoxsh' WindowName: 'dpcjuelqdjedupvwuqudoxxgwbxtooxurxszgbf'
ClassName: 'dxlablfriycrpwfxedvewsyxfxlitzvdb' WindowName: 'fgajghskulwspvikokkqwukzmgluyawknvwyftk'
ClassName: 'pohraghsyyeebhrmffmcxpfmeeccromwavml' WindowName: 'gaypdmlkwwctfjnzwqhrexndnmf'
ClassName: 'nropmuwzdadadrozdhjand' WindowName: 'jqlzfjanuxmkooffrzmcmqnohpkxq'
ClassName: 'eoiewkpmffzbszuufd' WindowName: 'knmwngntfmhtjpqszxwojlbzwdgmbnrnhs'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'rxipavzfzunfiwzspowxwzfxnwi' WindowName: 'qozzgrjfrpjschoqlevwnw'
ClassName: 'clyzdsjmmkggftqlj' WindowName: 'cwchcllgomcvryih'
ClassName: 'fcjgbojysbfmieewiahpncwvaudsmvkl' WindowName: 'njplbroxldmtysctwhrnkcv'
ClassName: 'moiczkuhnichzvrapvqsmpqqspciiyyg' WindowName: 'szuofpijudqscnxgwqpbdnecbymzqhhqjxdmv'
ClassName: 'fyvovvbznfsmmwokgppyhzzsxsc' WindowName: 'jhfssabclajfnsstbzjppmlggy'
ClassName: 'cfwjrtomwflklrgzttviqnxjztxs' WindowName: 'lctrmiyrwwtmmbvgyrhtq'
ClassName: 'jukypxnvhozrelkzjmlkolznppsynpkoidkffek' WindowName: 'osfbncicoqocmkhzulpuf'
ClassName: 'uivonieodukjoggfyxybriiqhktaxry' WindowName: 'rbfnhdsiyplehgdbopllpkcjnzwvtjyfyo'
ClassName: 'ttthjjdqxwyvqei' WindowName: 'ipiibqfcdmmzsqpkefshoxyh'
ClassName: 'fyeupaxbnudarwcqtowtdnbjlwyaxfdxwus' WindowName: 'koiebtlydmbdeoqig'
ClassName: 'fjvgefjjgduqnaqszpdjekyeqdperckxh' WindowName: 'gjahruyjiyfnlxttafitdwqzuangfkdrvm'
ClassName: 'lciqsbceshpsdjtjbdrmykwwqbudrqc' WindowName: 'tqkrgnpelhsnimuxcpcvr'
ClassName: 'khoaabvunyjbrkrncetejkikf' WindowName: 'jeulhksrraewjbegj'
ClassName: 'chdiwcanpeopqjkbhzol' WindowName: 'yvymjjcutpfzdzlxfepuwlfzgayrtwibwmz'
ClassName: 'vjpklxoeegnrisljwuzl' WindowName: 'sfckhhpkufyejqcsctnztkgdiskrsarltfgd'
ClassName: 'vueroickhcmxqgiusqb' WindowName: 'zpocjtshrmupfnvrfnocjrksyi'
ClassName: 'gqjvgtqfxsqlapbvkpt' WindowName: 'dgrayccapdxnmhhztasnjtbrlbvjgkdodrbxaku'
ClassName: 'uyiajjyhyublbcuoryobhgstqfe' WindowName: 'cqpndkbcmealvracycujbuf'
ClassName: 'cgvtwoewayytyrqlhcvupphkj' WindowName: 'sakealmplknuzxdeci'
ClassName: 'tklqrvniuafxcsljhftte' WindowName: 'upggdmxrygtvuededg'
ClassName: 'huawfpbmkiqgjunzftkgzn' WindowName: 'krtbctugmbhycqtvkziospysywqlxvcyvx'
ClassName: 'jbrfpfxtunzjqikmiglqxktxcogxdwqgx' WindowName: 'ukuixbnyonnfrupzuxnvulcgpxbq'
ClassName: 'njiumhpemndwfnnzcg' WindowName: 'wmslhsnoylpbgowwpgqqnq'
ClassName: 'zbwqdymznuufcumyjenpjkpqkafd' WindowName: 'psnhnpqnsiixcdpfswxuaasyxhgeizh'
ClassName: 'upztxrjeklviesoltsvmxlcfj' WindowName: 'gbltuxvnykhncvcqmgadipgygmnfyztzppw'
ClassName: 'snrbybscbiryqbpgxivyfm' WindowName: 'cbjvxehdmwznljkklkuhjfhtwfawsoavgffng'
ClassName: 'bndrjnodbcdmnusvpikesxetuyliy' WindowName: 'uqoxglzjfsnrsawvtyqeprhdrysajkppmj'
ClassName: 'vjgcjumgwsemwua' WindowName: 'lnyiotawrbjcmwpb'
ClassName: 'foagbhgkvkceugkcllroxymknl' WindowName: 'weedvsbqtkwoxecvvfkl'
ClassName: 'mfrwicaawpcxfloaykepmrtkkpty' WindowName: 'jzjixsfnmyppsedjb'
ClassName: 'dtaoysiommxuwhfrilczxeudodrkljf' WindowName: 'upxbpvlivqvlbttywyomfcxmoclc'
ClassName: 'smsjaigmuxhljzbrvfy' WindowName: 'hnvjzwcnrbenjvfgcdejmefbqftee'
ClassName: 'dzszutejwxekhgoqmmgwrwpmzavu' WindowName: 'lqqulhuzuqejjhnaepnfg'
ClassName: 'gtkllsvwneczxjcstkuxghhxryvvvptinrd' WindowName: 'ojtxpwnyayiesaloqstmdiwsryridf'
ClassName: 'pbynyizqmzqugkfjorwjrqe' WindowName: 'tjdphpxluyvccwctozpzuwsbl'
ClassName: 'artkrhbfnjwykjor' WindowName: 'xrfarwgnxgotkmfmppunxsvkxltbn'
ClassName: 'zwmzohdckcqvxyjtlqssjzkypkiedqqvyhusc' WindowName: 'wcgljcvxhdchxyabaocpjjojhtgbjezcw'
ClassName: 'nffrvmfkbjemyobeuoudtzl' WindowName: 'ggkvykedbebeiejosikbdhqkzj'
ClassName: 'xxhvqkxczhxqvgxywwjzafn' WindowName: 'xhwgjrtlkdqgtlsznwcfejhuyqitopfrkiwxch'
ClassName: 'nfqseuzysjmdjnmj' WindowName: 'twoknnjucocplyxzoleyihuntf'
ClassName: 'cdrfcfofiwcrcasoqwhxajrehjygeim' WindowName: 'wikjfghvlalwkchvuhqdjviwpwmjih'
ClassName: 'vpnqldjpmijgiwjpezhmyehudmr' WindowName: 'jvjyalmnpfqieuvxybpvvbnucyybfeehexcplb'
ClassName: 'ydaqjndimlszllsyxelvjxblprjk' WindowName: 'alzgqobgksidqrghxot'
ClassName: 'rpasccnpsnonnhpz' WindowName: 'vosiffxelnqdsiwnlifhdak'
ClassName: 'fdkpawmxrrgwvjkevmitrf' WindowName: 'bjvsvwegohoilhkqrkiqyu'
ClassName: 'xzwpuuyqzsfedsgvjxopdxrccglabqrjdmcl' WindowName: 'dkwqdhzyvesfxlgruuvyqbplgpwiw'
ClassName: 'xtdvcyipoqkkplcfayepp' WindowName: 'soinqkpywcomyzrffntvimwkmtxpv'
ClassName: 'hrtgrkallabvriahwdxwuusmeeuhul' WindowName: 'gzwrwtjuadkcimpvbl'
ClassName: 'mrnckdiajcfivjutczqnhluqstckmprbsfgjie' WindowName: 'qqjgbhtfhatnkzto'
ClassName: 'qwnpzywqmmjiyzto' WindowName: 'xibkpjverihppelowpuamjsxowf'
ClassName: 'flpfwlptioocucrkiomf' WindowName: 'ioapdqkvqihqdkgissnqz'
ClassName: 'tmnjbonxxpgvsgtyrmhuytakcvcr' WindowName: 'cevovtdipejdaqeqyvkqtxea'
ClassName: 'oatwizpdakwttldkionjgttsxnwupsh' WindowName: 'dqoqhribzksxqfnf'
ClassName: 'tahzgzuyetkruqnpgqhcnqrwmj' WindowName: 'kzieqehgakrcvrwniasgt'
ClassName: 'sdkklyfntnlullfzdsbyz' WindowName: 'uiwxyunxzmtuosjidnkvcppeimcejgbvseaclt'
ClassName: 'vqkhdhnrhrqrrzhjamjoqvdzzsauutvdtyqrikp' WindowName: 'lowctywbsoecptaa'