Trojan.StartPage.59373

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsf2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsf2.tmp\System.dll
%TEMP%\nsf2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsf2.tmp\System.dll
%TEMP%\nsf2.tmp\Math.dll
%TEMP%\nsf2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ecgpipnnvzkxrrezyuyikzxleiqpirmxus' WindowName: 'zpxxzylbtqizozbfbdsbnocnnupeojryluxlfdz'
ClassName: 'hcogilijprcmeispzvm' WindowName: 'kdfldkigsrhynoksqpkddkvihkfapirchjpikub'
ClassName: 'jajpqdtkuealtzdklqrlzwcv' WindowName: 'kvtqcwbfsvoxgibumngfqsjsdmuakflol'
ClassName: 'wgvxuxpqqhzfygysazrlygsuqrfguyvtplsbq' WindowName: 'svkspqctgfaquitdgtgcgjia'
ClassName: 'dwaizvkqiyfodmsfhzaqfsayehcyekxvehvp' WindowName: 'oqegscawovkesbbatkdchvxcnisxhugjjtw'
ClassName: 'gpsipdscfqsjmquayplnk' WindowName: 'gsydvouppulzfbxdafukpcytxxapbdt'
ClassName: 'laburfywtwsqwckehlsvmylsnyekvs' WindowName: 'lynnpoadrgbocmfzteudbfdm'
ClassName: 'tvptdbrbholrkpkrtflrpsztxmluyisqidizcrc' WindowName: 'xltxubjhlarhgzt'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'qudoalpfeofeljyufwewvjsarnsdnagybobj' WindowName: 'aszcdxygunxjnbekroc'
ClassName: 'rgjgfjbevqiwtfrs' WindowName: 'qhibqmbpxpjihgwwevgemnzygyk'
ClassName: 'esbmomwwjupwckcwsb' WindowName: 'yojububwkhqflvbqauylnsau'
ClassName: 'zpojubsxfiiulnyewlgfebwjtbijidfslvd' WindowName: 'egugurvctvqmcwtusnjdrmtqkxfrbfwcohkotj'
ClassName: 'sovhhocabznbzyilwqhev' WindowName: 'xtshxndbaxylwmtqjxyqbtflrwesdzjvbpd'
ClassName: 'egfkuxwrkdeymbcembhlaka' WindowName: 'idcffhznmbycmmde'
ClassName: 'cvkzlspoqpblmdbidpspjnhq' WindowName: 'pwupkvlaxbpmdvzgrpbjilvenbqveolkfta'
ClassName: 'hectxjxqzpkamswjtxnibirholoamdyp' WindowName: 'wlmwvjkunbnwpwgqjdcm'
ClassName: 'erpapsijkabdkqhxjgrrthegenttdwlriaxk' WindowName: 'fihkgmpgpejmugsuhmbjujnlmxtp'
ClassName: 'pwlfjldqxufkafnuyrejaydnjkwriufbcthit' WindowName: 'hnnejsszxabccijvqqhnnrxwovdrmcf'
ClassName: 'obqawfkkjbpkccchsczg' WindowName: 'rgqxlzoplkroyuloedyryn'
ClassName: 'yopdbecryfllbwsmnwfqetm' WindowName: 'orxunmteuaqrgrpstnqlpwqbvdaoljdxkmdwk'
ClassName: 'pferiswksnsrgpvjuwtsddwyxegpnwk' WindowName: 'pkttpatnhhtouplsacjh'
ClassName: 'segmlsgmbyvtandimrtcllpluxdy' WindowName: 'okbvzlzxignurmjqziegcdy'
ClassName: 'avodxlmamdxlzhvvxeijmwgqjhx' WindowName: 'jralffgiehejfbtya'
ClassName: 'gdfugzeldugkmyagtinjukpvtqmhgrlugzufpqz' WindowName: 'emvyxwxuafqrgsdgywxuervbbfsg'
ClassName: 'swvlukihntgehrdtxdwfjhctwh' WindowName: 'muzciiyueannnheelnywjsvvg'
ClassName: 'usgbhhdrqatfsmqnsexd' WindowName: 'vazzygufxrnivfzhycijjvi'
ClassName: 'rzgoepevjzmidtuilz' WindowName: 'uwakwbfwdfafpejelrfyinxyzteypotyazdly'
ClassName: 'grpwznvmsuurknddkhzsisxht' WindowName: 'ecurnwnaocvqrogstnyfmqntn'
ClassName: 'yjrdzddytykkvajwjltby' WindowName: 'uixhtktnhvldomclfgsaqifmntyuksrseyckyoz'
ClassName: 'kqjdyexvzupadhwzxfkzlfhrfu' WindowName: 'jizshosgdhthpcljulvdjyybfdyz'
ClassName: 'jyqaikijravvrujhawgwnmydlagagyjwbxm' WindowName: 'jlpgqvwfyejstuyxbjep'
ClassName: 'yrhrivydnuodxvkqpdtmzhqfabiipwx' WindowName: 'utishhxyngszjjrzigruivgb'
ClassName: 'qowbvsjcapxjoeoygcmlmgixjqqmwsr' WindowName: 'vqdahafjztzelpqcz'
ClassName: 'lamglqnzozqfwvqeikl' WindowName: 'jcetimvjdlirkwqwzq'
ClassName: 'imdctyucgqhzimc' WindowName: 'clqljzmerlzpfzkkdgcsxujbafrikjpbcfdax'
ClassName: 'ltiqfpsfgaylkjngbcisgabgje' WindowName: 'vkhqvxqsjpirpefzezgpqtwlml'
ClassName: 'gsltrdjsepepbsbqxkjcjsmfpmadiautx' WindowName: 'dnfufvlelwdcivjukfbiotrfsruvzycpzgrkhu'
ClassName: 'cguuqdneymmyitqlukbxqxeittzivctlfbmtd' WindowName: 'kvytezxnpmjbxnwfeonziohulomoyffgizr'
ClassName: 'lxsmfskqaaxbwejdwkgfxhvimwixkfyknbvl' WindowName: 'zbepamahwuisxnvgwjvtspwbelmobndvx'
ClassName: 'xieywzwpkxksnysfccrortbipb' WindowName: 'ozowggmgjlngispawgnlv'
ClassName: 'uxkddjtplknapqld' WindowName: 'chpbzmhmcyhbdpgcsizmlthvrxqpsbzd'
ClassName: 'bvnzzmpnxgwjvxrjplcfqlxx' WindowName: 'rihdoxtbcdfhdiwtxmecdvq'
ClassName: 'njowlakagnghrgslghqwjsmpbcme' WindowName: 'daaejkhtzazzpkntpwrdspjyneedenkuyk'
ClassName: 'zjfuajubtmtrtuapakhbnyrkykissv' WindowName: 'skpawivrgfunsrhaeisklsrowcfwydguaw'
ClassName: 'dueohiwcqdnrxpqkpwzj' WindowName: 'pxofaucuybnaiqqolwqbvkabmkeolbpwwoh'
ClassName: 'gzkvgnbdccqydydofxwn' WindowName: 'tjcnoqclgmldrsykpis'
ClassName: 'udzfdzptksjguozzignudnuserzzwiridmchrqj' WindowName: 'oiccmirjspvwlsonwdkboptjpuofhsmstnxxax'
ClassName: 'eayybskowsifnquyc' WindowName: 'fdoupibylruyutnqhvysgo'
ClassName: 'dqumydakkrppihytlumbwmaajfk' WindowName: 'ntxhgkvkzbxppkkxkbnvmkfeuntbudh'
ClassName: 'sacfakysoevjxrnulutvgalbg' WindowName: 'dydlvvqxexdtjkznii'
ClassName: 'jmzqkzqjhdyotbkhzxdeewnmmsdfwdzbko' WindowName: 'wdvbufjajclkgzwnorechyxhylvuphaxernvu'
ClassName: 'waowlcbyslvjtpmdzyhtktnaqcjmpvyg' WindowName: 'azxglxpsafdouxcihzlnleldz'
ClassName: 'ywogqpbubdmvvfsedlugkyyuhivsvm' WindowName: 'dtxumhtccubnwqisacrzvqnxvhwvck'
ClassName: 'csevhllfqfqpjfmvoqkjjterbti' WindowName: 'oqiupiqgyifxtsubejacdqqujyxrpstfbhlc'
ClassName: 'jsqowjbddydjogzpltctzjzjuvrahqtpt' WindowName: 'wczdlccnmkehybqzxpgdusqd'
ClassName: 'wqvnjdbgvhblwdewiaktkbmkikhbzksaswmfgrz' WindowName: 'gamvtrsmetexxqysvntkbsaqntdzxgmte'
ClassName: 'vmcgotoeojotbdellxoxe' WindowName: 'ttxgrcsobpqpsyyasfughhcskgavpwijy'
ClassName: 'pohvimeikfebiwpuviifbspwwtkpgzjxaedgmel' WindowName: 'xpswjkmxrtktwvgnlvmweubqhbq'
ClassName: 'mainglcwejhpvzyrikvcga' WindowName: 'ldwectursprkitiw'
ClassName: 'gqrhdqseegpryzg' WindowName: 'zgvghgtzhsmdupxcrcvfxqm'
ClassName: 'apsgzabubyydswfhvvx' WindowName: 'mygcwaoyzedkwftxfheunxktxy'
ClassName: 'wklmbzrxyzivyimdfvqhcgbqopfpkj' WindowName: 'epxrxsiovenyccjypydynokpi'
ClassName: 'xjgalpsmrzfjwtc' WindowName: 'rgwuuplugnsvuqbrvlwkkvzallx'
ClassName: 'disxzyocequfrnktvhnsnwzsdcfpigsvpcgmaso' WindowName: 'ytjqkvhxcibatnaicxtcrkifdltpthdt'
ClassName: 'bbmpsyagnvwuvkeljtxjqyplsnr' WindowName: 'dvsnrksscosyactnpfgnxwl'