Trojan.StartPage.59370

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsb2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsb2.tmp\System.dll
%TEMP%\nsb2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsb2.tmp\System.dll
%TEMP%\nsb2.tmp\Math.dll
%TEMP%\nsb2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'vqbtgcczhywjqjfxz' WindowName: 'mnwokglgxgsbvuajwrmmdwooi'
ClassName: 'zbmqesmqzthirjfhygtostznwtsjkd' WindowName: 'motyomwhrgyloanfbbkjoqtkmjewlynuavurci'
ClassName: 'iuxboltxngwdzztgyuzdhlsdqygbhfheou' WindowName: 'dsxtqbpgzgkvwpwcogfxkfmqcsfhwjkkmgnc'
ClassName: 'buktajtvfwxyousopvfxqlihnuttfkonz' WindowName: 'xuuisxcseytlaoz'
ClassName: 'ikmnrekqachmxqrevqnkywbvkntmyykimyduzwn' WindowName: 'lbgnvhtvtqegwojxrejvudkgrx'
ClassName: 'lmrwnssgqzopafmukfkziutsyxbjqnvcfymapd' WindowName: 'ryntovpgzbapsppvz'
ClassName: 'revstgjzewqrpjptgth' WindowName: 'galfcyoskwuuruuokdlfbwuwnszx'
ClassName: 'lgwcddiwudpdckbpkhuw' WindowName: 'dljkyyrgjokpszikdb'
ClassName: 'kwdlqnmtauzidbuhzucnajdem' WindowName: 'gmlzkcwqrgkdoxvyzvlurtkebokcqzsjwuury'
ClassName: 'ziqekynwyrdeunsmsksklngwhnrdxhkxp' WindowName: 'nesgnjntmjtogymdietmfdxzgyrznbucmdlo'
ClassName: 'cdjfyclgshjawzijxzaofnjsrenxbqqkju' WindowName: 'pdjhkcpdgitmddmivourfmwzdi'
ClassName: 'wkviaqbsrozwnobfgckoqworpx' WindowName: 'yifqyojemuzeltqrinux'
ClassName: 'cpdfofctypreznwpvynyzzfbbkyrsbopmlsfoi' WindowName: 'bjceincxqtonscot'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'uqubgestyupddipeoroorgmyvjprmszy' WindowName: 'vcjdhvnrycbpptfxnpspipbytvpjbixy'
ClassName: 'dthbgqklxpybnoewctraawelgsvo' WindowName: 'vxsqfvxgtnpquqfjein'
ClassName: 'pjpfmlgivvpgmonmveupvatbczbyvamwliq' WindowName: 'covwepuyqkpbeubdtbyanzxbf'
ClassName: 'jxwjxepzvxwerfjkpexxnmh' WindowName: 'snehuehptqpxdtztvmohaewdgxhbnom'
ClassName: 'hkwzrbnbdtvhodivjxszxvlrpmwnm' WindowName: 'odztrhlemzhejungachujuiex'
ClassName: 'pscisddkeucrvyuem' WindowName: 'rdvymeohawfqjfhwsxfopdloghboxpvwdg'
ClassName: 'ulxpldlvytfpmrwtcpgxwbruweyffgiylkvqa' WindowName: 'kwbbjfxcbpbrqafgijcybvaectzy'
ClassName: 'wwvimryuofroklhzsuekdbvoyowfrncefnbzv' WindowName: 'mpmdctcszkuorrwntwoumi'
ClassName: 'smeupoqwycujzxahdvceqmsgirhukrtyddcu' WindowName: 'xrdwyzdoluplezjoupamodnzbffoenddz'
ClassName: 'tezoubkdhpilaheujjcpdpakgcx' WindowName: 'hjxjmbzgxkwnnyhutulwjexmjwsadble'
ClassName: 'yukwilmkrywmipeka' WindowName: 'cxgcylegmlwawobvxbojapdb'
ClassName: 'biqbmqadsbytqtcjjysneslomrjmgldzcwomli' WindowName: 'immlvmwywwhuxirdwgshpevhodgrnqlxcp'
ClassName: 'riqdksftlqfxxcqhu' WindowName: 'hqpmoxyzmepmbluwxuzvzkczgdafqkckmko'
ClassName: 'ddejpptvcjrzaudz' WindowName: 'ynpmyraboocprtoihpbihozgvjxldahcjwu'
ClassName: 'ekxjnggthuetjwytldn' WindowName: 'wgcajiosenfaeuzohj'
ClassName: 'ulttijxwoqsrnkhriujodjej' WindowName: 'faxapsuxrifsawufpx'
ClassName: 'iwizbsztinhkxpxnmytnarccaqlqgcvok' WindowName: 'mifshpeoewmgejxjr'
ClassName: 'eovwuxxbhloknhlyywlasrqmomo' WindowName: 'nnplmgooquzhbqyanfgjxjy'
ClassName: 'acujdjuolzbsiap' WindowName: 'zmgeaqvyzleuoerftpei'
ClassName: 'eerzzvrusdzfiqpsqcuhjihxet' WindowName: 'vaqejveruylclolhyokjwjefhcbzsiebv'
ClassName: 'jxchnywqswhorcicvxhqtjifbgsiqsmyhljuny' WindowName: 'tjjalxgxqwmtultfcwluzynibmbd'
ClassName: 'emzixdbxowqeoihxplngfgizyzjftbt' WindowName: 'poqxkvqvgueaamjzxxpgcuwypgua'
ClassName: 'flcemtuondzbxjceaqorhceusgpnujauckx' WindowName: 'cpxwcfapphkvulxyedybbqajpuuz'
ClassName: 'cxbofugofzmwgkucg' WindowName: 'mswgzvfxmwyenwtgrsmh'
ClassName: 'ceoeekfvcfshegncihkkqzndprpclwhorvscj' WindowName: 'rwncgkifrrtrsaedhffuftyq'
ClassName: 'wchoytixexcvultodhbkbowzicuyu' WindowName: 'aerquaxwpfoygywradealjogr'
ClassName: 'hngjkcpmkzaalxlcgigliklfhxeegxhhjeweqv' WindowName: 'vckptrrybgqgucog'
ClassName: 'rvatuyzvebqwhjosupvczwntyfnaauv' WindowName: 'gdiwnlazgqrzwcnmhizhilqnxtkpznhmdyu'
ClassName: 'suadcaczunldshdckskrss' WindowName: 'hgtvtuwzgreldkbwfyxzmitgwipaqpecwwbybac'
ClassName: 'xeahyftnycnvvbwxknsluoqqvkzl' WindowName: 'nencsuuljdwlhdvgu'
ClassName: 'grmrtbxeztlsacur' WindowName: 'hkyaendfwrpkrboqtxnmnxrjellwdxg'
ClassName: 'nnknjentnnlstmjichkgundddaptapjxci' WindowName: 'mlztrrcikyejugrytnliwqkbjspjeldlhzkige'
ClassName: 'ajnuupzopozzycjcozrzromhiwnnjv' WindowName: 'ytfwwuawdjhyxxhjbjuomphavriys'
ClassName: 'aaqntgpeujyfhdlesuxzitltagwnwzgmpeiuipy' WindowName: 'yptvbgtmqasgdfnjvhegipfrivinjgtwvppzxee'
ClassName: 'mmdtgkgtolhtlvggtqvphzqqtrsacfzxcorzd' WindowName: 'vifuwzaokmkktfpohnctdicnyutzak'
ClassName: 'yotifxtjsfeopmzkzjfghfvkdlkvjtv' WindowName: 'zvsgrgvhlgrvbpv'
ClassName: 'mrawgfkxsxdqtdftfwtuypfffqefnrptmmlg' WindowName: 'poxmvqsdeabdroxmboj'
ClassName: 'hmwykgbbrtytgcssxk' WindowName: 'jqjvetqyafrrxjvkhovgfmubnrxmgxwlwl'
ClassName: 'mqbkbhzulzvgmzhjqtmiocggnjmasac' WindowName: 'dwndqiwztvanbodoth'
ClassName: 'fzkrsbdzisfssetnldc' WindowName: 'ylobpqvlxdmmjhlweufhtcbcrsoaxnq'
ClassName: 'wbmauyaywqteibdnubqouzib' WindowName: 'waaraylekdkgflbbc'
ClassName: 'gnamrhpvxigmiandwltziivlwiasidzemascm' WindowName: 'koislofolojgwkpjfkdnktapyidkuyufs'
ClassName: 'qytesvxbjdwklcqdhqvsmquryaxqbd' WindowName: 'nuwdiyykqfigrrsk'
ClassName: 'gwmrmvarqqlbyrko' WindowName: 'yzmuwbagnqfuvdnogsywxmypmoh'
ClassName: 'tfnijtnreqensbiyatcda' WindowName: 'yhklvzcnybwutgdyduxcxig'
ClassName: 'fnsjelxirfdtytkxcfopccbjclxczb' WindowName: 'prfefxpdsvbczxrodqzoyajsghnoi'
ClassName: 'gnlbstumcpozazmzjfjuqgiovzgxxlx' WindowName: 'frswogbdtbgbgtnufsiauywybuphlmx'
ClassName: 'uujtcemwwrjitzhqkexapfzwplvlkwyobmapcu' WindowName: 'ikcxplvzqinkkmypywjetrdpdcka'
ClassName: 'lwxnbhbntvjxdqmclm' WindowName: 'taojdtitlqylndrorxbshtxpsqmh'
ClassName: 'pqebcjghbxjxhlajwmcbdtktbqqzczuppui' WindowName: 'lnrawoleguxzinquiqwdspggaenngpjumxcsj'
ClassName: 'eqrnzmldjbecxddanzjnuikqjxtfav' WindowName: 'vclfyishfizadmskfnvoakgyvcek'
ClassName: 'uabcndoosggfwgbdtdvgqljydspdvpzj' WindowName: 'zjiyeughwhshakllauctyuoeahwqrc'
ClassName: 'vvjxrqwfuujnrzhkancaysxdbhjsggqctzdl' WindowName: 'hxbeynrjvksfnpixfbvz'
ClassName: 'onfdthnrssmfbegmhekqaxbgopvs' WindowName: 'prvoxbolttimhoumxyrubmswyonrwktpn'
ClassName: 'yevjxabchyucuamu' WindowName: 'bivgvwvotckrlzosagpnhe'
ClassName: 'bjsywlcmvzntuhvbwgsd' WindowName: 'rlasvsbuoboeodkyqsmpzlzwaafzkl'
ClassName: 'unetxufqsenftqbbnfeqcgxubc' WindowName: 'ptnwbrzipogatmbrtzvkgz'
ClassName: 'vpvnzuwminatvdjojxmarnawudumtoqxivm' WindowName: 'gosqaohsyqxmwuma'