Trojan.StartPage.59427

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsw2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll
%TEMP%\nsw2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'bwzrzuvakxabfqstgnggj' WindowName: 'ljbfkrsvhumwybskxg'
ClassName: 'haeztsxhkvwxatjmxphlxueadjp' WindowName: 'tuqqbzwwnralcpohrruxdbvocdhpxqu'
ClassName: 'tcrivruouablzupcapjkmofbir' WindowName: 'umvhkzhdbqlezlgnh'
ClassName: 'fcacrguyxrwxfcmeinsjxvlspahw' WindowName: 'nkidxygjaixjngvxgcowmwvacovyyxtkodohoiv'
ClassName: 'vyjtqxzxmjyqfqpwrlggsti' WindowName: 'nowhoduztfenakgrybdwyfawqvlinmx'
ClassName: 'rebicjpgxgrtvimfwxdwxby' WindowName: 'qihwqrsaeumrpbufb'
ClassName: 'yitqvevwqlmrnfduxwsqzxcafomfkcpzhbrl' WindowName: 'gqbkphyodgkgxuqovgjmxinyddwnhpdkcfo'
ClassName: 'evkfspejqecsuqayondingwvzguhpomxqo' WindowName: 'eppxtebkpvoymegwjra'
ClassName: 'obwrjochbpcpgbrlfqhluzlrs' WindowName: 'fxmkvpjzmnpjutjkntcrfnnv'
ClassName: 'lukzexullsegsidebytwdegjforu' WindowName: 'yprnezgcpikurnvtljvvi'
ClassName: 'visqnyuliczrmfdyulcypbdvh' WindowName: 'ofkvmzvmnvpqxmuudd'
ClassName: 'cgwrhoupbrlvjggvsyyhvpcpggbx' WindowName: 'rdlcxchhstpsqfmbxgg'
ClassName: 'hcmppujpvdziwju' WindowName: 'vnbiqcckomdxhtrwymctljijxiu'
ClassName: 'uixcuygqsejftnrqrabcbqlncfu' WindowName: 'scqhnwzvibkyfqmgjjxgqfhvtky'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'uidkltpcntokgszt' WindowName: 'yoyscipulnavtiyflxgacc'
ClassName: 'uycfjnhviyldvppkkikdguurtfqxygsjyeqqlm' WindowName: 'orzkhrwxuizikbtggy'
ClassName: 'yoyrdsipfheqnnbellebyiqhzfavdydpw' WindowName: 'doahmtbnmmakbdrcfaxil'
ClassName: 'yptbciqizazmantjbhv' WindowName: 'nsowglyyhgbkpufigdjjuii'
ClassName: 'titjsapucpnhagbftrflxl' WindowName: 'uxjllzentdgklsqg'
ClassName: 'htwgyufwkveswzm' WindowName: 'ygoylsclzjuseqhhuzkozzhvubmnhvpfsdgc'
ClassName: 'svpfvlarhlsjpawmxqthslratzt' WindowName: 'fxlqfgsxkrvzvqssrihsdqyqghceqv'
ClassName: 'kfgbggcbjwcqmgaveaykgpknulohrwwx' WindowName: 'puyrfoyzhpvstdjijiwwjyfg'
ClassName: 'nbkjinanwnectfjeaaqpb' WindowName: 'hayusdristidhhrzp'
ClassName: 'dcdhyivwgbvupkxkoskyllagsyumkxdhxlaysho' WindowName: 'nezlbmxpeynacpfffzrjcgslhm'
ClassName: 'hzasmoquezatwbqsdztoegclfeqpenyheont' WindowName: 'ptvxrcdjlhdspdoxzmgygdvinjukelalb'
ClassName: 'qrikjxanxrmdhpdjrtgcryxtyxxpjnxdqbj' WindowName: 'suthjprysrswbuqlhkxrcjqvjoorpjapjstcgp'
ClassName: 'kgzukzutbyldgvjodgsctfrdzckzillfsqco' WindowName: 'sukyyxlqgadbqhzeigjbeugfaneedbvisib'
ClassName: 'nkdpsbuvvxmtygfsexffuqxehoguah' WindowName: 'kjiijfgimsiyndvarnecxkiv'
ClassName: 'idcauatihmxyeskf' WindowName: 'oxmfseqtnibmyfqvdnuagcuhhxifsfwswfnbnj'
ClassName: 'wfadskecbpuyelvpqava' WindowName: 'umzxutmktrruymdj'
ClassName: 'ytmrvidusxwsjdheicreglsymeburzywjuwgnc' WindowName: 'kqwufnblnbvgcdnhznrn'
ClassName: 'gxuatwrwffffwkwvubdxzcyupmyxcz' WindowName: 'jdtxjczwcmxldffhzxsgzuhhadf'
ClassName: 'xzhhsdtitkajceppyqkpliujtbesdtkokp' WindowName: 'eduuwuvzalktomprxasgvthi'
ClassName: 'ydbhvxmaemexfllvaaawtrvzrudw' WindowName: 'qhlzqgtwlucwcrfsduhvppoljlnrxryjtrpygfw'
ClassName: 'uebzgudqzvepelkpriaioycbqlqgamwgafqk' WindowName: 'xhjndpkjpsklydadsy'
ClassName: 'yszonwlbcaqszcvltputdz' WindowName: 'lwpkxfkdgwxxepuflsgbluavsiowhgtucikefch'
ClassName: 'zqyjnnzwcikdzbijsf' WindowName: 'bgyursuneiwkaxeeefljxgzylufeyymxiz'
ClassName: 'ctxkmmjmnkxwthrtikb' WindowName: 'kjqkfmnlzysfpzykbzxwlhzzuz'
ClassName: 'lewmjjctezpzuokf' WindowName: 'mcrjtttjizxhddkiwzwdyccolj'
ClassName: 'ikqyhfegwbquzthmldencrezvxmypgmclqcdis' WindowName: 'ckmrdzumfzzhsgrauwgekm'
ClassName: 'lgvogfdxiokrmyxksh' WindowName: 'bltjevqqxtofmqmgaepdztvqlwihyzipmrua'
ClassName: 'ngzncmpjmrojiprydwnyypnfnfuyvuyjumlu' WindowName: 'lkhvmbumiuzjagmleehtbge'
ClassName: 'dcitvvznrmuedcqfopdwgayfhqtnqiqpfsnxlt' WindowName: 'unfduahwhbtkdprkwafccislokfb'
ClassName: 'wqzmqgylrhkyfjyebadvtqhajgmzfpeydh' WindowName: 'anoyhmqmaayugqeknxtfyldcyxnuszyqfvn'
ClassName: 'hqwljedqbgnndagvai' WindowName: 'zekoldowxjrorwwiiirrr'
ClassName: 'epxdplscspdyzepaylffwuddzeinolwyk' WindowName: 'aitenzingmdcgjhszyutlaimthjkggd'
ClassName: 'bjubttqyyrpnfppypoillsczjuaiumoj' WindowName: 'mtgjqgntekrxikeihbuazahisxberyvawygfxxe'
ClassName: 'ewertggqnhoatczuivdrekaqmmacgfrxr' WindowName: 'kngnyexnjmiixos'
ClassName: 'emhghqmydbxtiyvsfym' WindowName: 'bbxllibzupomcemqaxmgfumgzurootvjhfpjln'
ClassName: 'ducirbkwiwukvbimpwjgfbfjsegiuxicufl' WindowName: 'dxgdmllcgclurqujbscjfwuinnkdg'
ClassName: 'tovtygwdfiwryzwns' WindowName: 'hdrqrlfijfvzqwkclwvn'
ClassName: 'txytnlkppolmzquwfxnkve' WindowName: 'yxnonguvjcwryeqkgttqlsbfxdufw'
ClassName: 'tapuhkiftqackjodoqkdwnymx' WindowName: 'gbdaavpmlzkorwirijfemmchmjgd'
ClassName: 'fuwxctmpcyuielllbwrgwlsargvoyafvkac' WindowName: 'dsjldhtibpatuvlvdpmoljnahvewobkbldcnt'
ClassName: 'dgoymmegnruolad' WindowName: 'exwdpjthnjmzimermgzvvnsncz'
ClassName: 'asgyuxpshgypgjjvzmdqseoqpd' WindowName: 'rwjqkhrenojmaybjhftmzsbhv'
ClassName: 'subwdwpquxqjuhd' WindowName: 'wqzvqeaihldwwbfwttuosmz'
ClassName: 'liqduxintcndalflfyhqhbtyaruzslokqxnh' WindowName: 'sdbadqgtddyfffnhbpxbsz'
ClassName: 'pdcdaupaujbspcjqoydqn' WindowName: 'miyheslljefjnrliqwwkxkodohws'