Trojan.StartPage.58409

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsh2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsh2.tmp\System.dll
%TEMP%\nsh2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsh2.tmp\System.dll
%TEMP%\nsh2.tmp\Math.dll
%TEMP%\nsh2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'mxikvpqwmapessogkptynojfxnnlxzzvw' WindowName: 'bgfpfvmgdoifwdjtahwhdbbz'
ClassName: 'sqgszwmrkvtbhiblewx' WindowName: 'miyedafrmqccbouumd'
ClassName: 'ndzjwskxezctwycadoxbsxhytsykdazej' WindowName: 'nslaxdlzoostpofuzrddydgjfsxcv'
ClassName: 'nujvklbstptiobufvkom' WindowName: 'fterpfhaaikhraha'
ClassName: 'mwmfugjtbhusqepo' WindowName: 'qudlzpgekfmpqvhrdhidp'
ClassName: 'avzudkqosrcyabdgm' WindowName: 'omyiupzwhcbfyjfsaywpwedqgxtxuso'
ClassName: 'qjdvmoxqxwxmkgt' WindowName: 'wbozmpucuvjnrmfm'
ClassName: 'okzulhfnuuudlaogzacolz' WindowName: 'tskyanehqkhxfdcncjgboxfvi'
ClassName: 'zlbtfgvubiekvhrphztjrthbxmxna' WindowName: 'civfkiyuvermcvayjfbxfqiiowmlrhieehvnqj'
ClassName: 'wakimpmpvmtjgowwqofjycmccwnlzhu' WindowName: 'thnvzfplrygflxvi'
ClassName: 'gkplqvbssedwjgtrzwppltv' WindowName: 'eltpwpvnnkzknfwoxsk'
ClassName: 'qvtbjijhkqzjhlfliwpwzckxau' WindowName: 'hlaswzpfucfmgygxmosytwkrkgaa'
ClassName: 'sveulychdkikxvkstficjcjvrkeip' WindowName: 'nfinikvxqgikqwfbcltappzemsziskpsn'
ClassName: 'frdnhzfovomaigrfyedt' WindowName: 'bzljtfxvdurhtcdoabmkigrvpzmh'
ClassName: 'nmnkzjrnakchbbapfdeejwuipdrzeixqtzij' WindowName: 'jvtnjpafinnyfxinlgbhsy'
ClassName: 'qsfgflthojqilmwunipenlbfojdm' WindowName: 'ggoaqemqzsiexuqlwu'
ClassName: 'hborfhavdqzpdbecjufibsjijnaedk' WindowName: 'wdynovpwpcgfmokkxvsqs'
ClassName: 'nrpfabchuftnhwsmysuqejqson' WindowName: 'znfslxcctrrikcsksgpyibzynaoc'
ClassName: 'buiiutydlhzzmmhge' WindowName: 'egtzrbiohqqqmgumxdwrzjlwh'
ClassName: 'xnoexozmvholuazuztsjrftahnb' WindowName: 'igottpuqmfnjysowuyemgnrwvoiyayy'
ClassName: 'elszeqijhhodxlsthkhmmyokc' WindowName: 'ztemfzicbujgqewpjooujcbszrbidzih'
ClassName: 'dsotcluieerrvuamwcmzreulairjpgmgp' WindowName: 'einirldlensuvxjfxumcadpxqctxly'
ClassName: 'lfucsybygltvchscysedln' WindowName: 'aghganftqbuhnrjdtsara'
ClassName: 'kqahsoxxxqgzvycknnpfaanlar' WindowName: 'eeqmnxwswlblbkssg'
ClassName: 'oacoixmhkewmurlabwtmhqkcgdvii' WindowName: 'wkrywazapnvihogkfvfrdoe'
ClassName: 'qrzyljkekeuhilrtkcrobnasmm' WindowName: 'nsdooopwjweuxxgnxyeskxwzsfwk'
ClassName: 'ufidjwtabqmqfxahdfmliotjuumavjhepfj' WindowName: 'hxpumldkehqyrhnlcaoofjlndadzalygbgif'
ClassName: 'rqutoewnxxnlxknqpxb' WindowName: 'uaourpltljarevgwrlssfusjiurreomoddozg'
ClassName: 'opegjirazcjyqfeyctxscs' WindowName: 'wgzvhunvqhngkpbeqwisxypspvrkwuhss'
ClassName: 'iwoannvgnogbqsbetbhptauourlhvmkzhgt' WindowName: 'nenibkmztwyehajbpklcdctzfuttspuvwhqucf'
ClassName: 'qehtmnxkdnbrozyjsvk' WindowName: 'izzpviemvvnbunp'
ClassName: 'uhnrlagfjmkcmehgknmbdvzpjgesuyjvxsy' WindowName: 'iuoyaqunizbfcablgamumroedppwcbzbmbrir'
ClassName: 'ekqkmcwcyzlrzvknerrfdik' WindowName: 'xypbmvwqqlhqrjhgfhwkxnxalanqgg'
ClassName: 'xsmlddciucdpvxze' WindowName: 'cxvusumxzpxryuoguuygsj'
ClassName: 'pytuayghbgbdbpzlmxxzrqsxhi' WindowName: 'ydhxuqherhzwmlbjxwkhajrlbrrmassbgyzekq'
ClassName: 'irkvuwzzwkgnodfmzivscleyjfahvfgmvkmngqf' WindowName: 'iqzkqfcvxtbdcyqigtxmwvqvh'
ClassName: 'fagjaftkfsuyasai' WindowName: 'mlumrajuhmrailexupqijtyhgo'
ClassName: 'hkpemgcfbmcvaapcsdamcfgfxazwhf' WindowName: 'emkhhstmbjlydxequtuhkeiotihjwner'
ClassName: 'egenjtgdlzlwuvxyppptbvetgxratc' WindowName: 'ohpjzuimlxuzvdsckiehow'
ClassName: 'xqljlsornelndgheqdls' WindowName: 'wqoscdxqxlmudffiasgixmjsrhdkzwaehjfzj'
ClassName: 'nrsvbbahiylgmtebjsxkqglnovni' WindowName: 'gvspnzizgngeadaonm'
ClassName: 'conlbdbphxdgivkcendbueqyezgezy' WindowName: 'orttyrzjbjpowmvuji'
ClassName: 'apjjgfxnmkfcjzrhrmrirdwfpzgaqucutqyq' WindowName: 'zgrveswnosxiuhvomjushmfqanlmys'
ClassName: 'pwzpohxhumdixegmgbrojsj' WindowName: 'hqpapficazhhgexotdwxonahphvjhu'
ClassName: 'ysxtiadhrgcxigermvhbxzpihldlqbln' WindowName: 'ydltuvghkisvqdkmavdvlartmbdmbvbkda'
ClassName: 'wpbebrtthbohmwimcczwgpnvsb' WindowName: 'klidcmocdhdgtlvznzxui'
ClassName: 'hzooueeaobdnvmbphjylrylnxnaxdxxzypkqoc' WindowName: 'qwapxiibpqyhhdrnokjmdcdibikuooaure'
ClassName: 'bpednortmaoytphkjbrfdo' WindowName: 'zobymqwlvhpyrjospwgzcetgwwwqb'
ClassName: 'dfkvaivhpwrqgamkqfcizjzcyxd' WindowName: 'bjochzrvhlqazlndwuzclyj'
ClassName: 'zcuatqnnlotomozkctcylui' WindowName: 'ubmbngzoykroguoxol'
ClassName: 'lkuzltuxvdrggmupnlhctottdzdqzxhaarrynjv' WindowName: 'pasgkokbnhyanmdp'
ClassName: 'xkybyaxopyewxjkzxpliymyfv' WindowName: 'hvmofzeyrbmkyqdqftktcvllgrqfbdmy'
ClassName: 'nesbuyslqngajvkaruldcrwzo' WindowName: 'cuqkzgycaesfzhoywjwv'
ClassName: 'gpkivraqdlwlyuswwebhvttenzqttcjgo' WindowName: 'dfdxdqusrbfmtuahcvywjogtnn'
ClassName: 'mxnzaexqzsilvvua' WindowName: 'ixxaeoqeiwbnyspj'
ClassName: 'rcelsyqstnsgukxffwbqofil' WindowName: 'ssrpqjqutozdwdjzxmbfwvh'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'mcjmnvefatiyidhlja' WindowName: 'wzbalccqcecxyrjrwrdood'
ClassName: 'kdkuambkvxgfotemdgjwyrccohxerpiitnub' WindowName: 'nporsfumjrkfrfcjplohtjr'
ClassName: 'dipmxdwotxldlculkxalmtqrympwvju' WindowName: 'hwkyzjkaiitjhlwtyeukfhktchumui'
ClassName: 'aetxgaljwdmfdzynsxrbyrqhzosnfwsijbu' WindowName: 'nmqtmqsjpirpgjdmvfhcpgfxiguwzkesr'
ClassName: 'roqcwcvhiiqnnwesyucru' WindowName: 'licpmbrmbcscmuxtuvinqlbhnmyndi'
ClassName: 'fricnfgvoxjtgresjipj' WindowName: 'eqkmgprgzkkbddlcsyflapwbpctq'
ClassName: 'doakvvgmhhsmulfrldkdrten' WindowName: 'phijzuoufngfiovoqevlhtnnedtlatt'
ClassName: 'ikbvucbphgtaxsmgzcprdwsbmtddbdlpczp' WindowName: 'gegudaplofmlwfidrkffz'
ClassName: 'fehsqyqqiyyifddrlbsllxouligeqd' WindowName: 'klxmkyqywljtwtnbccehlbhhyfltbc'
ClassName: 'lveysieazikrutkgjhqycdsh' WindowName: 'twnmtuqksrvozmbnjdtxbtdfxtwllypcuz'