Trojan.StartPage.58621

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsj2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll
%TEMP%\nsj2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'vbfntscskanatasiijpruzyjccmgqrn' WindowName: 'tsdadxuytecdnbrgjzdcinog'
ClassName: 'oyczlrnqebeezqpbyhffsde' WindowName: 'bsbkwlqywziumdnfbqziyq'
ClassName: 'xzeydyiybqpsmpayekqwgiekgvgmquqq' WindowName: 'lkbsiofigsuupggkmlkcsqffzvoyxzicgno'
ClassName: 'jtbvkxrzvwfvunnfykmjlzufofdvappigbpi' WindowName: 'yrqduacwhhwcbeuugcqansuj'
ClassName: 'utykcnsjkhkwhxxtppodrszewi' WindowName: 'gwyweggiphrdiggcyqnsnw'
ClassName: 'borluuzatzcxpqpxfvibwbmsqycjnzjqdqsx' WindowName: 'poadvzuabayxtjmvcvbbqfoeaqwlhx'
ClassName: 'qntkatxxccluqaxqtzueuulzyieiumodwf' WindowName: 'fakgyyshvpgyrvl'
ClassName: 'zxkzafagqqjknonrm' WindowName: 'nfcgkvszovfuhgnjy'
ClassName: 'tluatnlorcjlktvezsikxfqnchecwzcdjif' WindowName: 'rzalurhhrbyyfch'
ClassName: 'yywowuaxyuseqdczbnjdll' WindowName: 'fawhjpzlgvxdoylh'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'sjsrapfoezrfbobjwkjkyehgadvuzsosk' WindowName: 'sphgowwbntzivrlhegueizdbnvjamifoavy'
ClassName: 'rwwhiugrqsfbgbltczfn' WindowName: 'igbunvzryqznqiicaxeaxtkmkvrdmpzsj'
ClassName: 'ujlpjvsdbgqiigx' WindowName: 'vcpjfcqbnyziqubsxfecrvtmzwvudycxahk'
ClassName: 'swuwcihudicyjbupimsxsmqp' WindowName: 'kovzmatrolteikmiguxwrh'
ClassName: 'ttjasbysorusuawntnwkqlhjsfyfrdifjpfvjbj' WindowName: 'khezftnyuaqswutotxiinvmdxlfixsufa'
ClassName: 'peisuoyhcpyqdkpcaxrfburnwfttzsjhcvtj' WindowName: 'bstbxidivepgbmlxhlcpadzgcrvj'
ClassName: 'fnwlozbelevcwoblxunycwqxer' WindowName: 'zbrdmyesmuffzlrghbrjczijddbzzbfzywsnpk'
ClassName: 'lmyihiajyzqbhnjojtggvujqsvpciwtc' WindowName: 'xuweewyqkbvuqcjzacheuhtlkaackddslwcsw'
ClassName: 'ovqbohwbtjdhoaqejkwoncixmcsdo' WindowName: 'htvhdkkqclfpzebjfkje'
ClassName: 'fkpjbwsoipkxmmffokskycexugeau' WindowName: 'ylhiatucottxntnwckicpq'
ClassName: 'zlmzefwwltxwkjjzpzznnwdnsvcgsjovxdgbe' WindowName: 'pxinjdplnrzxgrrhsqpkhtyfwgauz'
ClassName: 'edbmgipljivakfvckqgpzuoakyjyasvs' WindowName: 'dgfvjlebnftsmlpfgb'
ClassName: 'vkmjowuameumwrbdczxzztm' WindowName: 'zptvyvflhlpdcgrdkeybieyehglqmktmwvvlr'
ClassName: 'sobxmfvrkfcojekcd' WindowName: 'uogqxsnedtyucrzoerqhetmem'
ClassName: 'bhlsdvioemvwisdidp' WindowName: 'busclqlkbvakcwpybzmmkiihvgupwsvaebdvxvu'
ClassName: 'chgchlfftppbdqofkpohyevugkcezrxquboz' WindowName: 'prnhhvwvrsvennltkjgfyzxqsbitr'
ClassName: 'wtllfeztdhuispdtcfje' WindowName: 'ktuiqjmbvjifejyrdbxreoymdyovupx'
ClassName: 'vhkvwojelnzdgtiafjmyhpvuwuhgmnuamb' WindowName: 'hcbnzhjyzefwqrdunhahlqxdcvho'
ClassName: 'znesxrooswlqxaemvifnnbghyjceetfjy' WindowName: 'rtahzmdgtxqizyqbatf'
ClassName: 'qtwejqaoxmhbmcpgpqyiyantmwfvsqb' WindowName: 'ewbonksicvwsvemcq'
ClassName: 'ajmlkxpvwrolhzigt' WindowName: 'awtxivvbfoowxggcxsdbupan'
ClassName: 'zqvbavbaafcohzsjkrgmslsgnswqy' WindowName: 'pvfvbwgkiadmfgvrtwtzpeubwyluvqbq'
ClassName: 'whjnompaxzscdsgrmiorqxjpydtedlqpbecaj' WindowName: 'ewiiukekzhwrmvqquujvmjdwfashgjanhsltjvo'
ClassName: 'kkearoqrbgnvdgmasqrdnxfrrpsjmldknqt' WindowName: 'jzeqexwphquffwczkxtrclrdgiawpcdvgiv'
ClassName: 'kxftusjfrglzykbivpwfcmrxytkfcbhejz' WindowName: 'efapusnaueicukoidyxmpgvsyiyogparlmzd'
ClassName: 'sldmpmlspgttnnjtcnozemjnmqjjddd' WindowName: 'ybrolcufhnntewjnshhgueggkcrytrmsmdu'
ClassName: 'rczmgntmcmkcfquvxdmmwapqzkvkwmitwmulle' WindowName: 'biuvxmmvdgifqssttisiuquyek'
ClassName: 'fuoomgpnirfczxbliqxcugelidraby' WindowName: 'nxkgqcrifcnhoamkwze'
ClassName: 'sygxtybkufctnovpaydzfihze' WindowName: 'hocbufeklfujuwsm'
ClassName: 'vhknoqunvgixbcstdmybtjhneudf' WindowName: 'hsucogvqropzrxiohdtde'
ClassName: 'uxqbipkylhptljtgitoateecepqm' WindowName: 'sjqbzihlqcwdlsjjryzfaklhi'
ClassName: 'daidopyiauarynzkfvzdwsrywqpeeyignpqdyxs' WindowName: 'tmdqxepsbigkisznizsdkwp'
ClassName: 'uiupamqifhhaduhoabvyl' WindowName: 'hjlbpkfrenaskagqmm'
ClassName: 'nsvablpgaemmcdso' WindowName: 'vbrchglxxljfxkkodylmtxkljgb'
ClassName: 'adheqapwityvtvejapdfefrvmsgks' WindowName: 'xjkybeeahrddbfjxtepdarhqzckav'
ClassName: 'dovibnlkuwdgkpsvpecwdmoaggynklymbcxbdw' WindowName: 'ppeqvayhrkuzclrnmvhqoqcbauz'
ClassName: 'cehmpdqjkutgutrmdrefbqricgthnnskzyq' WindowName: 'nktqplhukrsccxwuogzmtmgfwpbrd'
ClassName: 'jitehujzwktsoughxurgrybkpbski' WindowName: 'tzirxpllnmzdpwvhnqtfais'
ClassName: 'wkvqigkuboafxyblv' WindowName: 'psvnckqelvktmvwffhsetfbdx'
ClassName: 'ypxdofltlhjgxtltrhjpcgppb' WindowName: 'biikzaosvrkogukowwyer'
ClassName: 'cvoukpaunrwaumcvuwsrvtnkurnusgi' WindowName: 'oeutdqfaihuirszmnisxzihub'
ClassName: 'kvvewjqojtqigktjzfrbjkdkkhkjzruasrdy' WindowName: 'gxttqhfmbldoipcjnvrvxfaazguybiudlbvecz'
ClassName: 'dihdajfalwmllhl' WindowName: 'reviixilihiokjearyfgadyrwmztlwtwfckzzvv'
ClassName: 'tupgjupojlbueomcbcyy' WindowName: 'mjzzjykaheiopbxvrvpvcbo'
ClassName: 'amweygngobmhhoxkgbjwfng' WindowName: 'fpfggahcqlfngqpxymcqcmadddlewske'
ClassName: 'qcfvzlgbwgxyljsjmmqmrhkvtjhwwhwtwwrwk' WindowName: 'qgjlhxacqwknbelzbpuoxelfklwtqsbixnienqh'
ClassName: 'pgzwawlraxsnedrcnuthddqatwzqbbcjzt' WindowName: 'fiuypdecufvhlnevrwiwkzzpffocbp'
ClassName: 'wbpynbmjirblnvrbsugjqpsmzsj' WindowName: 'yauzajshmskuapltqlggktvawtrswxkh'
ClassName: 'wkhnfaeeqbazydvl' WindowName: 'qahtohusvzprlawfzoloomg'
ClassName: 'zjddnxwbxcujtkkupjpb' WindowName: 'bknjnjtsxtjhktqkusvnfgvaufjjnbvyfxjbvx'
ClassName: 'xesqlhxlekmgviogbizpzap' WindowName: 'hntoxvhnzlpqcrifwhxmmfhaiikiyfxueqsl'
ClassName: 'erihijpbendyqvyyhecyafyiqoizbez' WindowName: 'uzspkpcnnmtoqevoeakbggdm'