Trojan.StartPage.59170

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsh2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsh2.tmp\System.dll
%TEMP%\nsh2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsh2.tmp\System.dll
%TEMP%\nsh2.tmp\Math.dll
%TEMP%\nsh2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ejzdohlsqtgbhlxyxecbbu' WindowName: 'dlahgnglxxmflkqocaufxmcaobbpywvthn'
ClassName: 'mpeqhzvesbqgrrpzzkthlwovaxisgevwgoipxf' WindowName: 'zwyqbdisbrcpxlktsgtukuf'
ClassName: 'wgttxzhuawzykpfntgjfuspvycwkplxpdsm' WindowName: 'zwvotohtgnpurhvclcvvafvkfwuzgpe'
ClassName: 'pbnqlqfjktyqqpgdkflsrsagey' WindowName: 'pbtqtwvdbheggehcuxplsksgrhyrhdtnynanhz'
ClassName: 'tkweqdehalszqlddzlte' WindowName: 'elgseeqbzjzkvnj'
ClassName: 'jervkywximugwgqecappdqcdqnmoekrjjmsub' WindowName: 'unrzlfqdcyihoqhkefajtqs'
ClassName: 'tslxthmhiucjtktomwiuqqaxrnohesvxo' WindowName: 'xeebgldtjkuqteipcbtgbpx'
ClassName: 'ovltxzasfmkrucwyhznrcgjzdeayhbjjrupd' WindowName: 'zaqymsfrmlibjzknxrbgckiaaynstyhsrfud'
ClassName: 'hqylmxgxulooxskronmvyqsqkpaerhejiulij' WindowName: 'jeugzyyqlnulctmyngkjnk'
ClassName: 'ybtgdjsetiqwwbwqncbisrmenfnh' WindowName: 'pwwokhxdascwlufrjjbqmxevgsgyyaizzu'
ClassName: 'pvgxyxbyhzijyswshyzhqgywmftxtjyscykpt' WindowName: 'eeqmxqllivsifxz'
ClassName: 'euawqdfsyvfyvcgfcsppzwpydmbzhavurfvbphv' WindowName: 'suzycrzpnozyltacbygeklmastxgbxo'
ClassName: 'tfsdkpxnwjluijqrukldlglky' WindowName: 'qylomfifluzumsityffwigcgtr'
ClassName: 'bhdkrewhopfxqzh' WindowName: 'akcqntvgiyiifluckvfk'
ClassName: 'yohudrykdeuajxiafihxmtxlwkhqwharupos' WindowName: 'lneptlxgcsrvknrvvijamxzrrrcz'
ClassName: 'srnnyrwxbwpzjsvhbdpaluqxx' WindowName: 'kuctfhiwiyexwybkeyfydczmpbqfh'
ClassName: 'npvijwmgzfqehtdyr' WindowName: 'vxvcavimapkmiuakimzho'
ClassName: 'fyrhkrbkyxnuzuacvyqqviwf' WindowName: 'hshtnfdjwklkzwpd'
ClassName: 'gsbfpyzopirqtadutiya' WindowName: 'jbulucorxkfgmspkgykoqwy'
ClassName: 'cmkyypihgrmlpsaqhdoqnystxyidypa' WindowName: 'xofreetsccxlbunvvnaugodlothv'
ClassName: 'uihftxnjzxncrfykwpwxqdr' WindowName: 'rptgilvtflfjmkjxpfqdsi'
ClassName: 'fwgdcfxytitsnbuuyosqixvcfwtwjvwegfo' WindowName: 'sllyhnqjkxeljeuufdynmdrsjpl'
ClassName: 'ooeyqabbuiftnecuntqlhhcj' WindowName: 'ucgkxdgnauggmpfsxesspskxzsaqa'
ClassName: 'biiqfwzautteirrjgnkuyutjsomdtsbxazkadhj' WindowName: 'bjwpsopopcofazxnpmkdavgdipidedluver'
ClassName: 'kjcvxjdsgkedobqisaobqtbzstujpubyktz' WindowName: 'ebayahttbbsjmelbhjuyahccfq'
ClassName: 'hduquawhhlqzcfh' WindowName: 'iajmzglbgvbgbqerl'
ClassName: 'rcqddkwhpehochkbvpquemppygkgsqmwfzlrpms' WindowName: 'prnefkvkpfoenkpwhj'
ClassName: 'oljyvmjnhtfcpzskxqfrtkzlzphvrqercol' WindowName: 'ovuvsbcbqvohjoekuipyhwjbp'
ClassName: 'spiakcctxhrpdgcv' WindowName: 'ocaqrnhalysnpjvullws'
ClassName: 'hcvqxycymlrmzprvqvikp' WindowName: 'ezxgmmpldfwcqrqwkoud'
ClassName: 'fekxpbuuuwykgiuchveufbhjvvewvjmwkwu' WindowName: 'dnzpexcshdjzxanonpjuinpcpuqnx'
ClassName: 'viwlbvtzfbiosqcqmb' WindowName: 'ekysbeodqmygnnwkua'
ClassName: 'gjbimyoszvvinfaihhjgkwaaivnxnimma' WindowName: 'lqlxsalrigazkcyrluddvhxxzdqzfpt'
ClassName: 'lnddhikazyxvocznscxqjcwvwtxinfd' WindowName: 'zixirizsfmrcqnvmywspbrnzftudugfnlbnot'
ClassName: 'nsltuqzdcancdurgrqgakazaeicdqfzwwenmgne' WindowName: 'jsgfjbjmgvokmbfygqqpihlnw'
ClassName: 'opwqmffsejzmcnbnpsdxfjftgqj' WindowName: 'ipjeasmwmbnjemcrrrugeribjjysufcjw'
ClassName: 'uaauvchkdgskdtgsbhmqovtbgfp' WindowName: 'izuznldnvnihannlvqpmwnqvtkxktebvnjl'
ClassName: 'xnhuqpmtbogyzttqgytbxdwkjqkyebwfxzvf' WindowName: 'smxguzmqagzzlwoqsghx'
ClassName: 'nukneoydqotrgkygmbu' WindowName: 'poihlhpcydrffkgvlidkqbuniprcmb'
ClassName: 'kwjetbdwsabgoxynfsjdfuyfophkbpuxibjelyo' WindowName: 'hfisjrvaiovdcnrodpmxdcvfbgnbyaxwxzwiat'
ClassName: 'brjesuahjwiusvl' WindowName: 'arsilnytggdzfsjwfiejtwhymgbxiqvew'
ClassName: 'nloulfgxdinfljumrtwmduqboolgv' WindowName: 'pybwalstkdgfbdyerzidbxegyylxjav'
ClassName: 'djrlgcjfypdtqhuth' WindowName: 'axgrtdasqbfgohfxcwswyhcdrptoyewik'
ClassName: 'zxebntqurbzyagizqjjbgicxcmslp' WindowName: 'dkhhagkqexgjxqihzulqidwmplqq'
ClassName: 'qoeipettfqtabbbriaxktrqa' WindowName: 'qiuetwcqiqpfvyrtzbjhmayfdimwezoomxckoez'
ClassName: 'mvyodcrcxhewlceocbgvwmwcc' WindowName: 'nbeihhkkbfdknlcktisobt'
ClassName: 'crgkjnylxrpcvwo' WindowName: 'iryhddpfnwssbgmiefrboftszykpce'
ClassName: 'rybflavkeibudbr' WindowName: 'lcbmtsfierrwaqadezjfhuztzorl'
ClassName: 'scitduxtavobigsykapbwpghnqjlhwwaaanq' WindowName: 'xvmmnztabudskytqzigblepfmxb'
ClassName: 'xxeiyrpllpbjudaywcbulgcervaa' WindowName: 'ozufjjzsauppupxtepcjxqahmfwyzhfgwj'
ClassName: 'gxeuczazssnnatfehbmwnmaugrqwwkupzd' WindowName: 'zssuhiirksfwwxrnrqqkbhfvrzuhgqhvtcuzocj'
ClassName: 'lyyqyalnxzhejgtsunfigreyfmjvqobnpn' WindowName: 'xfhumuphsuieelbaljeaa'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'ajcixlgqtdkuojuj' WindowName: 'xdlkdunzsqbhbyhwpxmrm'
ClassName: 'tgyiilgcbuqdykchpefficswhlnc' WindowName: 'qlnewpaxuoapsemzgkebl'
ClassName: 'jdyshnikrzeidlssrigvaegn' WindowName: 'kfsyfntbsqfbumbnwilxpojjbvllkz'
ClassName: 'ummqifvsbewsnhcjaou' WindowName: 'citdoeovdszxglpwpblikdcl'
ClassName: 'ewsgulytohznggeqezhxlipsjfkqkjdfil' WindowName: 'ogcajoiqfhljaxbirgvwlpqpzakbkyhfcjorw'
ClassName: 'qkrywljmkxyeuamaryugqfzkgprwhzesd' WindowName: 'raiplrajgoadgqedzdtzhzyimieapoumegpro'
ClassName: 'edsbnpnoezydyoru' WindowName: 'ojhfpeqnoyshsybjiimotayfyl'
ClassName: 'nplgzhmxthwwlqfddxcgoisecfy' WindowName: 'novihucbxrarrqgjztnusntzlcglxdlpgfnltf'
ClassName: 'fbawfwjojsunzmencdvlmjo' WindowName: 'cuyeyaqttgexittxeosdhredcjgskrnpmll'