Trojan.StartPage.59154

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsq2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsq2.tmp\System.dll
%TEMP%\nsq2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsq2.tmp\System.dll
%TEMP%\nsq2.tmp\Math.dll
%TEMP%\nsq2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'dylouuasihqiuhbcgfzqsuuuyvoz' WindowName: 'jkajacbltkzrhmjgsqkrx'
ClassName: 'wotppttyyafzakpwymzymcjo' WindowName: 'pfqktforhjsrocsqxitwdusxnnpikuogfocw'
ClassName: 'kpkbboafnjqgysflsrpbnkvohcllba' WindowName: 'xkmkxhjimapoymjmdudkyxecdlkdupyfskq'
ClassName: 'aqilapaecfxnjruporpnh' WindowName: 'ncpewbtelawgrrxeix'
ClassName: 'orffcswtqneeghvlaiua' WindowName: 'zfyehiqzemlycaxhnxmrfalrgupscjksw'
ClassName: 'qnklbtmdskjwlpcxgantzhuvmmplsuidpzd' WindowName: 'tgboupvzoxfszhqkponuzjhrnvwlifl'
ClassName: 'fmvulnbyxuosooueuapjpzqjsnhnuazrjdxkbf' WindowName: 'hellfgcwpfaxmzikzvsuuqwbzebzzwzhiltb'
ClassName: 'anknogeuqbcrtsxkgvivtjgazqj' WindowName: 'tbqauwrgbbuucsd'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'ffchixnmbgwefcyfktrcpijuhpaqbqfkw' WindowName: 'ikdixhiwezetqgwxotavyeuxc'
ClassName: 'fgfnctlxjxopgpdmdcmwnfmtduhtg' WindowName: 'lniiafrbembyaziwqyzhwzdfepvyjldumlviwk'
ClassName: 'cgjabsaqhrsmdiwsgpkdvamxeicdvz' WindowName: 'jesttakcugifrcbutpuukjkazumoymuvecg'
ClassName: 'hwqtmfymfjulnhyhqeynznrggypxaln' WindowName: 'acrdmhmiketlmkptgeorzxzrgrkzpsdwwsx'
ClassName: 'ufwxmuumnxipoyhaxuqwzxeasvsegjszve' WindowName: 'rzxpzwzwjfmczchphfqbnidaxmi'
ClassName: 'bdwretkgcbfrgzlojoojeajgzfoh' WindowName: 'xasalictfrdbdpbryzcxioenl'
ClassName: 'ycjgjjjadunquwzqibjthelrqdwokuenqj' WindowName: 'bgfsbxwmvualjjkpqtgoptzcs'
ClassName: 'ymzfpemyoyaunoyoky' WindowName: 'yvpjqlmnzgsjjvfvlboirkqhngnnl'
ClassName: 'gbmkrhdptzvajocytvyyxznsoxbx' WindowName: 'wtrjrylgxrsswylugrei'
ClassName: 'isenixsiedmwoyoadeujl' WindowName: 'equqzrsbkljkxamtpwjnomwosybq'
ClassName: 'ydllikmlngbfarczjaynpfiwsu' WindowName: 'wchhnckhcntrlouwhtccbibbplfzzqznfofmjgl'
ClassName: 'ynyjrusqgaqbunfkazdl' WindowName: 'eykvljjrgmiyhsynhnvwdzxjpvesvyfjqfosa'
ClassName: 'dejatqypmqvibxfwtmelucdlupczek' WindowName: 'pxjbcwpinblzfuynzhnbmiilepfzarj'
ClassName: 'kwhqddtueyvzymrzeeltlwquk' WindowName: 'rgneavghzpqrxuqiromjnxvqghg'
ClassName: 'exgmrvoyfukpktjokncpvp' WindowName: 'jeqbzurivtwxybtfbhjeuscmctsxhigxjzhccc'
ClassName: 'aahnkswwpmqubujdrfutn' WindowName: 'ompqpuotlpmlmzknxbwypyejaxd'
ClassName: 'laekghxzmahlofbaxwkwrtqmdlpkxzkgzfrqjt' WindowName: 'qmaqymdarwzdrojvxbrnjwpicczjbxoedh'
ClassName: 'jxfddhtnttpubazmamepuoavcgeutios' WindowName: 'rjbzsiausuttbdxmftdzvbplysqmqdhumdgzliz'
ClassName: 'uqgoiztcmruuqgemqmddzrdtyjuzklovseapk' WindowName: 'grcyjnzfgwiataxxmgtv'
ClassName: 'pnyygtwjqhrxtqbsowagvpqsrgkxqpltuvjfu' WindowName: 'wfsayhlczvvdiyyinuuvimwcdvcphfzim'
ClassName: 'lbzrgxvveacnbarohkqvgle' WindowName: 'fkeardizkjodukrpxer'
ClassName: 'xtfabwnctpcctamwvogwno' WindowName: 'wfpviauinxsnugl'
ClassName: 'zxjrlkismqufaacasqlddtmsrc' WindowName: 'itbmikzrleqdzlivzzi'
ClassName: 'xowfdfgxlkqcqtrskildriiucnzzvjjn' WindowName: 'nnlcknpviurmtrucwyqdoolefepslzjnekpu'
ClassName: 'iuhsaoqjmbiqach' WindowName: 'tzixbvzdnmgqmjnisktbxypkghzstdczrwjxgad'
ClassName: 'mrrgkuhxyieloejgmsaimcxefxci' WindowName: 'dbngbcnnymiidjwoinoybucweaztricnrgedcqt'
ClassName: 'jkdrglxkbltvwfqdaalcecqqbvhytirnipvd' WindowName: 'wzjpgzfmbogwkzsjd'
ClassName: 'hszxctbzubictdlmpanakmrsgjgfrlojdcp' WindowName: 'iayuviegpinhmidbhsjgmgrafas'
ClassName: 'zedfmbwhkmzoydtbz' WindowName: 'vbjwkihvsywdpddapdmtnevnrsmasphctnd'
ClassName: 'xpmhmxlwhjlkgbyytdfuelzalsd' WindowName: 'gpsyvbgqnhtzsvnybodchdj'
ClassName: 'qerdmervhcblrklnmxkjtga' WindowName: 'cuovghlrgucvsidokprymgd'
ClassName: 'vhrgzocwekbzxhrmugzkxlalklijfnqqptzcb' WindowName: 'zlrwckjexjpvmwllkojfp'
ClassName: 'qtcfeildewpqqhcabsyjuewcj' WindowName: 'kzwoiboighvgkyqnhat'
ClassName: 'ahwctbjoatxkvpqfajhueiugxdahqge' WindowName: 'tfkfddcsdqvdheqdsrgjacv'
ClassName: 'hmaojrultbwiojgzmyjxwwetpvkbirbe' WindowName: 'yknyukgawoonxulxrlnjevnvuzqv'
ClassName: 'buhombmvjsuznslosoxhwcblqb' WindowName: 'qveeamswumoigvppkqgihkhdiiypfqlknajeeuz'
ClassName: 'qhckmolxwcyzgybmuqqwgetgxtglflzdebfch' WindowName: 'pzcgfxopzjebqonomqgbyyacrmbdydvr'
ClassName: 'oqbzaqhzezxiixqajdmeoofdqq' WindowName: 'tybqwzykfxzxrxjrzyevbonjuiqisf'
ClassName: 'sxuduhezmgobnlyxnczanywliwrl' WindowName: 'btotalzvzecfhhlhaaggruxzsokquq'
ClassName: 'crnqyanyqljfdmaacyqxxspkwmyclfye' WindowName: 'iefzhkqkfeffvfesncxxcjldnecnfybw'
ClassName: 'borpoddjplrbwlkoahowcm' WindowName: 'yutbuuzyjctzyaffckqizrylrvtvmjsi'
ClassName: 'pgrfgcjwuwkajeirbhdqitjnho' WindowName: 'tuyxdqlbljbumbxobdean'
ClassName: 'fohcthfmrsgixvssfhin' WindowName: 'nxaprqbrevuhvhdxhkgtxfhrykp'
ClassName: 'gedhoivrdvewvslzwqqwnhrghxplrczf' WindowName: 'lyakflgfkcprgnlevlhg'
ClassName: 'ytsghcufdecmprtkrycixdhfruewkp' WindowName: 'oqnrgmxlcmsmeopktgcp'
ClassName: 'asmfmsagmfmkqratihuw' WindowName: 'ovcsjirklxilxqibrdtmkcdhpgq'
ClassName: 'csbrqtqnswvetosdofijraecudvmbhqbgvyij' WindowName: 'mmghosgbnotufdjxhfllewvspyb'
ClassName: 'rgfyhulvhtqvaatgwhazqzobcxuwdalc' WindowName: 'chmegwshfnivbuozlxgnxscjcprkcetavq'
ClassName: 'ykbyrbufqnznmcovyysiyggfnpfomdai' WindowName: 'xlwnlfomxghidtwoacwcsmagnslar'
ClassName: 'pqbarfxjsunvmkzmdr' WindowName: 'tllbuevonesehqfqyijc'
ClassName: 'dinnyusbuzkbrlexrhxvuftckbgqr' WindowName: 'zjfltbfddecmkuxkuaaulckciezrzrab'
ClassName: 'hsmczmylwyfrvlpxviarblixg' WindowName: 'cwhvesfwngsgyqdf'
ClassName: 'pqnndizjfycqepplbycvpyuazeiujyuh' WindowName: 'xagmsynwieehbfmbtpwf'
ClassName: 'qzpvbfzypdknknolkvsdutppqq' WindowName: 'irsvcpwkhhyuajyslkixazz'