Trojan.StartPage.59386

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsi2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsi2.tmp\System.dll
%TEMP%\nsi2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsi2.tmp\System.dll
%TEMP%\nsi2.tmp\Math.dll
%TEMP%\nsi2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'yagpegftteuqsnyevhl' WindowName: 'xkzandzbpkxcagd'
ClassName: 'qdkidpggwzniwrtpyrpwuskbady' WindowName: 'cxsehyzetqifnqjqvalvsgbafey'
ClassName: 'dsvdoddhpdzdikoywifpaqm' WindowName: 'gcbqhxvyozzqkjmifblhn'
ClassName: 'zreeojeqtstzpbmwympbfuzlirxrnqvnpwqwz' WindowName: 'xsmidwqzpxioefmuzm'
ClassName: 'brclhqjglstcziogktcvlwpnwmunssdnlduujeg' WindowName: 'udzuhvvhyxpvakfyuyauwot'
ClassName: 'qwjmiyyukduxlpmucmfmsqw' WindowName: 'icjjxrlzovwprwuzngu'
ClassName: 'krmbusowvyzfcnyzsfw' WindowName: 'bryiumfeiauxkewqnxolfqgvmbxpf'
ClassName: 'iyqfwminagllnzgndlajze' WindowName: 'xbztmvfcvkskmxcrpeqykk'
ClassName: 'kmawxfsllojwqwzdcsqhxfdpxbfaybxmtvgnm' WindowName: 'mveoczdvodpzuqveezlmagzuefvejkpyrokdxg'
ClassName: 'iokewsnijrvvemaarktyidbwoxopbhstxvpwyi' WindowName: 'qwmmxepmrsbbyncehetjquvglnbcejle'
ClassName: 'pxjmlqsbzjrcsuilixtzvgoghclebuluydscvxl' WindowName: 'sscfhqqmdachvkkbrealticysxigzupo'
ClassName: 'akhmargrmjczhmyvkf' WindowName: 'xiclvaepnjzuntynhsry'
ClassName: 'ajvtpbbplosioeqtlhignmirpstwmvgmwnoz' WindowName: 'zpwpajdkyamgeyxnnunj'
ClassName: 'zfiznnakvjuqyxohuuqhuyzfzae' WindowName: 'vzujelzmkhtnucokguvcjikn'
ClassName: 'khzurubcqlmilexkwwdamojwcucdyswg' WindowName: 'ovccqbpmmajiopatgqd'
ClassName: 'zaphnbxdcznidyiwfjlwfzi' WindowName: 'uavuzuoqtgpqgon'
ClassName: 'dutodsstyhinycwbzmtaozhgdcmtwx' WindowName: 'xpvqlhnbdvywdjsvzvmsbedapjpuw'
ClassName: 'mwuvbiolebwpeqoyiur' WindowName: 'bmfvdaoyzcoywotkgrrtz'
ClassName: 'abardkwdahkkkpnr' WindowName: 'qnsmaavrdbbgfpbhffrxjszrkmqgix'
ClassName: 'vsvnumwpjfifbtqlkzstqujwdgzzcqjhs' WindowName: 'uvexcpwdwxifvfppcqmrlrmwkxtjrcutwinyjrm'
ClassName: 'wyabchiflqzujcrjkpikravnpsvlizwx' WindowName: 'stizcbpimjbozbrlkfiadbhiukgcgodkdq'
ClassName: 'siyugleclaosevdxacmlw' WindowName: 'lobqostxvjlgzkgkmfykcnvkymisrfcaxoprfhg'
ClassName: 'dwdjvddvuzmvzjqvqwuaqzmafhfqizgv' WindowName: 'kejmikmfajdcgtppzsqx'
ClassName: 'nkvmfshlroqeggibdvqfexuunmctac' WindowName: 'ydkaprzwgywusbslvkvbbfwkumuokct'
ClassName: 'dawsubmvnubsmweauayboblsa' WindowName: 'hwxcacwxedegmtwcdmtnilqalrw'
ClassName: 'wgfqrrekjqoiklnvqumsswvo' WindowName: 'kjorwoqpcfxgfvvvzbbikczarsc'
ClassName: 'wojmorvjujzxhifinghkjdc' WindowName: 'dtnwbtoicdoqboxupbvgshyzraruphtgbg'
ClassName: 'mbcvpnjbnhemytqdflxbygzsvkfckkjxgtqe' WindowName: 'psuecpcfzuycemetef'
ClassName: 'dbhyzdaqakysqcfajwjhvgkqryt' WindowName: 'bockvhiaojsjdcbyempwoidjpxymrqymnmpv'
ClassName: 'ugdstencczxhthwv' WindowName: 'zikhgjnsixgqdkuxcxdovudalektqcttvg'
ClassName: 'yglozspkmbyhesmuvghzqstcsxtzb' WindowName: 'tlswgggktbhjixfdjdxjebn'
ClassName: 'tkxvsyeucytjfbeqi' WindowName: 'lltrobzgxcklzpkrfxjeionwceozxgw'
ClassName: 'tqctsobikyicnslmbugx' WindowName: 'wlgaqwhzsaiqssfuy'
ClassName: 'jfgllzriktxmpdtzngj' WindowName: 'ftocycifrmeqxizbzacygxyyfmgusfvrwiegl'
ClassName: 'rxbfbwquphkpsjzdytyetycgwvxqwo' WindowName: 'zujawugyclvlrzfypvgkop'
ClassName: 'ovsgsxtmgeudcnbopqnsrjlsrzgqifxkfhc' WindowName: 'ucxjegluzkeclvoxtkbjhjltxuywj'
ClassName: 'aqzihtaxrfsehewxpupblxwfsrbvitghkeohev' WindowName: 'qszcjrtnjmekbsebkxblhjlox'
ClassName: 'pkugylmsgawaleobyxkmqhdsrdwr' WindowName: 'qyqwqhlqylpmnqsnsutlnofkuafzxpbcbteyqfj'
ClassName: 'pgzmpgvonypjgkmzizchnelwozzlpfpmmo' WindowName: 'iwwdlcrzmdbiqskqozng'
ClassName: 'mcaegbuaofsdncwdyngjsfx' WindowName: 'bbrqlvlhobcfzgklbknssrcrsnrjguj'
ClassName: 'zwppqbgvaesitbjkedwzuwsdxwlhfij' WindowName: 'ardxsihaqqiplwgrm'
ClassName: 'qyxrnmatpspdvcighvy' WindowName: 'qzwlbupkxgdmdqpqpntydzlk'
ClassName: 'ctryixaxyacccdlynkzou' WindowName: 'aupxjmwadckxfuvmjw'
ClassName: 'mttvjtojdllplyoitj' WindowName: 'cfflslwzhfyqrutbmwbigacpwztibqq'
ClassName: 'xamqtkjsntgdnnmhtgslwffl' WindowName: 'ilxbalbeyvaenvqkbnxojwuy'
ClassName: 'einrpfjbrvlzatk' WindowName: 'ajprkhzccvcnsdvmwy'
ClassName: 'vsxkkdbezyrrlufhpnpjasskikyjrkc' WindowName: 'vphrxjtgorkghwppj'
ClassName: 'dblsrdacresjgdwdmdeqd' WindowName: 'saxaicphhlilszztog'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'pocxcdawootxotdbgb' WindowName: 'hpajysdcmnwtxreycagarm'
ClassName: 'bukfvxkyxrxltbugsvbowsfqzxtxuyby' WindowName: 'rnshmuwsyypoqgaiijfaucben'
ClassName: 'zdifqylkgkjjbchlydohhbkhjduohymzq' WindowName: 'tnlfmelpkaeaxtakkwwtrwsjclfpzrkfpow'
ClassName: 'gnokzmesytuevjmugrqzpvbduqwbmylbtp' WindowName: 'qozizxmfyuhcflsugnqmvosxbhvrputpiymla'
ClassName: 'bzdrsktizsfwwnlilrvmvcsx' WindowName: 'eadgwnmsouulnvegkouwbpzmyacxt'
ClassName: 'pmgvvcalxnzlrlawetyzpui' WindowName: 'iorobhlpyvdfhcbmnlmoncgxzanjynkn'
ClassName: 'gqnybfmslfwsfctkfbndqcsrvlxfekkpu' WindowName: 'ecxrgdcxnavluaejfwuasizzghyyk'
ClassName: 'ggepvtvqqomoeqyxxygmegaocgrezoaungnt' WindowName: 'abackeelhzcmvghkvocek'
ClassName: 'yzphyppxgldscorkakwsaeqbkhzmgvbmsuzzrbd' WindowName: 'yebrafhvndpsyhjljbhqex'