Trojan.StartPage.59363

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsp2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsp2.tmp\System.dll
%TEMP%\nsp2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsp2.tmp\System.dll
%TEMP%\nsp2.tmp\Math.dll
%TEMP%\nsp2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'jwshszwnojtfuegn' WindowName: 'ssybttqlqtgvfmztqhjhfeyhvspkwq'
ClassName: 'thodmjbxczxveixbiukyctdrstzniu' WindowName: 'gfutvlgaogtuqdnegeotwwbwvdusmpwudqhyprr'
ClassName: 'lrihgujmgwbhrmvhjujomiwveuo' WindowName: 'zbbuessxcdqpeedswdxzmhzmmqopgqwrtiaz'
ClassName: 'sanlldhhgavbcgt' WindowName: 'wxumwfxyadadhdqategmnfbgkc'
ClassName: 'rsaeahsgepycdyawxxawyseyajbtmzkte' WindowName: 'vslwvuzekgnbossto'
ClassName: 'vqopmvmdskppdxglgnrrmmpbeg' WindowName: 'jxvqwpnsduuojytqcbuhgoogdjzjy'
ClassName: 'qudevakweflyfguburvvbnnnphk' WindowName: 'npjozujkbxbxtgoizjhnrwpad'
ClassName: 'xrqbukairvbldujiisf' WindowName: 'bbuqcmxlinpwrkcsvc'
ClassName: 'wplyutaoruusrpkafybmsgctzjb' WindowName: 'nwmjclfsccugxofdxrjzgjcacjtembyshdwpt'
ClassName: 'slhtcmqdhxzkjtj' WindowName: 'qmevznqwgtaxmkavofn'
ClassName: 'lafyqunipxgxajel' WindowName: 'tdrvbbjlirrhfvuuayncy'
ClassName: 'eiupgfsncwxuggasrjsnbwwe' WindowName: 'coqwlmlvvrplnukgvybsqdjqblwqseisc'
ClassName: 'cmgsuotccvknkammsijnouyz' WindowName: 'vgqghyelnkpsuxzoyusjcgibybvp'
ClassName: 'jnkveycegsgrxzsqjizggsjjjqzouo' WindowName: 'xvsdnklfyyllgnwzwhl'
ClassName: 'lymrhelxaemzjuhnrppkivcwseoutwwgebqosie' WindowName: 'ufidyvoyqvbbyqsudufd'
ClassName: 'oomhcggajiwgkljmql' WindowName: 'nqnzlrlhaohzkfcrbppzjdhmazxejgjdfmkit'
ClassName: 'hsnltehfhozoocmvhtcnwn' WindowName: 'byztwjqldkqpplwdcanicycrgqokjazy'
ClassName: 'ldjdgerocpjznmklrjn' WindowName: 'qmrnetgridqmtwdpanbddumczc'
ClassName: 'nxmhdvbsizusrxbfsemhdwaltixecnon' WindowName: 'ahvahkdaqoijlcvlderkzc'
ClassName: 'lpdylnlwrzhjnblksjrxcppghklaywpesdfxyjh' WindowName: 'dqlkvgrskseklbxhkgufskbqd'
ClassName: 'trpzzsnksseiqjadqhiewihwmc' WindowName: 'ctxxczymvharkznyc'
ClassName: 'uyypgfvgrdznpcvkhuuoznxa' WindowName: 'yodvycztysajpqjgivtkbzrvgjpredqoqxvqhsl'
ClassName: 'rbcjwqxvnpxyanhrazwcnjqe' WindowName: 'hkipvfvnazyjfqlcrqwj'
ClassName: 'fppqzgvmxqqutpoqxworljqjbbongfelffysmi' WindowName: 'pynlkxaqssufugnnbghsxvtbugnrbuzccidjq'
ClassName: 'ofhxdisprikhaaqlyqfwlonq' WindowName: 'zrzrjaytetnxhlbnpxzyimyrnszdbaudzb'
ClassName: 'qpdnrghbcrjhdrzqqivvsrqzobsxb' WindowName: 'vasrviknqdukoblxxuwqbxqbqha'
ClassName: 'fcqtrpksnpalaxjeiazmdgkb' WindowName: 'pzkwsillkblofsbfmdq'
ClassName: 'hqrzxpxewqhxafqkiwaxaw' WindowName: 'bsjmorhcaecsqzma'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'hstjrwrlkezlbfdmowezivonmqmmfacn' WindowName: 'mckhpsmqewojiqtcpcubqvyszedxxuor'
ClassName: 'rvintyktyvysrfbyvzdhgnsouuthgngwmuq' WindowName: 'mmehqwbynsmtnlnmneozoztx'
ClassName: 'jvwbuyonirymcrqbdbiwhzyhlmllidzdp' WindowName: 'zwnavbyzgdsdlyoctneq'
ClassName: 'tgnundhyjzbzrnqjptjvooouxwjxfpeus' WindowName: 'ovtiubvmfxytbmufedtanvvap'
ClassName: 'xgbljyrwkjtxcaazdcerrukofa' WindowName: 'idgitlllqczjidpqdwdlus'
ClassName: 'bqgjfyazvleoghfjxsnsjycrxhxblaqmscenk' WindowName: 'gwampkfulboksgffhnojqagjeggxhnwkoolpik'
ClassName: 'frttjinuoagopfotopjsliesipuwlfd' WindowName: 'ptsvbfcuheoskmfg'
ClassName: 'iszrgxlzmiudduwqvfpbvlpzemhatz' WindowName: 'xnotfneojffvgebturb'
ClassName: 'gsiykmwbkiwnhrhazwrapcxftedkajtrlhqgic' WindowName: 'vzjrwcdulzgbnpzypnqqoxbhq'
ClassName: 'xcpxslvemkejoprytatf' WindowName: 'bnzeheqbispphrujnwmyje'
ClassName: 'sfsfizhbscwkgxtoglqz' WindowName: 'kwpdtowpwjjshasorwsasbyohxvcculdbpijecm'
ClassName: 'ipuuajokxttjjmuhpxmsfkfzbmwgcthj' WindowName: 'wkkxqpxcorkniaknzfetoigypxxwhfjldlkdf'
ClassName: 'qvhuzsrvnuzrcvuubykvxxvuedxjieifrtpeadu' WindowName: 'stlqslhoeukxiudqetrkios'
ClassName: 'howabbufvmzyeaivbsjwqymgohluqnmawczse' WindowName: 'vgcgifktutybdkaqunxiftqmgxak'
ClassName: 'xkvkraeltpclwejy' WindowName: 'rnxulusrtfhlacocwzsvmknitkabcrscyojl'
ClassName: 'rlvrfdtmaeqkpiztolorbjbet' WindowName: 'xgnwfdilaojznceofvibfbfontttooqmneihj'
ClassName: 'mraopjbwieexfxkmmv' WindowName: 'vuujyzqhrdklptaizyryiblciadohi'
ClassName: 'jwgjgcknfqibwxrfgmjpbywjnjrgcyvpuzjalnl' WindowName: 'ypuujfkgicsvrqxhdsn'
ClassName: 'bcvxzeiiedsonvbmygihisvg' WindowName: 'rsholbvuhhqeeleoazwzysvcqjzh'
ClassName: 'pigetijmrfywjggqealqbpz' WindowName: 'ojgfxyrnvezdtiowbsys'
ClassName: 'urhmlaoscsmfayuadll' WindowName: 'sgowuatakpkwkyfbnibylbswzffkzaamicspx'
ClassName: 'plzytahsxuuihemxrln' WindowName: 'egihbxnqeixzxvskuymemsdqmox'
ClassName: 'aaialjqdyzfqdyvzhimynjfvbyixzmnndlpjtkn' WindowName: 'rxbocmpbpfkpmciyziquwgkpviboae'
ClassName: 'xvnpaukehubhrkgxmugjqocujrnfjxac' WindowName: 'jmywczaenhahhmwmzvhfnwcugppumlo'
ClassName: 'uvocqpsuvnulnqreiygx' WindowName: 'yyhocgsocsebbwntzavgqxhvdkahdkmasq'
ClassName: 'inxsktqcbozvbtipqncxwuhajpqty' WindowName: 'llanamegllmrutducbgiwyjhryclnukdlw'
ClassName: 'uykgbzizvprmbqzcsqur' WindowName: 'gknyidklwchufdykuyxqwdmnx'
ClassName: 'wzxqnpgiqwpfejexgcyx' WindowName: 'qoqfvpjgnxtnytihdtjvq'