Trojan.StartPage.59368

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsc2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\Math.dll
%TEMP%\nsc2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'bihumvhmlauineloyztdouwqwvggpmr' WindowName: 'ftluntklbrppitjifvklluqnpiz'
ClassName: 'ypcjigueogxbqpsxapdkgrifr' WindowName: 'qirsxbktleipzjzypajygpfnqtvrdtedocls'
ClassName: 'esnayusktccylamxbxvoapmildgw' WindowName: 'pwhkcvysjhppinhcicggvct'
ClassName: 'avdgcjuyxszrmyvje' WindowName: 'rogbtghljfqvhceg'
ClassName: 'hbpavbmetmqmxjejsrhdzskojbjdfkzs' WindowName: 'pfzimtnnzatzepumdfrrfelg'
ClassName: 'whoysyjbfpnzavvopbsoxxkh' WindowName: 'kmhbkocbtkkxducpyyy'
ClassName: 'sbmoqhfvxgdupsjhgmzxjluomramoxbccntrmhs' WindowName: 'vliecetqmqeeunrskkxdsfi'
ClassName: 'allyvsvqrqxjbbsyhojfeasnmvhrlndzu' WindowName: 'hytdlppjvqwowtwqeylgkkbwbsjelfesrkrhcpp'
ClassName: 'xsbmoabuyoiiubexkdrljefvuh' WindowName: 'nqhifgzrjkolrababknvidzsvilq'
ClassName: 'edbxqsmwahkdhltwq' WindowName: 'ardqefesmxqvhvflcma'
ClassName: 'hwnxlrtyfrtpawfdxsjxbmvnbqooixyuzwdt' WindowName: 'txenacyltzhkopkwbdazgyameoqef'
ClassName: 'thlfzqqjcpjiscwlfyrqw' WindowName: 'jgcfvnnsuvalbriszckuttvqobacwaw'
ClassName: 'srnjijkiubfdmdlrvarynzfumukvvrnbnhu' WindowName: 'iclylayhbclsaxcnivforcyrtvjz'
ClassName: 'gkvhcgoxzpixsrrbtvcagfn' WindowName: 'hpjuhnkdwafyspbkvqccazosbqkzaqedowh'
ClassName: 'mvdqjlpkztqvjqjbetgliicbuiilqatcxdet' WindowName: 'plywlquhqvupclpgpehomwxfcxok'
ClassName: 'ipwwkuctjebfeyrjinezllnteuk' WindowName: 'hsokkxhbgcznbokmgqhumqbwrk'
ClassName: 'srtcfgcfmttgfdib' WindowName: 'dwfktqqinisuihphqrckdlsrfew'
ClassName: 'eeadvaqzbnjddwyawkssnak' WindowName: 'byzjsxsakxgooiajbvopunuuohqgv'
ClassName: 'nmfmzpgqmmiiafmclenhihndfqhimbtrydjn' WindowName: 'zfwxwxxuqljvgrbhmoldxudkwwqxukquwsxvre'
ClassName: 'lpgtzmrvfrqdctwnuyxywtmd' WindowName: 'hzgdumsfnnncxwxdjhkdaubpccvnwd'
ClassName: 'lwokuiacriuanslgoovpwhlaosjcl' WindowName: 'jbqywtlurtxxgkhwoyulpgkgqpy'
ClassName: 'fcfowcbibqivwei' WindowName: 'etmckmqhbuhrkmxcbforjxxg'
ClassName: 'jtsbeswwncawxrfbvpqgnckdheczekucv' WindowName: 'tstxbxbfqicerwecczwtvxjngrhtjwjxfgolju'
ClassName: 'vtfjyybxstiwmfheonrktsdmtnvyupzdaz' WindowName: 'zxeoqmbodzdtxowqmfhxwobmehxbvdbkxssyitl'
ClassName: 'wmzicbrvelkzepzoqbmxhlrmwzumctuts' WindowName: 'hkufqpxxbpgvckymlcttjrzyanvqharnyv'
ClassName: 'vlsdvoezyqzafzwubfchwwvmibuonwkqlmrrsm' WindowName: 'ijylcovkzzclzfwtihp'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'twmfrhpspwykvxixcgela' WindowName: 'eoeuzidsqildiubpkivdptmknspq'
ClassName: 'vjcscwjoburgahokieizdbrfuwhfolxfavjjx' WindowName: 'lkmvjcdjlrksrseychvulispyefmwohbwmzrvt'
ClassName: 'eoihxhwinjtsaxyvgjenjioyjagikohivdedht' WindowName: 'qkrbrhrngrwmfaisekejzmmexepcdsl'
ClassName: 'yrmlzawroyimysojq' WindowName: 'cetwidlvbgtxylcsqgyudixyfauslp'
ClassName: 'ovxzhitxmpxziitcgh' WindowName: 'ynghwffnehbfaboahsyrr'
ClassName: 'phvwnyqnuvieyzpoljhdlwkag' WindowName: 'zdomazrrifwjibv'
ClassName: 'llcgaxupafwgupbhacsrbwknjqlqevkaq' WindowName: 'ggalluqjkkvenlscmxsnlzonaztinvisuuovajy'
ClassName: 'aknrhshczjsgdrflu' WindowName: 'otffamhdxgjvknulnjppzrjqc'
ClassName: 'moccvwyzdsszoqdijkqqn' WindowName: 'zmrwhpqyeageqrkligqij'
ClassName: 'qvnhcciwoeqdcbatatkweduj' WindowName: 'gdekdciqebpyspopyuaqeveetmwwxxcriokpxc'
ClassName: 'cwfiowkqhosckohdrfwwfny' WindowName: 'mhbgesvvsjbwqnfyqrit'
ClassName: 'psejyrglbdiqvujgilnlntlcs' WindowName: 'ckmnjiwamrosjnumoblowruznzfsasiruqqtfq'
ClassName: 'rttmcdljopmrhgyflvcawiddcmrmvfuubtviokx' WindowName: 'dgilgmhmymsdoppzgkjllci'
ClassName: 'fkzzkmsjtfejlezq' WindowName: 'wgxvlhiajucbboikrpy'
ClassName: 'oidrzszunmisenykjxzifiigky' WindowName: 'onrmtaxgnodwngszvetewtgxupoug'
ClassName: 'wzvskxsoknariidm' WindowName: 'oyukmpiviwwpvumrgwqhfmsu'
ClassName: 'xsslfxennwvcxrgrixnt' WindowName: 'cmfpksadlhktwejwbafikgsyocbdzinyqr'
ClassName: 'dwovntftaxweafgfzoyevusmv' WindowName: 'uxghmigvxojmhxqcqyoattxtylj'
ClassName: 'uvpmeqrsmoxsyurwakgnexemgo' WindowName: 'iaitfnswrzxrvfyfvcmlqqwsndqwg'
ClassName: 'xfklmwnroghwxexgafwctoqmionv' WindowName: 'siqctmjxdkilnjudqtiyffrpof'
ClassName: 'ylamzzfiqkjijsldd' WindowName: 'pnwmfimdenugbluwhoqfaxjobtfauwgicz'
ClassName: 'szurvjlzsyzydglctqindedwjsglkc' WindowName: 'syrzgfhwwcwgpbd'
ClassName: 'ibwqfvzpwcczcfxsry' WindowName: 'upaxljrdnbfnjyyanmxvxi'
ClassName: 'unavmwtclhfcjvjwbhwlddckbwpxzhsemrg' WindowName: 'qjkfyjkoabxfqdjhydjz'
ClassName: 'atztpdoafydgbyrahltcb' WindowName: 'zkkllmyjdqjamfskgzeojt'
ClassName: 'vsfsevacdejppwduxgqlvnspvvzicysoxcmw' WindowName: 'qmzgcsvyoozikzaqmeg'