Trojan.StartPage.59409

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsx2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsx2.tmp\System.dll
%TEMP%\nsx2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsx2.tmp\System.dll
%TEMP%\nsx2.tmp\Math.dll
%TEMP%\nsx2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'buozvotjjimaseagawaxyobeyuul' WindowName: 'dfnulcxwasuseudfcgcqxekjwtohczkxhciq'
ClassName: 'sxesktrzznuouydzjegfnhv' WindowName: 'mkbccqqulpebzgfmgkeuzswxcpjxr'
ClassName: 'arshrpavclclwfbovdqlsupasyvr' WindowName: 'mmohbrysrnpslzwqrdwxk'
ClassName: 'tqzwdrjcmfijkbdtkgdzougwqxdbgnbrugykzp' WindowName: 'iwhhuwmciekqipcsmbpgxuhxkhgiqsfjmkgnpbb'
ClassName: 'xagamagudnmqgaooduvowdjimpyuebsf' WindowName: 'utortebvfyiolqdxfzmhobghqelfsoocekpuxw'
ClassName: 'qaiukagrbtobojsgbhefzybpmagoo' WindowName: 'jabbzhiladwogulpzabnybiukhzibgboxnro'
ClassName: 'gmfcxbzkmjtwekrmdhningcoamopku' WindowName: 'wzzcqsyymeydbsflpazbvrbq'
ClassName: 'iqfhihxcywovhwcqypz' WindowName: 'fdataykigspfiwwbynxsaqntxnnagqt'
ClassName: 'nywutnhygsdlwgsfkxftavv' WindowName: 'aabasdecfttiqym'
ClassName: 'qsiubfvqpvbphicpszywcvkfhhcnza' WindowName: 'pzqcoesoetcyysmufprbkhdnbawt'
ClassName: 'owqqzvhoqbmrmnzgbiffkmmccfur' WindowName: 'rvwjokikcngvrvvsosawsgrkzeexgqd'
ClassName: 'kzutyupicwtrhfre' WindowName: 'qckbqnicitzmlhceypeclmaruczqqiqlxc'
ClassName: 'kebzihdqhcrbkkhykbzvnmdoavhklnhq' WindowName: 'afumxeybiyhgucqd'
ClassName: 'vtbflmxsnctwsprsjipkazvnpagouwc' WindowName: 'tkheshllekoyfoebelgpn'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'pctdwbxvaimabfkmjzdeizpxbztjp' WindowName: 'symwrpjfaklcgtevtyoxmxx'
ClassName: 'cwfxmzoayhprbehggiicnkhrjrconngm' WindowName: 'uswlnkdoqvgyxrjaotsljvvkcubhfeurvqtt'
ClassName: 'cxzzssqccgcguqoon' WindowName: 'ndseaxwpefoldizzqxebhnaiwgg'
ClassName: 'csbgqvoyviwxzbwp' WindowName: 'hafizemdkjlpfycmqekocpsklio'
ClassName: 'rpdweoxjexmtfbpimtxmuoqdqhbzhkibz' WindowName: 'mbnxuvicouoexnnh'
ClassName: 'slpwopqdnjoigexbc' WindowName: 'iyqbgsifasocirtnoqqpwmwpzzxqqerejtfslsu'
ClassName: 'emprzmrwehshboiruveiilultevxmxdtwtx' WindowName: 'enhokauneixzbkdrnbqnzjke'
ClassName: 'xrupqbwbnawnrxxypjetkamyifoggcwzdpw' WindowName: 'gxxlmmzjnanyookjgnepwyactvcctdhvflhvgs'
ClassName: 'gptucekuoeznuemywaqf' WindowName: 'sowsqftaxllzapzrjqykfwmulkpyyxsjihoslvy'
ClassName: 'ejmlpvvibamrgbjtgukntxgrdwyetkyywwfyg' WindowName: 'negtgejmpvactbhgmew'
ClassName: 'wlpjrmhdylskmxkukjoogu' WindowName: 'xyviczgiyjyelalrifcvcumrovvlfgts'
ClassName: 'pymkzzmzgbowimxgsmpmbedkdtfq' WindowName: 'bfmcrlctuzoyniemlvktayhvrjnfvliwl'
ClassName: 'qymneawbdxajywxdnytubhz' WindowName: 'miqhccykowawdjhmgbehgfrral'
ClassName: 'elgjpnkqfgltawsy' WindowName: 'bacqtdzyfdcqzkc'
ClassName: 'ffpxkiacvvbzzcwgglcfxmvlbge' WindowName: 'omiurzqramjznffmnziagpaznthxwbcma'
ClassName: 'djhpgqthazwefipkowvno' WindowName: 'jhedlkuevfeqiquzbnchzhakc'
ClassName: 'zietrebtujirrqgruwt' WindowName: 'kzlrzwzhmwdmeziosmzaednd'
ClassName: 'vcginmqckiyvmtcydoqcilashudgm' WindowName: 'vnpqgukldjduqundclowbcdgjwlvvragfzgbq'
ClassName: 'ryvgyyzjjqikggyeqxnqahdzud' WindowName: 'nxeradbgkxejxsqquermiwmjrmxjyxonne'
ClassName: 'rjlwdiyvzpcwkwpew' WindowName: 'ccfszyaahrqzjpnwmlzhvciv'
ClassName: 'fazxupahfhbmqzlswdllbubvxqlawjpvvwj' WindowName: 'xyzgfphyacrzsclyh'
ClassName: 'btyjaypenadzfritigqis' WindowName: 'lwbegxynsupuzpgytnyrxfl'
ClassName: 'kmuqbuilsnqkhqerdvyspesypy' WindowName: 'nukuljgmmurzfvm'
ClassName: 'nsyaxhgycivjovlbdgydlzkeliyawvphcbslwv' WindowName: 'vpquslmbfkfnnxabltdibof'
ClassName: 'adevqamcqmfpgpjxcxfojqbaasbemvrlc' WindowName: 'ssoidfgvdagtzjoyodhicxanzc'
ClassName: 'bzzlasplfxfdzejnoyawyil' WindowName: 'xgxpzfvebqiidqznv'
ClassName: 'uhqeecjhprdsbmtzrasmjgvaksd' WindowName: 'knqosjqmgbikkgxemuemxrw'
ClassName: 'cywukyfaeggztzfzp' WindowName: 'firjrchwybwfkclkgwiwvgoyw'
ClassName: 'xnlfbexrbytjghvfiuhu' WindowName: 'ceikrbfdvrjeyqgefdy'
ClassName: 'iycantmhyxyvste' WindowName: 'srkvhrfkfabutovyvvpmvyicb'
ClassName: 'pjvwczxktdhxejsvhzvb' WindowName: 'kbqfehmdfrijruxlywfgdftxbquyg'
ClassName: 'jkgghighgwmswhajrufsgmfwoeqvlxhtseawvi' WindowName: 'zjrdzkdnrkwkorisanwcmndwsgoyfqkutqd'
ClassName: 'pebvjhedhjuxmhqzjqrvhawsdtgxmfbm' WindowName: 'swkdhvjpdwvvuwjrjchnh'
ClassName: 'afhtlgtyrzutikctcdwboizqngvaso' WindowName: 'dethawbauqlfakrikxkqqauiptkvewtztwia'
ClassName: 'ubbbkkuuyrrsmdamvbqrqnegfcckyeqie' WindowName: 'xknyqgfiqpiammnnteaplxyuhckdkwsh'
ClassName: 'tmafckvjzwyrblmduxcnixlayxckimywjpbp' WindowName: 'hpjjftuinjchurpad'
ClassName: 'nooetuiphmzpcfarqxtyvqrntvmbrfgcgvi' WindowName: 'xusqmtgzkdpthyeevahcttfjtfubxldpech'
ClassName: 'pvarlxemhttzdbpifirqrwswanrefzpopkqv' WindowName: 'fhfevbtfthxivtfeuerrl'
ClassName: 'yxxxhzynzzgnmmmyvxqgxe' WindowName: 'wgqupchsieflgpmizbwvjynvptug'
ClassName: 'muolvsfeaawqysybyjczrmodtlnkwujbhr' WindowName: 'ccpkrkywsfhfhzoerwoguhzoimpmcns'
ClassName: 'fkdxcrzouoqekenuioyfqzzbqoa' WindowName: 'rretboqgaqavgneqhdwkhyk'
ClassName: 'clpcngxvgqbruttkyiwbvuhrqhwplzubxqkbpmh' WindowName: 'esijfkouinnqzfkdwrpywjikhcxogtpy'
ClassName: 'obvwkzrrfgkaufmgjsahoaanhmtpzeobup' WindowName: 'hcedtznbhtfknvofidllqgctmupteqr'
ClassName: 'llsvvlvmqwwutlfzipmvrspgl' WindowName: 'gvtljbkjndquhhctclairh'
ClassName: 'dheeglncjcpmjxzyt' WindowName: 'ijdarojjshveapmjjervtsnlukhxoe'
ClassName: 'eyoevmnyygvmgkjnvhcxxuyoxcdbks' WindowName: 'wlsuutbwhnndbgzbpzakszm'
ClassName: 'kbkfdsvzmzmhvvhaou' WindowName: 'wokkntvoobobbhiigbynoxnhetwzavtknsdlmow'
ClassName: 'mwzenkvdouacqtnwqdd' WindowName: 'njcfnkmkuzkrdhsxtkzg'
ClassName: 'oswkxdxzpsusqgfqtmrkm' WindowName: 'uwswtzitkgyohizmlczlriclumoisjmj'
ClassName: 'yegpnhmhrahsuvhrqstrhxawbvypatpqxqdm' WindowName: 'wlahwqqrovnnybrvnlwbdeqm'
ClassName: 'xbcoolrjlpjjtswbizzhby' WindowName: 'jgckkcxtezsvertbmahtxnomwdncvo'