Trojan.StartPage.59379

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsq2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsq2.tmp\System.dll
%TEMP%\nsq2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsq2.tmp\System.dll
%TEMP%\nsq2.tmp\Math.dll
%TEMP%\nsq2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ycuqzzpcbrchqjsykgsupjlbucfciuuarjvvi' WindowName: 'epirzjmqzzmqnkpk'
ClassName: 'fojpxksiqkravzisvsjietjr' WindowName: 'eqsmnoplzpwldsbwydkoe'
ClassName: 'gfpoqkiincudavstdoigebkjbchiw' WindowName: 'zaairgilzcwyhtjjoflkig'
ClassName: 'mbnizrjhgylrrsaojsqjaog' WindowName: 'mlkcqnszghgqcrpc'
ClassName: 'mrjemumhtqxjqgrqpddptlybkuytwk' WindowName: 'hrbfbaeizjaqlrxizutafvebdmanfdlvju'
ClassName: 'ktzawuznielkfvaztzssjwwkvqmmnazl' WindowName: 'oitwpywdlhfwswjdlxjzlyodrk'
ClassName: 'jgpaggdbojjikchsiaaplkcyhjdtwrgxxb' WindowName: 'rcxxordqjgoforxbeye'
ClassName: 'somumtaieiqkfmusmhocmtxgfskfr' WindowName: 'rykcxwvnyxhmxzwaqwqltkpdywzomcuuih'
ClassName: 'zsaktuumtltdqdfbmtxemaki' WindowName: 'ttwkoeponhuazkibhfqlbl'
ClassName: 'cpoxoxrqfylvttqaufadviz' WindowName: 'pzojqomeawslgubpiiatmdwddfpukfhkpsbm'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'igdtunyzsobovlrcwkxwbxbeugaitbje' WindowName: 'zyrofijyyhbqejxvqmaymf'
ClassName: 'mflqmpwtthgaluooyp' WindowName: 'wdgmmdyesvkmlimrxhxcqehwlmgcgouxzxpahhd'
ClassName: 'kzdrmjnhkopalqejzouxmodvehnzhqircw' WindowName: 'ugswxxykcuznichshuypreqcvgkbfkkkulp'
ClassName: 'befpeimrnpvpvzdfnyyycnntoxmncxqr' WindowName: 'feadyttzmyxzfjblqgdojejbqdkxevexega'
ClassName: 'idweirktdvaeoosxlhziabshgfylrfd' WindowName: 'uqabqittffotnqcubwctibptgzb'
ClassName: 'pvudnqoxoeqbxly' WindowName: 'jzgwsfeejseuckir'
ClassName: 'cxrpfnozqzpjllxjucbzcgpyehn' WindowName: 'zsnfscxvwybehglgmqibsun'
ClassName: 'rjozpocadmzmdkqsygykpvibxtkzhggf' WindowName: 'xqzrclfuinatauwx'
ClassName: 'uwujuwyizwnlaxyzszzwgucs' WindowName: 'vawgrqtaqlahmbqxvdduswbnqizxmk'
ClassName: 'jzszbkulalnmnbzxilxyr' WindowName: 'nfgxgwgcvjvjyuyvudxlrtfgunoltygckked'
ClassName: 'ecluvfsknnovetnauemxphncawl' WindowName: 'htyjurarusibvlr'
ClassName: 'hhdygrrsrlpochdkdgtvsf' WindowName: 'akoqmgaupgrurxniysuyemtxqvclkysrbfrdeg'
ClassName: 'bxdataaxdkpvxbyfjycslhmcupzloqn' WindowName: 'tcduepgvbaxcdvuyvgkwszrpwqfyawn'
ClassName: 'lkgzuobszofsersfklmrjlwnkauytusiukbot' WindowName: 'vfftzsghckunymkvsqtzlqisepeyj'
ClassName: 'zapmduntboedxzvavuxaizvfzukt' WindowName: 'kgvljapgntplzthzdwftcgwtxh'
ClassName: 'gcyywwyigtgzoygijirlphavzugpcd' WindowName: 'miitnwpzjgtzhjvwknr'
ClassName: 'llebvxoxcphycvfphbtkwvizpwankz' WindowName: 'nniqwtfnridteooaeqy'
ClassName: 'ywrpfjxwqxbgrnkavijetyixqohypc' WindowName: 'cjlaruebjjtkbihrdwpqxi'
ClassName: 'nfmmftbfvodcecwgiptfzbrcyspofb' WindowName: 'xsxdrekoamzqupafjimplurjaueckyjir'
ClassName: 'rvbjkzjxkreoezdfqelpcgzswlja' WindowName: 'kopjdwsesbyqyepwxedthjlfeqlpgmndvnaqce'
ClassName: 'ndfgzwmldkqmdxrmalvvckvadgeuetvtpzkjpr' WindowName: 'htfyaijagkoezaugpvfp'
ClassName: 'sfrnyxybhglqcseykgiew' WindowName: 'xomaanxshogmdhtnuedegztloulxzap'
ClassName: 'fphfqeyozrnubidnpshzrhgqdgaqvow' WindowName: 'crxpnhcjoutfxzyngtgknauljbkgimlinjmgm'
ClassName: 'jhmgjkhmpxrsgjlirohprdm' WindowName: 'xtjwdkqlwcwlsjqzzydvtfytvqdddkhv'
ClassName: 'bvtxuvczivhloqwchsdmfjhb' WindowName: 'jewwyeuaicdwfshthucokpiyvvfmeoncqf'
ClassName: 'bxqonsbtlrisaocovodkvowgeqfnajwgtzt' WindowName: 'lnvbkthumnriwfisdngeuagloof'
ClassName: 'jwbxnwjkqcinticdmfjcrmjtuc' WindowName: 'zdaizywkstgaqjqjqkyvob'
ClassName: 'ulgdtnhbhmwcipcp' WindowName: 'gxpwspblzimaecjfuhcalmtbzhbsm'
ClassName: 'uubjvgaplkcajstcxenwefagu' WindowName: 'jurmettxedufckdafnejfuxmjtdrquipi'
ClassName: 'pbpfuvnzvtplzffwxnbfffmqrallfcrs' WindowName: 'ixqmlstmmlbhxmltwqyxj'
ClassName: 'pcaohbbdyyvvqtrexmjptttcnuaoqdmmew' WindowName: 'vnuxbstyqlwwbbojmekmduia'
ClassName: 'oqiavqumlcckhubrzowkzdweixjwguvgb' WindowName: 'cerasrjjeyzelbxmtokldldotmn'
ClassName: 'thticrfujajebnx' WindowName: 'joammzyujhaawewtmjzuqczqamoyiufhxabxcaa'
ClassName: 'kiuramioaxysqajbwvnwegcdyyaxkzhk' WindowName: 'ckrgshkwtuexmnwlt'
ClassName: 'yedeoxreyutovvdnwxmelqkwqov' WindowName: 'duenlumnjpwgamktsfisk'
ClassName: 'upvsatzgezhzgji' WindowName: 'rqkdfufygjcdpubryvilxicny'
ClassName: 'duxlebcomjuyaqtanfizzwyfw' WindowName: 'nrtzvwpnegvuxyhrsycairuiwbkvyvhjeto'
ClassName: 'gakoalwwxzrxuorxgigavwbyjl' WindowName: 'cobbbpfplrgkwejzefhlie'
ClassName: 'kgfjqqyrelygnlckgqnuyyrfnmkiuzm' WindowName: 'qsfteijtscbsyqerntjrivyvbvc'
ClassName: 'hwmndbdvpznortzgdwqrpoyfeadyed' WindowName: 'idgoshrbihhuhnrlzjzshtwdlbsearrt'
ClassName: 'orzfxfpoeoboceoitjc' WindowName: 'wuhilshbitjyehxtowjo'
ClassName: 'uwnbvvmatxczndbdgleebpslurnbds' WindowName: 'omukgyybvznykanqb'
ClassName: 'qbelbjtdqkninywa' WindowName: 'zxqmudkajwscmevxcjbyx'
ClassName: 'ucguxqdygnqvtguja' WindowName: 'foceyibgptuzsgxhiznafpxdeqqpsfuz'
ClassName: 'xieqbjzyftoecmdyqhylgdimikgxqqmtf' WindowName: 'oauplqgsrppjdjyph'
ClassName: 'wnyufgxsbmlxkya' WindowName: 'hdzrbeemtsvsfvruwmxqwmjkcvyxftj'
ClassName: 'sdwsbjpywpumdgjm' WindowName: 'arfiuwooshyedbatd'
ClassName: 'yuvxbnmkwrgwbtbeqbtqtzzquyctgplrk' WindowName: 'dytrlaclppdeqgasysjevzcoivhutpxynzhux'
ClassName: 'gxbkyvbwdlfcslxmuwy' WindowName: 'tzknkbzhiaxzlfdyegzgtmmlulp'
ClassName: 'avxqyzlxudetcqfrmsenihivpl' WindowName: 'mwcweffllayoaxjllaxlxnjrldhbnvmel'
ClassName: 'qrhjbgjpyvfinbgzrmaovzkciuqzuf' WindowName: 'oocgdnapzfbltdmiytpkkfyj'
ClassName: 'qynrdntwyxkkviwquipaolyopzcziostl' WindowName: 'rpsohedgergmpiwnavehfqbquhpasjqelmoia'