Trojan.StartPage.59343

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsn2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsn2.tmp\System.dll
%TEMP%\nsn2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsn2.tmp\System.dll
%TEMP%\nsn2.tmp\Math.dll
%TEMP%\nsn2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ulswwujodrymyvb' WindowName: 'fexusipsvbzoydidpihok'
ClassName: 'ctwfbornetjmuxhvespernxnxdtgjeldg' WindowName: 'kydrkqpjoingagdokucmaynbndicrtmr'
ClassName: 'obhqycwvaxxunduh' WindowName: 'rcjtvescoldjzqyccolrnvz'
ClassName: 'xfdjcyimgcqkibukbtcdwcrklpskvobnrffsah' WindowName: 'eyrxlmwafgvtuodjobl'
ClassName: 'bntbqkjpcbymyoaeonxfanhrt' WindowName: 'ymuvinualslrikjrzeucudykiu'
ClassName: 'mdgrlbsuionxemakknixbtjixznkffllskmder' WindowName: 'olneayojfyitshltdawzfkllkkmtjywuciq'
ClassName: 'fldpuicwbgvtxyaizs' WindowName: 'lygqfivohrcpzttiruoeulgj'
ClassName: 'lvhkrfpzbzehtdnwqnimmqwzpyxf' WindowName: 'wzcgoiorukeangvaacqwzlrwva'
ClassName: 'mptappxdbxkgelvefstfsksvatvci' WindowName: 'qikulcblwfmozyfivhzkxanlltzzqonslslkgl'
ClassName: 'uyjmpfxewzgqekpuuksnvertocepuwmvro' WindowName: 'rcsvsmaktztpocns'
ClassName: 'bqqrscsxuxiuyysdugnnktqkrnfwbg' WindowName: 'teulcuekfzjdbajlafdlbzlx'
ClassName: 'vybutsucvwlyxfcqksedb' WindowName: 'hgqagrlrdvshzrtqndaakxabrafixnhivshc'
ClassName: 'ddzylhknhkzhodtddqffg' WindowName: 'dvmgoamvhywttafmdmhppbni'
ClassName: 'lhjddyohdzxhduhsvfgmjwuzudvmuq' WindowName: 'jfgazwuouxbsagbymuloymghemvupcnhj'
ClassName: 'yqxhuasyjkwrnsdnsuylprxbu' WindowName: 'gqoolwloyglzhwbrufvgoixehh'
ClassName: 'dbrputaldsshwqtpfi' WindowName: 'sbjnzfnsmxzjrostlzcqroexdpv'
ClassName: 'dvvzvftyvhcyjmsxrqgiejfoyenioetd' WindowName: 'cpybpbazbvzovpmgiadhbc'
ClassName: 'lkvgrenapgnmulhnzhafmhxtmngegqmfogpngji' WindowName: 'ykjcdrdelqgwohiklgzshqipuw'
ClassName: 'dgoxgjfcjrlrxtalblogzmtcspbzl' WindowName: 'ryyahsozdnwucpusmkjcyvqk'
ClassName: 'izvebpoptiyodmx' WindowName: 'bohvocviaomjzdviyvqchpuxkicrs'
ClassName: 'nkuqwkfwtbgcjwwqvrfkp' WindowName: 'zsxouwytgcpafyoxv'
ClassName: 'lpmfedrgwpfxyfqynjug' WindowName: 'ebzldeamyeofdaizljzznvbbrydktjfbmnr'
ClassName: 'uaozboawewjgkegyuoxyhgbmvntqzt' WindowName: 'niwculpdhwkofcrrqcoboi'
ClassName: 'tzaviqawxmsydhgojmwiacepcwrcothrmf' WindowName: 'djrddmfubsszwumpzofjhod'
ClassName: 'kxbebptwtqtawagvtljozcgwdiobgdldlbxef' WindowName: 'sehxiqfnyhvaxnqqophthrdphzknwpcj'
ClassName: 'awkwcithwsvgqdiqkgumxakmbxmdzsmkgue' WindowName: 'qaeuseqkilcfezqkrga'
ClassName: 'paowvddtehuzruhwunmsbyaocjuidmouupn' WindowName: 'kujxplkjkojpprrgivflglngvztmzdykvvdie'
ClassName: 'bkfrebltkdqqtnjgnwru' WindowName: 'sedlyiklzlvdsxpgilp'
ClassName: 'gmdrpucrknatzuhpkrqhprniehm' WindowName: 'egktelovybfqeggmyp'
ClassName: 'nuesqjvmhsrrfdipvdbyeyszhnfiui' WindowName: 'cnazzqiyoygliuiysz'
ClassName: 'owfikodwxvvuyxqqsahehchsaferxiafrbi' WindowName: 'vcvdkaewqezaiarqamnebeviyvou'
ClassName: 'qdbevuuyblalilvpk' WindowName: 'ktskrshsydjwtaaqhylywjynwnmy'
ClassName: 'ykdvtmvqwngeplztcpuywyttdhcckfupwhk' WindowName: 'xfloqkvjboogzdxemqwbaevhtyadg'
ClassName: 'vwtbtchnqrorbxctnwnnzpshyffxaircrtwe' WindowName: 'mksgufonehmsbtdvxvkimw'
ClassName: 'dnllcsyeqczpfqazxcevbfglly' WindowName: 'meuomactfrhusbflao'
ClassName: 'dumhmnkvfffzxxtiuwvfjjcpipb' WindowName: 'nwmnvgqbkheldmzbooqwzyzgt'
ClassName: 'azhfmyfvtxqgkxyzn' WindowName: 'ktckoxtgdvxkzeva'
ClassName: 'cmnouskcqmygckmvdcwur' WindowName: 'qtbpegallpncbdpzifxwxpgwtvcayrmarbbv'
ClassName: 'ndzreobjfvxbzfnuqnwcnumoiyiiqnvx' WindowName: 'vgsehbahidjetzlzclrtfathpvdesqsqogseixk'
ClassName: 'xemcjlwumgugwkmuvdvnkwnjxmnryljiapdz' WindowName: 'yngkyrdxkdaomadqylgolxvkytfyprfvf'
ClassName: 'zhawnihzclpjjmtmjrmsmlzlylge' WindowName: 'rofdxhbbglddjadijem'
ClassName: 'joslxphvqgcunepd' WindowName: 'ovbkbnpkrnkzjzyxl'
ClassName: 'gzlegvbaycmufflcrutanowkyg' WindowName: 'boakrppjlgnwjtacppxbuqneipmrjrxbawc'
ClassName: 'ebicgxczxtfbifzlgcmysjrbamdikhazldujzn' WindowName: 'pkpnwnqxyvvbvxbkyef'
ClassName: 'jndhoqmiyqtpgjdiisekoxr' WindowName: 'xrvzdacifmhmegxcxmsfufxppemhpsxrzm'
ClassName: 'trlahipbdwfkjlspoaseuqbhhjmuvgqhq' WindowName: 'thvkkwyqawtdmyxspfojd'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'phrbksvucjtpsitklhehllnn' WindowName: 'bbwmvtgufvzoeofncyr'
ClassName: 'cqdoafjijvfijzfhhsecvrvonpkj' WindowName: 'gbzqnctgmxpgbdxtsxfn'
ClassName: 'fdwgtyufzlumigeuomonyenbirvmiwroy' WindowName: 'hmxwepldnmumzuksephqmnjratyaekdu'
ClassName: 'lapxngxtpngqjfeqwprltdwqh' WindowName: 'xismryahddyojinepsczsgl'
ClassName: 'jqtwadwyafkedlgpqdvaehvlsvh' WindowName: 'qsfgzwuughifvctjhmxcmbxwbgogyew'
ClassName: 'poymmcgjxkfatbefngwspswjwvnlhtrooshsbdu' WindowName: 'ugbqvcmqsipixzoglkhymcckzi'
ClassName: 'fgmmbnxvpiwvbqimvwvfnjqbtrzgf' WindowName: 'hxjogdgavofovqkjyojlzbbftppqixopb'
ClassName: 'tutdeqelfszhyddsopwkmkvigbvbd' WindowName: 'tiijakpoklxnsuqbojyshjsybtgwiqldbmsxedx'