Trojan.StartPage.59405

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsc2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\Math.dll
%TEMP%\nsc2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'njoxhpxcckwebfnx' WindowName: 'cntedulelwgexbknrhtbesnibxrwmklfktuc'
ClassName: 'skpoqpwsqvqoidbnpfi' WindowName: 'tzrldunhykcmvrsrvgmwz'
ClassName: 'doksbyqopevcmxwnwlrubnkilckruvivjcobc' WindowName: 'uodgzeklnagynuqeiaechpt'
ClassName: 'kyrovkjtvxmabefflbzdsdprozklsqgb' WindowName: 'hfygzkxijzgvnmxrn'
ClassName: 'zbyclstiacanstghqfu' WindowName: 'eujxgovjjpekssqbkezgsxiajr'
ClassName: 'vyazbdcigtllawv' WindowName: 'urxqfzlfoecwqrpwni'
ClassName: 'beryzppsjjqegwsntkmzabcq' WindowName: 'yybzqoltsxxpbfexxfrrubjjhnvhdpc'
ClassName: 'jdppqmjtcvvbtyyxsopigsagjysetxzhmr' WindowName: 'hlfdimvpkbrhuxsnyjcwchbyzhlvnkowkmwwyhk'
ClassName: 'ogcpxbaszjkjwnlanuadoh' WindowName: 'yezikaulyqqardhghydypyypldql'
ClassName: 'houuthepgneehavczepeakynzxwitwrnmzoko' WindowName: 'vckezsmvamdsfioczhonzvpkugcvvcoqhxrz'
ClassName: 'cgftfbjrdlbpiihqqbejvqitjj' WindowName: 'ztsgrxiofejkxmbzbqnxrzkvnhh'
ClassName: 'jeftlggrgikjtquycxrwcezhszrz' WindowName: 'stmcnvzusmyvikzbnlblmcagcs'
ClassName: 'qwnpqlpaafbzxerc' WindowName: 'ocezirrwizhhgjkbvzdarwyfiyon'
ClassName: 'qmnfurvfwsooyfjqdzlerxzuagrdba' WindowName: 'iuuhjncgjscqasjbtuzqbaadqxpdpe'
ClassName: 'tzydsvtnydpqqniyyiantlcdhqbpgoghdsilimf' WindowName: 'lblcytmusdqisrqdheatkghdbbkae'
ClassName: 'fuagowdpnlkfywpwhgaft' WindowName: 'evygbfskfsqpwtxoqqtaotfgcsykxhbdl'
ClassName: 'qmghfedgluvjkwiqvssnlgntg' WindowName: 'qgouaexwtpuowlgqjet'
ClassName: 'fuqbasgxpqpkrbresyuwheloocyjzflq' WindowName: 'axxhstiauncvjjzzoinobsbhtmuofhm'
ClassName: 'klsfbenpvoqtjzfelx' WindowName: 'gsweoklxwfuzrrhqheubrvyahykqnezvwg'
ClassName: 'qlmgehzgrkccltmagfnhyoy' WindowName: 'qakofbnozywqfkblnkcprjynyuxjcnqgebzywke'
ClassName: 'cbqptpasapxbqpltpewnlxzow' WindowName: 'blxbnqbbkisfjgagvjlqshppqkzlhexhjcns'
ClassName: 'oeuqxinrphvwlmxepouerurvkrx' WindowName: 'uegzaekqcsnmpicjtkghmpffpfb'
ClassName: 'grdwgsmalgjndcyqofuhgbcrf' WindowName: 'ulnrzkuofkcvijbzcgwlbygmnnc'
ClassName: 'vgkxurliwexrmduuvdhkxrfaa' WindowName: 'thbzqzcnlhfsmskkgcinjsntvaegdssgj'
ClassName: 'jzbdelbrfqsaexxxgbxztrpw' WindowName: 'mopsinxvovqddaf'
ClassName: 'crxqyctjxauxhnvkg' WindowName: 'kkafrhjmkwlckmvbaigfgowdvzfusazjrkx'
ClassName: 'mkktuliacfgeqxsuuuq' WindowName: 'frkfnzybqnqwuewqdcwy'
ClassName: 'hqgcgmztjsbwfne' WindowName: 'hnsrghsojpwigqgpzafrbuyhobbch'
ClassName: 'lqeaydiikxtkuzkajjpbbojjksygqujgcmogb' WindowName: 'gzxrjldkvflgizzvogcpzg'
ClassName: 'eqnmnusgzymwruxbkqojqvof' WindowName: 'hvwjpzkdtuoirjlzoebdxqvyitrrmdmvlvmijz'
ClassName: 'azzozpvxaltntxsyyeldnopzydxpcpm' WindowName: 'amcdzdupnbkamkwjrpzgwavjrmvocgc'
ClassName: 'ycgsuqljhwrcjiememkb' WindowName: 'dshcwozztxvztdnlzlkgzymvbesnsuoubadobs'
ClassName: 'kiddcjyfnlichnedwylymqljxekfdmsbhz' WindowName: 'ljevznggasmpqpmgfiqzergtmredgzbrbwixlnr'
ClassName: 'erxpmvbjhrlvbyi' WindowName: 'xuukmnyxhnvfevbmcfxoedy'
ClassName: 'mqmiuzujyqvtekoqxiisqykvglczoxhg' WindowName: 'irpfjjewbhoybnpciqznytmlwpywkfpoa'
ClassName: 'nruxvqnwcxzpjpqrajbaowyraokbshosff' WindowName: 'kgroszdloyjtmootzeuo'
ClassName: 'hlmfnnftbirvdolsoqyictmlpucnbmku' WindowName: 'affzwbnbmwxxdodwiqbiwfihs'
ClassName: 'jzgvrdemwdpghbzdvqoorskhktipfxowzr' WindowName: 'aqwslqqofrmewctwomahgkcpaiblxybjbcwhkey'
ClassName: 'nalonbisliwnacfvcpbckos' WindowName: 'jissgempgjnioqpitjidnbcqrju'
ClassName: 'hqycgemnywcmbpax' WindowName: 'otosrvjkyxgwvqdwtemlxatnflwajteu'
ClassName: 'joinsozxhmnokmgilh' WindowName: 'ofogklwqzoibronxzbdlugrtdl'
ClassName: 'rqpzmlkzrhfnhvigouay' WindowName: 'acksnmwwpebyfrckvsoxwtoizfa'
ClassName: 'qczvrckteqqjqesgicrd' WindowName: 'ujjtkuecixishpzwymchr'
ClassName: 'aqlmkqxcrjepouijepywilyop' WindowName: 'nbsdfcghmtxgjgqzwjelmconjaosdpawwrhbh'
ClassName: 'wohehyvurqmcmvhesdyx' WindowName: 'ficouysebjmftbtrdtuxvsoawqvmixtzwbngxy'
ClassName: 'cndzokcmvxuzzlwrdueawvlsqobmudhth' WindowName: 'uxbxdennlttkdhmlmjocvco'
ClassName: 'yzexgvqbozgvhegxsmdhxm' WindowName: 'jlfcencftmqxjnaeob'
ClassName: 'leanjtgdarbfjzmtqgjftgfgpfhuipp' WindowName: 'rnzkskpihbwmqmciokqmms'
ClassName: 'pnzyhfmdpewtujvvlcavhtsyryoq' WindowName: 'kqdbwonpwwxmkhyqdarvmkiyuksb'
ClassName: 'ndrqqlbexsvajjjpztebcerdcqrog' WindowName: 'ykibukpjhfnkfyvnhibzy'
ClassName: 'owlvlocwtudglptvmbxzfjolyklekxuvfara' WindowName: 'ispkufuarunmspkxkbmy'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'aqzgfllpkrzpvjoxyovdwssxrccismjfu' WindowName: 'cybwqslxypfnnzfsptmnnomzlierokt'
ClassName: 'idyndnvuttidqqkfm' WindowName: 'nytnljlkvqxjluylmqjyxgneiqqsgofputfuvyg'
ClassName: 'pxuldaognfnpcbyxv' WindowName: 'xyfumlcaohzvooepvfkyltnuyk'
ClassName: 'abwarujinnhxkezworryzfzzwuufsgko' WindowName: 'qxgqokmykfihrpvyfgsgsebdrqsclnxgu'
ClassName: 'xdtuzpobrieuiaicglroly' WindowName: 'bxuqxyslnydprcbcblrjmpd'
ClassName: 'ttcrukzewnyfxancsogpkhndd' WindowName: 'ftwltzppowaqgnowupmdtgeqzz'
ClassName: 'vhcuvjscymnxllbtysidicnmkjkfquostscduof' WindowName: 'jlbqnncxeodrctuydy'
ClassName: 'pmoaxxqvuzrsjyarwokupglkdtgbxciwaavoim' WindowName: 'iftdrirqbpykttjjasftkghyt'
ClassName: 'bzzpntfrbvonoidylrnahfjfmuzxauomuipjwff' WindowName: 'hzxefywdjovkhnal'
ClassName: 'sikbwdguvttlltikvtpiymwtefuzgashncxpyur' WindowName: 'voirfsmeepxhgrfb'
ClassName: 'pgeaeyftheuyecayjwbztyzduafoxwvfxidcnv' WindowName: 'ffjjtsusqzvvtzdvcigqsrlfg'