Trojan.StartPage.59406

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsc2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\Math.dll
%TEMP%\nsc2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'vbwqmzzyrrscbskun' WindowName: 'kqifdaidslqnxpk'
ClassName: 'xzrpgdruxpxquxmpsddcm' WindowName: 'gyxdsappmcgexzwjdkwmdqkqdmfm'
ClassName: 'keznhqhrirseitubsiuirjjwskilvqqhvdwtn' WindowName: 'tbhcwsbgmqtdwspas'
ClassName: 'mlyjezludymmlhebqalcy' WindowName: 'kgjdjnhogxsxpxw'
ClassName: 'thmsvgiuhpzvbyiedcnyxiaiwlxll' WindowName: 'ocfbysftuwkgzwjclvamndtpxpgccnzaeha'
ClassName: 'llzzefguofpxrxkskifebkdntmwpt' WindowName: 'roqdmzkmlwjxnxjwfnnrp'
ClassName: 'qcbggelsweuenjxvxhixbhslsodybvr' WindowName: 'iraldczukyqhcvbyeanuru'
ClassName: 'jdhyxdzlcoyzzdpygognsab' WindowName: 'wpugqlnvcgaumxn'
ClassName: 'znmdtqtjdojieeaaczlq' WindowName: 'nnccvskygpwcybdjxsp'
ClassName: 'xnwxcnjoqefmxetglixsxehdfcov' WindowName: 'vdhjyorcwbcoavpvrwpbmnoekhhaaffbewn'
ClassName: 'ouknsujmisfjzgckflfytbajsjcgutst' WindowName: 'hzgigkmwcequgbkcjuwmgzeoecihaleuw'
ClassName: 'ekibroblitnglewhckwezff' WindowName: 'uaqkansrrrpasaywlskjneeqpfzqalgpwvekdg'
ClassName: 'yqgznjvxtxhdqmddjstcirzk' WindowName: 'qzizlrztldiwspgurscarqudnzwuxgnc'
ClassName: 'bpmcqkxykvkqpjlgy' WindowName: 'vlqyajrfrziajhplcbkxhwfbasgjzglsaoss'
ClassName: 'aihfykchoaxfzqtkkeqwbsaqi' WindowName: 'maptgbdqlhqwcbjbgqghor'
ClassName: 'dgvwyptvldmkcoesgezexztfty' WindowName: 'yhdgwcctfbtqkntlctgoxjquqocaajfbgclt'
ClassName: 'zdvviwrjvzcpkeuhkbrkvckhbsbkrdeej' WindowName: 'zmxkbujcjlrbzgt'
ClassName: 'sphjerwrnvunfvnptkdszsxbrblidbcsjqyyo' WindowName: 'vetnuhjrmvbfepkdvbxoqglkvutoz'
ClassName: 'psadlckzfmpeuehukwzuatvvjxnwktlhtiabxzs' WindowName: 'giwtagzddrxyahda'
ClassName: 'rikxdiymamywasckernimvjykhskerbysuh' WindowName: 'xmojtgusjanrdsmdwqxutnmwrpyga'
ClassName: 'rsfuewkrqqiseuyughbwqljybk' WindowName: 'vtygnowfinfgsrjatssg'
ClassName: 'huilxkdchbqvovws' WindowName: 'wrgnxxjzwzkmzirzkvpluholq'
ClassName: 'kxzcljqmgonzxfhrnjmkz' WindowName: 'nfydrsendzcjnhiymmroo'
ClassName: 'dxagwjtlytsrixdiaueaainfxbfnlwhmqpm' WindowName: 'erpuxsmtkiwxvzccsifhheckxnxgncs'
ClassName: 'anblgncdxsbbzbqetvlqcvuxuhmoyylki' WindowName: 'qknxkzxylgwmckwzionyvleeimcvheqfmzroq'
ClassName: 'hcddaknlxbjjoejkmdjbwjgwsrfqaweknpgcb' WindowName: 'uloeempofeikcvnximywugovv'
ClassName: 'vhewufpprugjzhpvqsrltxbcbfhylqvbcqxfj' WindowName: 'rdtwpdvytdfadroqqanxxqxght'
ClassName: 'tfoekjfdiatusenuedltsjowuxegespnbkosb' WindowName: 'jpdogedvvcrfmewfbgtyczi'
ClassName: 'drkusuqzaynygbnjhlsmhxmmm' WindowName: 'urridwaizshxpxyirajwbhzfnxrfdunaf'
ClassName: 'kgvagrgzsddyovzj' WindowName: 'zmjmvwsezzlinlsharunheijvy'
ClassName: 'eqirjcakeahtabexwatavbstwfieochcs' WindowName: 'capvedgywocwbrmlfvgoktj'
ClassName: 'uwdoosttdlvxwonlvwpmrys' WindowName: 'awpnhdqfiutnefqxozmbdh'
ClassName: 'xiggdzasltsykqaepeuxshtoksqjxmmv' WindowName: 'qujlfbrjlemfufhxfsjnzsj'
ClassName: 'wvscfzvtoneazwgfib' WindowName: 'ayywytdrrspfprcsotkzdnjlfwydx'
ClassName: 'wyrxgohbazmtreahvcfkfdp' WindowName: 'wqkmzkuztidnfhmltlnroissrhuvdijqcnknqa'
ClassName: 'ejgobhdxqfkrbydyjarkw' WindowName: 'iqxktkathrwnbaehmgpjezqcikipydwpjzgqeq'
ClassName: 'tijpzqenjgvhkbygbawtnsbxybd' WindowName: 'hftrmanfhtsagszcnbyokdizkylthn'
ClassName: 'jwysgnatrmgynjupiholjmcaawkzex' WindowName: 'hfuekglifekhvsdfdrfeepjgyhdmktzqhfxxod'
ClassName: 'pviungytrzckwpiagqjqimxyqbsllzsa' WindowName: 'wkszilglkvjynwbenjmwjkwxznymajjnhhnppbv'
ClassName: 'ulqfhkgzofhomyzpokslmrbcmheudenklwu' WindowName: 'rzpayeevojzqwvmyxwbgcitfwevvatqjxwv'
ClassName: 'prgkzdcyljqohuenjuksqxwbqfzvqdpvekfyy' WindowName: 'kyvrtbegparspehuiqlfrsjxfp'
ClassName: 'plneiycdxdfdlbfqfgefxuubflokpbvt' WindowName: 'gkmugxovtjltknxkjqtexzgrfqpvh'
ClassName: 'xcidpnhyvwewqcipql' WindowName: 'yiwgujobwurvehqvgeyfnndcuy'
ClassName: 'wlicmjfbavcmsxfsjovohjvtlddry' WindowName: 'dslircnruqlgzdb'
ClassName: 'bbfytysiwxlhzsuprodlclmi' WindowName: 'iqrvljdsynsojevvwjyp'
ClassName: 'ptqylhnoobhgganfjhwivqlu' WindowName: 'aoepecpqyfltpcwakrdstvkju'
ClassName: 'hkutyxosmyeexpigcakmohm' WindowName: 'blofdxiflezhrfzppylzdfjfloohxhpsgrpztq'
ClassName: 'dojcteeemzwkydjsmqnirsuucsymtb' WindowName: 'avarjpllbdhruntcgenynflalew'
ClassName: 'qmrpeywwvpwexkru' WindowName: 'nwefvtlyxnbtuibkkut'
ClassName: 'uduprtwxafywlevgoxbiqmvbpmxf' WindowName: 'ejsreydmxuevvupqasdxusfhvyimwfrem'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'uxgojwqvzcjcgrpzyzevr' WindowName: 'bfzbybjgbzeafbpvgwytcjtow'
ClassName: 'atgckxdneaqphbtu' WindowName: 'ewihzincuwljxhwwpar'
ClassName: 'gupomidomdrcxekpwgueqtcahriis' WindowName: 'mzjmrcyxynmyhlnukxdjthril'
ClassName: 'wfywmulubimtvzjfouzkitjwhic' WindowName: 'iscpfiroskyxrqfixndwrjsslkbawzrcnkhm'
ClassName: 'cypnnnzsercvjhjg' WindowName: 'gcfqpgamsbdlewt'
ClassName: 'kwsmimcqduqddxgxyvljebbixhjjkhey' WindowName: 'frlatwbniiepalyvjhmajusdkhkpftqrzaqe'
ClassName: 'vhmudzbckwdknvqkeklvmhjrjgmjlr' WindowName: 'rvduulqbcnsvplunfhlupdpqnzgrxxgmjap'
ClassName: 'mtxsxyclbyfrlmsuxturbkbrgpcegooxwvzw' WindowName: 'figmmqjflvlhwsyoa'
ClassName: 'zipmzidhilhqqalbedgrwzkoagktmqrz' WindowName: 'hbzwkiwcyhstpqlzsmw'