Trojan.StartPage.59555

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsm2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsm2.tmp\System.dll
%TEMP%\nsm2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsm2.tmp\System.dll
%TEMP%\nsm2.tmp\Math.dll
%TEMP%\nsm2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ykvbfvmfigiryqp' WindowName: 'tquazynbbaadbhfghdkzks'
ClassName: 'ilvclrknltjnuumebpwrwkohvrvgxobexw' WindowName: 'dqljtwgcwqoetxz'
ClassName: 'vchubhbkieltxvfhokvksoapmksudtuwxv' WindowName: 'evlgvpmcbqdrzvfbhkstgeuhiwxep'
ClassName: 'hsvqmwqmkrnjzyvvsb' WindowName: 'nxjtaxmoncjpfacbcejfw'
ClassName: 'smlmkapnjzoyidbmcl' WindowName: 'nezsdjjrnkkttctvit'
ClassName: 'ivehyuoqrqtjtmnieidcznfy' WindowName: 'gwxobohavqicfpuqhsv'
ClassName: 'gdnivykdlpoijimuodnpiqpipjfdsv' WindowName: 'fdjahdrtujdmrzompwqfkq'
ClassName: 'hzkvhxqjswwbogexubkjrmnoxfngawttjvmhdq' WindowName: 'jueljtktowfrrcwcggiguw'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'uifcwlxcofsyago' WindowName: 'cvqwbxqwlwxlonhnnxgdhkrkokcjbvrluxuzi'
ClassName: 'pmdgjfgllxoqnmurxe' WindowName: 'wormgyyrkizsspqqw'
ClassName: 'tcicnxnytsecybojcgxvniduufzauepaa' WindowName: 'uthtprsrrbpzkujkeztnlvfyjeecmio'
ClassName: 'zhugjgnwqdatpyjuvt' WindowName: 'nauymdxxuoembczitmattjdvnkggbyqe'
ClassName: 'wngspsaixufjsgamokd' WindowName: 'oudvwqnpuqnexjawxtkeeaipmvbtjyxjausjjtq'
ClassName: 'lpoiosbzaroieyxxwaacuvobaksttskobac' WindowName: 'siltwfdvniradueecgghyrit'
ClassName: 'udlnemgozpglneqmusgooxdkvcvxjp' WindowName: 'owwzfraeqphzskapvuteqglggjlihqii'
ClassName: 'skhqsizrhyphaiqjdwqedfevufucguzz' WindowName: 'akbgmvdcmtnwzanbisjwavggwzsfvyocaoro'
ClassName: 'iwdiqlvlvwgnewtphynbfmscusrgze' WindowName: 'cjbgaripdkqeinak'
ClassName: 'juhuzcfjnguambh' WindowName: 'zoplcbltdxlcauskaaxyojtsecc'
ClassName: 'yynrvhnablkzdgpunq' WindowName: 'tsunuuwdezvnpypkcqdsb'
ClassName: 'mgsnojkvtfcsaczmgluinfu' WindowName: 'socqcavlhggoufrkrwttgwvhfegfxmmacgyfnpb'
ClassName: 'exrxphcmirnbpubzxwdajyscgfckpydd' WindowName: 'evcahchyrpmzmlxkcsvxrmpazofz'
ClassName: 'sxziglqxbhutbcyaxynsbcotzgrko' WindowName: 'tnzuewtbapzmttamsp'
ClassName: 'tpscmazokwawfehyquwbonmqpkqhjizpgfxibw' WindowName: 'gvpoqkdbnuextkeiopqymzfglvrk'
ClassName: 'fceeqdjxfnddcgoyhrsskfpzat' WindowName: 'lwwicchnhzmgwndkthyj'
ClassName: 'jnojzamtgsxdnrndrikikdq' WindowName: 'kgbxkhweufitebdfblojysfm'
ClassName: 'sdrrnpmevtlmujysmgkxbhbfwssljvbbdtcm' WindowName: 'fzmxsrxyuxyeljpxwguxhnux'
ClassName: 'vtkqrenjgrbntdxegkktuopamoiwqiscjiorfz' WindowName: 'begkrrjlkpqmfoyvbsuppwubjbdtyizvhocz'
ClassName: 'sffzjfuanowggubnapzdigjppdicpxaoqxadtp' WindowName: 'sxnbhfrnmcxmybvbxcbuvcsqiabkeajj'
ClassName: 'ockfxmziidkudymnsxmnvkwxstiojuzxfr' WindowName: 'bagvarendvhzcqllrisedlesxtjgdeeawy'
ClassName: 'msvnipmsasacknkjflqfkypzkeqv' WindowName: 'gnlfdaeuyyafjajjemglbyqttvaudxclydpa'
ClassName: 'xzdjqitwnmssjktojsqecracpqdpbatjpui' WindowName: 'bksujjrgcfzdjyaghykdjbeynahoaoblhizva'
ClassName: 'jgagcqcbqajggncnmdyqdpiir' WindowName: 'vwelztdudxjimpvrvnqb'
ClassName: 'oldrkmdnjoqdxfbzjo' WindowName: 'khprpgzgkrvvogkzrbecuvwuhpfpgphdbsaxei'
ClassName: 'muyprxnuigmmlmcjqaookpxxen' WindowName: 'iscswnirargeitpjhqzkaomtrkgyxzdkcgups'
ClassName: 'gnngogzgtzchvpjcgdgryhotouerjknk' WindowName: 'tilpjqtipoqtrtsndqgcpdccqp'
ClassName: 'dfvmlgafqzaktmbthffeguursxihvhrbqayjhs' WindowName: 'ewsiwqayybiruribvphifafwyqtfqcf'
ClassName: 'ivbfmbnmljrmafqfvkhuwjlotjcrmoljb' WindowName: 'zshmkqbkpljojgwsg'
ClassName: 'ukuivuxhtjvchngznhnt' WindowName: 'wtvtfptfekxtncupudcnyopk'
ClassName: 'ivbsnlblemxvhmumskupvkfllgmjb' WindowName: 'jvmvqralbpolmvcqzhuflumlhrcp'
ClassName: 'gtemqhfwjejoscvjygdoobpqfenfkpzzb' WindowName: 'ficwlfmtjvxdkpwwdqjpwiddgutbcpyczqmvwj'
ClassName: 'qsjrydtjpgqzocnanpvgkccdkpkvutibkcd' WindowName: 'fnwqlbovbnwxgsckllojsiqfcvvkibyjare'
ClassName: 'vncljhwgpyyovqfietznp' WindowName: 'eaunhyfnpdcehxuz'
ClassName: 'gubbwbofznvremqfkhdlogkrt' WindowName: 'zlzfecuplrmsltrzdlqgkaqlbzfe'
ClassName: 'ldnuvfawxgourzvwdmg' WindowName: 'pfuktuhtrrnsorvhxrkmibanvdgxfbjrh'
ClassName: 'gpelvfcivuqcntqkghlcy' WindowName: 'fystxxreigjyljwc'
ClassName: 'swvavocunduuztm' WindowName: 'dwqcnjwhraqqnegfihtsgmprrtborraugsoyh'
ClassName: 'eslxviyoqynlxaorhoggvalaeqtpltiiaziqepl' WindowName: 'rixlmanfvqeogxknsyiqjbnpahiohjjzthtu'
ClassName: 'trxlojzjrtbrvdoaebgdbfklurbkubgevzptob' WindowName: 'rcmqkpbeakulvjrhkzlkawajtvgnvrbgembql'
ClassName: 'qjunwvpabeeyhyqdssjzwaygjilddasqktnnrb' WindowName: 'wibiucbfjajnlqwjcfieomqlnbknppqhe'
ClassName: 'uopgklimbxwcgoz' WindowName: 'omgdcpkbaiyamyzqqhszjyswxesxm'
ClassName: 'tywwamzqhonlyzdphtwjnaphfkwl' WindowName: 'vtagsatmrzxfvwmihrwwxnpjrgjtqwtdrmj'
ClassName: 'edecikorpumxmizhtmz' WindowName: 'lkspywlwaafsvkurwycgjjnfrkxh'
ClassName: 'sbxvexmxxbikhxpadskxwqw' WindowName: 'dbqpbsoxngbjgeqtdwqdkbtiqvesjwtj'
ClassName: 'xzfwjlilulgyfxfapnvmh' WindowName: 'iafeojigdfxtknxtulsjqoysdzxycdi'
ClassName: 'ytiivyyxtoredwqemnmpmiszil' WindowName: 'jeqxznfcdwibuqhuspusibeezqcnmgoaut'
ClassName: 'wukjyrazfklmvwswumxoaxfpajdpkp' WindowName: 'ufrfkhasavhbgaqq'