Trojan.StartPage.58183

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsv2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll
%TEMP%\nsv2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'dhctguwcvzavolscnsnbg' WindowName: 'hluevcvlgdqhzigldiemjdiyhxjqpcokmddw'
ClassName: 'baksgugbcvnkfsjx' WindowName: 'bixgyoofegupqvehoqqcmvhtrbiktpazz'
ClassName: 'bhhhsguilmmkntltlh' WindowName: 'hlnfglkextbznxt'
ClassName: 'yvlsduiwqqogturizgbrztxdnhrt' WindowName: 'einomzewkehsozhtaasunbex'
ClassName: 'ivkzaeplxilfzynmswkslsnegwxlccmlhw' WindowName: 'agcplynjgjghewkwbngrqrojlxpqydfaeovha'
ClassName: 'qfxucdlymwafzzoxcgdsfhkujdouvnqyfai' WindowName: 'huzabfglymicwkanhqmfrlkm'
ClassName: 'iclauectqyrwujbrssutlhjbegdlzce' WindowName: 'jjraomxxddjqxcmiiysjztrts'
ClassName: 'jwscoenwzfruyzbhmjsg' WindowName: 'ilmdnaticsrzjxzrslsprrjeoqtd'
ClassName: 'qijzsvgnezdurlfrexjnyqydmialuozzolwug' WindowName: 'txfahxxluqiraglnejcanwv'
ClassName: 'meivarbxucyyfhcpfrdbnzinyupenoozbipoixm' WindowName: 'xqksuxtsstubcid'
ClassName: 'gyqtrrwjeplmtzdijsrove' WindowName: 'zsquxfupvnxphlzhcvhtjwiadflwfuenu'
ClassName: 'xoztuiwwhcyxnexezeypfjntygltdwobrslrodd' WindowName: 'iyjizbeclvoopieajofhjjytxuajrbp'
ClassName: 'fmznntmqhmwycjri' WindowName: 'zldjyzwhdhbkqtye'
ClassName: 'mhvbrcgyyfqitjqwkkghzqmszrnstrlsk' WindowName: 'vrxlvgvxclqpaqnwzvlpobnjf'
ClassName: 'ttiajqcawxggboj' WindowName: 'vyqyrsslpxccrogaggcksiadyr'
ClassName: 'ybjzziwfmlabafnuv' WindowName: 'bcdqvvbxdefisxagfbgiqohveumdpoizacafry'
ClassName: 'krtoymrfnxcvjpvzhxdgncjgoddkfxesnsli' WindowName: 'slttvdogetekppmiaioonnmzhxt'
ClassName: 'xxbhdbvcqmzavyzafodikvhvg' WindowName: 'dqdechvqidweiyujwafreqwwxrlyrqbguk'
ClassName: 'ltfnyqydtonnfilnilkkclxci' WindowName: 'gzpelkwxxlxmvmpvrozqxdxv'
ClassName: 'iuvxviiokhabczoxdzpspiccsvwsxhanwyaitcb' WindowName: 'tlmgccamtklvbdiocwcdstvgfy'
ClassName: 'zopsaufidxlvxdeaoiuptqvcjnmrw' WindowName: 'ncwiermyxygkpckgkh'
ClassName: 'jfftevrjuysksbdcckvjfmmfelvn' WindowName: 'tfpyesqsjclynmhmr'
ClassName: 'frblmmvlcxgtarxipkl' WindowName: 'iomhlxtnwatnlgdatdinrjkur'
ClassName: 'xhocvstwhjjnkcpysphiddiy' WindowName: 'fncbelqafgdmesgizhbbertfovikaep'
ClassName: 'majmtuazufrtnkmijqfq' WindowName: 'guyhcqsprtcofcaszrjpdzajwsng'
ClassName: 'gzetatzmwpehlzsxdcjgwzbxnrv' WindowName: 'ybsqsznlpqoktosgstbfjzt'
ClassName: 'uckpbmgtiywwrbtpn' WindowName: 'bcromtkrshihkakxvc'
ClassName: 'yxivvdbwubqdyhesxvcadkgjtdoihyglght' WindowName: 'wzznrclfwqjvjnztee'
ClassName: 'fpkswrfrasyydffrvfxcvlvynsk' WindowName: 'pkhxtupdoahxodxb'
ClassName: 'rkjzzvqtxjjllhdutezdmnvpkjonnznjykkca' WindowName: 'nhjgfpidtuoarysobjxrpyvcxvdvzfihgchkb'
ClassName: 'ivleljqcyulhstyvbgyqbyxirxthozjst' WindowName: 'ojjhomsnzvjizlvkzqc'
ClassName: 'vqnjsinfsuqzotdh' WindowName: 'nxqmkdbckjmpjysqr'
ClassName: 'uotvbjmyjdjqzjdyi' WindowName: 'ycpviphhvzvdjvdrlbdhlkwsfaetwjadsvyzc'
ClassName: 'dnlfujgxdhkasnvrufuksqfzps' WindowName: 'bzctgsmucifwbqylgbolwudomqkdwgvco'
ClassName: 'ouyikcqpgemzlfbydpoqowr' WindowName: 'dctlptueypihpvjasplrvkbrwvozwguczuhr'
ClassName: 'jliwtghaaptxgakhtnyszw' WindowName: 'eyotzlpwtavpasgryzctakmvmrka'
ClassName: 'tjyalmwcnguldezudbuehkekpdjpneqntdcmq' WindowName: 'pzsbbcjdkccybwbulwadp'
ClassName: 'vpaxchtzodmcyjhpsfxnhewtjz' WindowName: 'lkwdqcvenagzpgekdgbqtgtyrkzvuatpqwkbjgz'
ClassName: 'zccxydyxvyikcdyeteygnhkalzxmu' WindowName: 'pgxebjphmptaepseogxxsgnbpqqcpjk'
ClassName: 'lhlxrzgafcujidlyltre' WindowName: 'voybyghelwghdvorfslmfjb'
ClassName: 'odwhanynduvfshxitmtgqa' WindowName: 'fujjhxhxmntzcnjxedozwogrgp'
ClassName: 'ddtjdopbeiusoxjhvruaqg' WindowName: 'bwrczkklvuepttqfyk'
ClassName: 'aphngsorwzcbezhvsbcoxoqwanzecyo' WindowName: 'agmdnokomqmaqzrwmkxpbndvctracjsviluy'
ClassName: 'ufdmmqtqsacndqcqmnjudeakdgd' WindowName: 'rzunmayqaddzqtjvyxsgbysfx'
ClassName: 'yycpyqzwkcyznttrxk' WindowName: 'cpbidxkmvqvzdtusckuafxinlzuowman'
ClassName: 'jzwojtxegbzimpuq' WindowName: 'qjlmfaterdgxqvzpnpuiuuwsxubg'
ClassName: 'uwiyxmynqopfztoxrwa' WindowName: 'swpnuynxhpmtczkcisafkvrrgif'
ClassName: 'kekggbwkqgdvhwf' WindowName: 'jaeelhlocrcrlhdcjdavnhhjqerzh'
ClassName: 'airnghueyusvishpotxilmhvnvb' WindowName: 'mjujxedysijfepopnhyu'
ClassName: 'ghicyywozyxqnljbtzarccjshxv' WindowName: 'visimfupasctlwtfbozwubde'
ClassName: 'yyelwzstfzebnjexcoxdcafntkhoxjfjuzxscsb' WindowName: 'rjxzbiprkqckvqnhnxnqdmrokrerpjgbwak'
ClassName: 'almwxljqczfviysugvwuknhvyrjzqjshfgudo' WindowName: 'opjtixujmvwysnbv'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'dnghtuicorlrssxsy' WindowName: 'elajtunsrgcfxhdwzmojbqddwkoqenjhxluozs'
ClassName: 'vvjdwftpbyzgvie' WindowName: 'tuaehdwsvjnpnfitjhpoggtulebai'
ClassName: 'xrqnfllerhlxwdbpzs' WindowName: 'jeaxixkksawbppemlddfcgs'
ClassName: 'lofqpeivvlihpbphdtpnvpyblrck' WindowName: 'mklulqqiiyvjwedmmripdpfojydkufsftqx'
ClassName: 'hsezmhjrfhnrnkqc' WindowName: 'uwcisxotvbwjhgxnnddffk'
ClassName: 'nhdtzxndsogxpwavxqdjrtmecetuwldgd' WindowName: 'vbimqqfnzitacbophoddwpgwrbdppva'
ClassName: 'xfwniuvpghenuemuogegn' WindowName: 'vpuvgvpigpweoasbnxpkyvbkwcdfplahkdjrlfq'
ClassName: 'sobwwshkepezuavqnvknfmadoqravn' WindowName: 'fgyfmgvojxlwelobibrsjdlxbidfzvfztuvlpyp'
ClassName: 'jfkfgjvbyqkchjc' WindowName: 'dxcccqyoqhgooctyhsxrhlyy'
ClassName: 'lsxsfgzjxjfadtsxxnmdxzwmacckfkjpkozde' WindowName: 'ooonyqbonwsooiz'