Trojan.StartPage.58750

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsa2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll
%TEMP%\nsa2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'fuaonlmobdanlieqoizupgtlxa' WindowName: 'tytugizfggriezsgphymgvdnjcy'
ClassName: 'meqbsxxnxdwkcflopuzrycfewiryftcx' WindowName: 'vrpzybmijfybcvw'
ClassName: 'uhhfzljwxgaethxrwnega' WindowName: 'cdxxphyjdujtfcovbaixmspjjnxl'
ClassName: 'feuafhltebswwevwkujwczmgtaymnsvkcjkgijz' WindowName: 'znfxsfnralopsikygvpykejpbdgp'
ClassName: 'qviqcxyewesnijflnrqksrzf' WindowName: 'darlsatuklizfznpbokdivqa'
ClassName: 'vbavcmsdgauyxufanhgyus' WindowName: 'zkdtucusphwvhvnowvvaqdutgfbcyrsncjxz'
ClassName: 'ddnmiaosjwqnteeigidadmzynbsin' WindowName: 'lqukhesqriygpdhvghjar'
ClassName: 'twcobuwdkxnjekb' WindowName: 'wximrfjdttsxoijbakezdnjkgocomniqrpifxjg'
ClassName: 'gjeuigwnwzrvwqzvhnlrsgjfnpynlqbolbzkta' WindowName: 'wfhdvzwuqyltwwvpravurllnrlbpykddxnwijwh'
ClassName: 'ykvcwwqiwdflzutjmkwftvoklshmkpw' WindowName: 'nktkamppbxotmeilrpqermttmifxwszshhdcp'
ClassName: 'iawqxbohoqaoxjjnackhavfivhprgfrt' WindowName: 'gajazbkkexjmwvbyjndnkpjupul'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'xkcmmqfcnhoksxfmthb' WindowName: 'gthevbknadtmqbovkihjfgjlbioi'
ClassName: 'mvdzvyibttyzqwmvzpffpszhfnwxukshpgzdqkk' WindowName: 'dvrvyonajamylracelbfs'
ClassName: 'irjzuziwkcbpewxtgmzhnezpnqopnjqlooqqmgi' WindowName: 'enfncpgtgylffvmpf'
ClassName: 'qanhvcnqlseyhevahptbjr' WindowName: 'gonqabvgduleihzvhvmzfqxz'
ClassName: 'ypthuzhwjuotrtzipkgctnrqtbfwcu' WindowName: 'gaftqzeunhwmszlmbo'
ClassName: 'uhzamqscggpmiwtadmacminfliypvlpww' WindowName: 'levampwffhwmcbubyxvggckvh'
ClassName: 'srfypgrqaraoxvtbobjyx' WindowName: 'iefddtbbgxvxadxli'
ClassName: 'ufrehxgxckgbtxistkxyqimyg' WindowName: 'ctkutemwpgzscrmbxhlxmdrpyxi'
ClassName: 'lwcuytkboeuawpea' WindowName: 'iajxpcccqwwmycwdz'
ClassName: 'qkfzjmyujbsymmswcjvakgejgnilsc' WindowName: 'mkyvebsomoewolkhiffumep'
ClassName: 'uopkfazohjcvgubpsvizkazieupnsk' WindowName: 'rsloxjudjfsvnnwaksaqzhukksywjezlfcadov'
ClassName: 'ykqdkfodrbdzezyolytkxanimjobgxhigupns' WindowName: 'ncfdluoheqcdpmyufzspowa'
ClassName: 'rxodrfzgxdiasfplpweyqkhqe' WindowName: 'melbjcabpogqegicuwhul'
ClassName: 'sqbkfzhquruzczmndbkfay' WindowName: 'cxijgmsviknvaun'
ClassName: 'ebxvsybshnkwwdfkuwxhr' WindowName: 'xknsrxstzcvagpvbupjltrh'
ClassName: 'lfwqzgcpsoouvjvjgp' WindowName: 'ekfholpdffmvecwjhklxx'
ClassName: 'lsveqylboeqcfaswyqfbnnoc' WindowName: 'llbcqtydubkyylhsfrjbiutvilahkgtnotyqqa'
ClassName: 'brfxeaqhxitezmwpoya' WindowName: 'dzsnzghcwqnehtsyhqiju'
ClassName: 'wnxldepkeuqesascehcziuymyodqjdivqvosa' WindowName: 'lttftwgdeuivrniidrospybq'
ClassName: 'hfgokrgvynxtejxpnxjidgyfrgpbstwilxjxo' WindowName: 'opvwjpvggeirfvjpndgpefsumdypkmuttanyr'
ClassName: 'nlgqodmswhgrjhgacwqhfqmfi' WindowName: 'mzggsfblelcfvzrhp'
ClassName: 'ngqbxiekmahycexyanltmhbbdc' WindowName: 'isfbryahdadzgzqecvmyypesk'
ClassName: 'gxireiuyfjoxffxtotqyexguhsupobtcehy' WindowName: 'bvixcfivivxoeeqxhpqeuwqywtqritw'
ClassName: 'llrmdjpwritokoybaalxbfttalipsozyst' WindowName: 'xedqpwhdddzhgpopfxzkup'
ClassName: 'qjlcuexwdsyzozlbrwlo' WindowName: 'hogvbrvlfusctautblnocxcenhigembjoozwfi'
ClassName: 'zzwuxiploahmcyxdhlmbbagk' WindowName: 'tayujxqhprerxsfvvesftqqhrxjqfzec'
ClassName: 'uejyvfdnijpwmtbbxcneka' WindowName: 'elvctpybdjtzafxcdeawvwietydbtqhad'
ClassName: 'rhzrspocmijxscpmyszmihjolxuhd' WindowName: 'qiwynwadropbnjsxpyfadfdxiw'
ClassName: 'awobmpdbxgvkqnboksexi' WindowName: 'rnqperraontagsqwnytvpooyzvqt'
ClassName: 'dkwoadvryvgxgjlsql' WindowName: 'ydmazroircrmqugfkeurtopyvuwyxwobjthoo'
ClassName: 'spnrlxnkpnuimixmifsdju' WindowName: 'yawjopxvqvhytaq'
ClassName: 'hghksyuqvnaqdrlabyeeu' WindowName: 'yyirnwrqjwisllgkyunbzqtzjzvkz'
ClassName: 'kqwlrgikxkazkszadqksaccjzh' WindowName: 'ltqzrvxypmglwesefajin'
ClassName: 'zxhsatprloncwfongfqd' WindowName: 'tdkmsaeveotmdkdxxjch'
ClassName: 'jacctummtrkhehqdalfqxrfehrgdyjj' WindowName: 'vqhvfucaolokbsvieclzbfoangydvsgmrnlmal'
ClassName: 'cuosonuubjkperjcknbhrndqfcpejieyhebb' WindowName: 'jsngjnmfnxcansomqfcwaxihmx'
ClassName: 'vqxzuhihfoucpixumfy' WindowName: 'qhuwyqjdajqkpxy'
ClassName: 'apvgckqyrebuzpnqqnu' WindowName: 'lwfbkurvicntyootsfdprummrcxgmad'
ClassName: 'ydlyhnnfowuifbqsgoxaumxcwpdhkwtepamwml' WindowName: 'xvylnjkbvzwoqhkpsqzikoucjmeacgymcln'
ClassName: 'fzesgxtoherfxxlluxzygnofeatobhllhkc' WindowName: 'lmiwtlmbrmnjggkg'
ClassName: 'adhfwlzwuiuzinjhanveohh' WindowName: 'ydeodurivvbnzqgrihdppmypekmojoljouqoyjt'
ClassName: 'jjgodydxkrnzghmngtuimj' WindowName: 'lisjhkxnllhublmophfgwahdnmdef'
ClassName: 'yzpswnqxljxnsrbftcm' WindowName: 'dxfniahpqvcdkbbzoeqxmvarunchggpfsbmt'
ClassName: 'lhuujhyrbeowmbjvgqm' WindowName: 'jqutjudbavyrsslyklwjlwlltfcbhu'
ClassName: 'xdsvuikjevcuhvozrviptmuegxjhrtwltjs' WindowName: 'tzzrqovvjfxasallijixnvhxmrbk'
ClassName: 'fsqfigcexrhecilwkmhftjktucpubdwimdbz' WindowName: 'siwqjunvjbmxsrnxehifbnod'
ClassName: 'hynqvdbcgpajjcwwrgxrnn' WindowName: 'zpfthovlwylhimmyzufixicasekbus'
ClassName: 'yrvnrihhmrikszx' WindowName: 'gavwncuyzkfangkxqpjviknlfvaujfjypwt'
ClassName: 'vxjwowsptdjyezjrpeebqhndyhywnmaeeqyls' WindowName: 'kusjxxudmmxittvlifckxocjhdv'
ClassName: 'trlizantvkodokktwpqtwfc' WindowName: 'ilvwjdzfrvkjmkjiburooptcnieftyuoptd'