Trojan.StartPage.59029

Техническая информация

Вредоносные функции:

Ищет следующие окна с целью

обхода различных антивирусов:

ClassName: 'whlhpiuafxoijjavpg' WindowName: 'kmfkigpvilxyofbf'

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsc2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\Math.dll
%TEMP%\nsc2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'qbdsnziipzjutohsg' WindowName: 'gdedbgaqehngqleebygq'
ClassName: 'yllflsxppqltduksasvrhfguawuleeqzinmx' WindowName: 'zvsvnyfpbgzmbdvelfb'
ClassName: 'xfevnqdjavdibtkefebvctdesthdcmazmhj' WindowName: 'qmhzagwdacjehsajbvgiz'
ClassName: 'uvtmthnytjncufblvfyrrhepfda' WindowName: 'xjrdhkbuajyqtcc'
ClassName: 'gjelijzueyctatopiintqkku' WindowName: 'xdqskttonfrzbfaohwtgorhuwwbhsyh'
ClassName: 'xxoxumfdziopnqsq' WindowName: 'jndatahizmwhbudednipxqurcx'
ClassName: 'askptmfjnqfmcjb' WindowName: 'paaljctlvootgwepguq'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'gqiogxpjixldbffzkbhogekgsiimcrwfstxgq' WindowName: 'izrcelhrppeuklkmxskxlackvpjfty'
ClassName: 'fzkgsugreotryzllzyasd' WindowName: 'kcsdzappbgyalsccdjomvtdemmgcp'
ClassName: 'kwfyxkibhikrohgho' WindowName: 'wcmordlzdquuscvcibla'
ClassName: 'nomckdzgyitgbmhomvlxuuxnlkagkzgkaikk' WindowName: 'cnugwoebwlrsfruufvype'
ClassName: 'fwqudlmzzdwvwpwclxeywlouhfalw' WindowName: 'aklabbvtwhqcdvyxwhrvxlavotaxzyk'
ClassName: 'hvtyylqhbkdyektzffqo' WindowName: 'sblygivcgwxvtajxntdxga'
ClassName: 'xzhqfmmexmnkkjejhdfxmuorrhmcdsmhmcngzqx' WindowName: 'lcwajfjszdgfurlyicqxdnyiprnna'
ClassName: 'xrvrklsymjpkrnyc' WindowName: 'hemloewnsnbbsgtafzfnok'
ClassName: 'oovqgztklivucknrjwjlghnq' WindowName: 'mmthcpmyerokogvqjqfyyytdygeprc'
ClassName: 'kiypfnxcibtqsntl' WindowName: 'fhlerzoesaakewjkarcthxdafszp'
ClassName: 'nmehwcezpsnjnkzwdtpqwrlesojtsn' WindowName: 'mxyhscgyvcsoyiwmcjnzvkgbvrdvxsfcurm'
ClassName: 'ecueyeyyewbikubnhvwqielcwkkz' WindowName: 'ebsrcawuqwgduee'
ClassName: 'joqrtmsdshxuqbxlfg' WindowName: 'vaxepbzgrcbqllidgxjgzdvqyrszewicsjyj'
ClassName: 'pzvjbznquycgbbzwfakmpm' WindowName: 'qunxafaqjqskwwcygmroadhg'
ClassName: 'okhkejoswknjjvmwuvnsdff' WindowName: 'gemgbflibvefkohuglwmmaxunqgqwmvagizyiu'
ClassName: 'disyxpwwduwgyuenbxppklaxr' WindowName: 'uzxbtogwhaobmqekjwodxncrtpnamisqdlzp'
ClassName: 'pstjjvrauuqokgyudjbfejtokbwavkdcmh' WindowName: 'hbzygsrequamnlxkqwrlufk'
ClassName: 'smbjqiqvjbcbrrfxxclbqvtiowxxnc' WindowName: 'fmxtvotwraunmtkqhy'
ClassName: 'putkhwftfsbsktcduodqrtaufxraytgl' WindowName: 'jyazoanhmfflvftybjpdmbdpnxruymwufhtv'
ClassName: 'rhaljcfmhjysvbmyafwbdcetbygscsbhrt' WindowName: 'zdrhyunkxsrfbzaqolrgrbw'
ClassName: 'oadfirlucpdgpysyqnhkiczqufvzqir' WindowName: 'slkrrebisnuhbmnspcbdkavjegqerxpmvzkbdyr'
ClassName: 'dejrkjyzjejwuzewiousgplosszlqqksv' WindowName: 'owersagrahgmhcwkoasd'
ClassName: 'wmiparnbetmpznquzelkm' WindowName: 'yajbqejavbinmvfbkxbfwlowrvxwrsislv'
ClassName: 'jztrcewunzbibsunfsgkxlytycjskgldxbaafn' WindowName: 'ohnqgeuvoffyfvrdcfmzkrklsbranxhiymnp'
ClassName: 'cynsvuecnqroscbtzamihvxqamwlt' WindowName: 'wpdbmpfdkqepoqtogavmyraipvocohzanfrovt'
ClassName: 'crpahzloiclflkljhkdmzhzmdmcmvuemyedfkd' WindowName: 'imcjbhljxnwufwpsbaeousdfdivemrcgewfp'
ClassName: 'asdvqdksczdfngbqmdjnpfxa' WindowName: 'hefrynzevjdiwhpnottslmsasqnugt'
ClassName: 'cmsfvsnppxpfqaeonnmjnfwokgfjyjkx' WindowName: 'rxmxxfdvqtccjxnsprlptsreteneccis'
ClassName: 'ndjxycfrcskzpiscjhtscdf' WindowName: 'dlwwajiwdbmhkllxnlm'
ClassName: 'uplspaxcbcgdaaova' WindowName: 'zhihckfnmizojeayvhcvwmrhcdllrah'
ClassName: 'oennakhapjuhkwznvtcqvfycnnz' WindowName: 'zwqmyefjjfpykorqcxojngwuaca'
ClassName: 'cwyouvhenpcnlcouqf' WindowName: 'znubrtefgwptrvwgbcnlivulkeekgcai'
ClassName: 'bzvcmjigyyzqyvrzghylmgq' WindowName: 'kchfkjxfihuxpnybgjstdvbuumxhqikvtahcwn'
ClassName: 'kxjlsmaheufxuxogeeiyfzevnmbnoqnfersyep' WindowName: 'rwelsuthxoicrnljo'
ClassName: 'ndttvjragtcggompjxxmbisrkllxrbtisvbcz' WindowName: 'umwrbsynbxzkdcrg'
ClassName: 'dxtpdwaegzrsgghj' WindowName: 'jcpeboaplnzcbcvrafwaqyacs'
ClassName: 'nvqtkokmwieebgxnsrvgrulfqkvzogvxf' WindowName: 'dweckzjgkbjxbzsgisoyttiqxrtrzoyfopbma'
ClassName: 'rccmubjucfbgcgtbekgnoqbssmfoqyffy' WindowName: 'jgwllawdszwbpweyfuttolafyfwwi'
ClassName: 'dpefmrzomescpjbuhakx' WindowName: 'uxtrelalztfgashi'
ClassName: 'lrmgivgvnpqrpizgslhysbbraxxohninkdkfy' WindowName: 'vxufmyjoyvgbgpsdqjfkspm'
ClassName: 'fjvesmugvaguipylrcxopvpgyiutpoaunjsjcj' WindowName: 'rztgyznrjyhptoxfqk'
ClassName: 'rxocjpdiwdhkuxtkgesgqfezekpuoechdpki' WindowName: 'bbervokugvkkbzdhpljq'
ClassName: 'rgoryabjwmhmbtonklbwwvubmxzgexh' WindowName: 'hxqjrsxozwhpcwlqfmiwfhsbpducrc'
ClassName: 'pxttmjxmmyfcvymnayzkiwubdgfbgph' WindowName: 'brcrnrcqqwxxionvnxljhcyjpdsbazgvpte'
ClassName: 'vtawahxrrovketgmxjvjoplofwbmqwyuwyevc' WindowName: 'vdszhyabeiugwtmbjbuehthzwxkwizknjukni'
ClassName: 'fwotphejvartssgijbwhzgaz' WindowName: 'nsfibhveslbygkgbzmmzdcoasczwrhuxfvuxdu'