Trojan.StartPage.59159

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsi2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsi2.tmp\System.dll
%TEMP%\nsi2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsi2.tmp\System.dll
%TEMP%\nsi2.tmp\Math.dll
%TEMP%\nsi2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ghjonapfzumucripfzdztfdbjykrmbahjhv' WindowName: 'cjcsbxxrrkkykdzk'
ClassName: 'ewyyfimglwtsvithzccrkvmlgxheqqmemxhfpna' WindowName: 'vebnwdabfkthdacskxfyuzsbamkiqwivxtsei'
ClassName: 'gserywjhcgvutaymkcnqe' WindowName: 'qrpcjgfxoxrgtixbdaph'
ClassName: 'idxrjwobxupvrooxjhyewvcizmtjrlad' WindowName: 'khyujfawnmbtzxmxoiwg'
ClassName: 'avgstucdwkwfkvwxceyygsjhktxdspqgvpbqmb' WindowName: 'djyquvlimgvqhtdwzbtdjorlapgzgcvlcmajhkb'
ClassName: 'chasbfdqlztxpktwvpsjyjuccuvwbaqmljbkftx' WindowName: 'eyztwslzsecdmoitcqzuwxrqkfe'
ClassName: 'unpximytkiumtbuswycvdufnyigeakdegzme' WindowName: 'qhgaxcwumdvlbvbwwozbmyhubmrqqhkekckezy'
ClassName: 'mpclebxwuksatlluvs' WindowName: 'ocevuuetetjqhzuxigzx'
ClassName: 'lkfsubhwuiuojmpsiuqdsyxl' WindowName: 'acqibvygealwvgxvvbxmcrqcebqregadiqwt'
ClassName: 'caszbfjakhkfjgmy' WindowName: 'nmrtoucodzdilrzjcawyi'
ClassName: 'xoburbkxvlqvonzkofjeuwqamsfdg' WindowName: 'xrunefilevujbampils'
ClassName: 'uwkgmszvmyqmxqficfosktmnqt' WindowName: 'jqfyrrfvwiwenqgdtauxwvudf'
ClassName: 'qidqgdjvldhhyseqofruzcluesxaeoth' WindowName: 'pqeopsgkzsskjhckunhq'
ClassName: 'ullrbfkpprztfippsvmkw' WindowName: 'txqkycxxrytsizpgvocdpvrqqjqggivo'
ClassName: 'husljancdzlfceirvjmqwbxbzyjbxjlrhkuvfwn' WindowName: 'bplfrfdcdgpruyqnwritejn'
ClassName: 'marpsfckhnxryccer' WindowName: 'ymtoiuxtpuinqfqykfjtvnqlooudqaidph'
ClassName: 'zstmbcttygiojunywsuy' WindowName: 'deeupvsskdsbauzsddop'
ClassName: 'hopxmpoycekjmmlbzmoodpkwfpit' WindowName: 'wwllmlzxtggykqiot'
ClassName: 'fdvipcgadgovzjcbyhzrqzbubzlezaanimyjuu' WindowName: 'cjugfadtwzrwjgygojmbicxp'
ClassName: 'wonubybeaoprzxicftzeu' WindowName: 'qgqeigevlinifztmkayhholnveyizxh'
ClassName: 'cykhaajyiytqopskjfuoumtntywzjqft' WindowName: 'sdrtcwaczjnjtqhqtxirbxidc'
ClassName: 'qkcntuvpviczvtaawjyqphhxlyyoecer' WindowName: 'bsaqfbaaffxehwybxweemiqiufgzojqtdrsle'
ClassName: 'rszmyakpxnnueufvpryxqnfwhqfavxfv' WindowName: 'hfungfgejpdowpoyjdycwfhptnkagngqhugxi'
ClassName: 'tkjlgwyhpldpruxswxelxfiom' WindowName: 'rdcrvgqzngelqcmvvanadetudu'
ClassName: 'jhvyirlwrvudvgobiojaalkknpqaxlqbkfeteo' WindowName: 'meetfnbxbfwihxgogyndamkp'
ClassName: 'qgmhwgthdxgealcezbckkhkietdrmwvb' WindowName: 'tarfnklzynmmnzavazcnbwzkuxnqcrjudo'
ClassName: 'xzzgpuqruoiupkqbdionkwxukcbckbaqg' WindowName: 'ufggjjunncstmdveredsztujbots'
ClassName: 'njcskfucbbaixpnxwbgbpomumypqhgxc' WindowName: 'oumcdplhwlpevsosfcuhrv'
ClassName: 'kaejddrzrixlzwwvtxurdbndmllc' WindowName: 'spwiziylqqhkhrrpehidjuvcdxcrzuyekt'
ClassName: 'ibdmtaorwfvpvvgkxj' WindowName: 'erhjoyxpwdimyfdakspphy'
ClassName: 'myuazqtaybowryly' WindowName: 'kethanksidsywvhpunjwmcwighyyfpk'
ClassName: 'esqwyagmejevprvz' WindowName: 'nzmgturfbxwvoujvwzsdwkqskra'
ClassName: 'armujzctdbphqqgnild' WindowName: 'myrwqyxpclhisjydj'
ClassName: 'mjwzersrjjsicfbxlveyu' WindowName: 'yqkfjmyyjwvgiktoldlncosqkcqrkd'
ClassName: 'wlutaltcdtxdsslsleazsc' WindowName: 'fmfasqhcymastustqpsdlnwcpvytkllyva'
ClassName: 'pelyjcdaslizkaekfyhzqjxtdnulf' WindowName: 'qslmgaundzbopnbfmillhiez'
ClassName: 'mgpzwalszjcnosa' WindowName: 'jawqvgymwbfkchyuzzptedfoblojjvl'
ClassName: 'lpaeyebhvtltqwhc' WindowName: 'hlnlioqgszptsrp'
ClassName: 'msooqcogchfvlprvmhruxlwwufza' WindowName: 'nwooamcvvzzmwnqjfldjwhsvmjkrx'
ClassName: 'twebxavctnuliozbdgmrxtssofortobgmaemwyw' WindowName: 'trenlsyynkdetiylybjp'
ClassName: 'owdnelejeomluvetlspyrnwueiw' WindowName: 'nlvbnmcdtljwcexrb'
ClassName: 'ebghjlnfqukompjoysi' WindowName: 'swmqihhoyxvfempjdbpngdqnyxdha'
ClassName: 'dtolmhjhhxwnuxbddlmpkn' WindowName: 'yvdruyrkfcdfqxehhrnldyvensxasgqktptnmmu'
ClassName: 'ktcioouzzbwoipjqmdpfrhhgyxvkjdfjniuz' WindowName: 'geypehwtipzgkripxl'
ClassName: 'ksenuhgwwvhzffsdkdxgqydmfj' WindowName: 'uyqiifktgnchejdvrcmb'
ClassName: 'zljfxevtvccebdrzyzhtzuroqhyplhsreu' WindowName: 'mwtopsohnroifzlmqaurcywp'
ClassName: 'mbvwpkoncpdimlkhhqyrtkqcaiqghithvjiz' WindowName: 'xbtrjpxxammvbccsyjbfzufmzuacnflqtcodblg'
ClassName: 'sdmmdyxbyskwldeejftjiowmwedxxpziw' WindowName: 'bqwwdymikdsqnwclcquqadoxppme'
ClassName: 'fxmatvougnrekbswyqqjvwqvyjfpt' WindowName: 'khaaemrdkytttmn'
ClassName: 'ajvkqjozdkaytordrvxgfzspczcfgxm' WindowName: 'wiofnjgrptpbzzrfseqcoecrfaw'
ClassName: 'kaufyrxkrjsmxaqvzaxmzlswsspidzbivrkk' WindowName: 'kyssjrgztdtdpeaxeqfrmfgellkikt'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'gaartmstetakogpiszfhxixjw' WindowName: 'hxykvknlsvwxawqonhrjmhex'
ClassName: 'wjpnrzysjrvwiqulivwy' WindowName: 'pxthgfmauzmmnbdgtunmntcsutlhk'
ClassName: 'hacjiaenbiwvizuglsi' WindowName: 'uusdkysjttjzyvcsgro'
ClassName: 'fnajyupejrsptufiwd' WindowName: 'cxzhyglrzqdsghjuxbirtkxksbtftvtcskcfw'
ClassName: 'bkikypxxmacihtepprta' WindowName: 'dawzhcjnrjkwvzetwrawahjzj'
ClassName: 'nvviykqndaszqqrsekdgeh' WindowName: 'fecticeezjxrkdocghejpxgjdlfxdlyysxmhks'
ClassName: 'lewlyvpoouyfmoithpyfjomneusfapc' WindowName: 'qtdegjpgmyjrzilbmugljtgjdhpgkykoirrllag'
ClassName: 'fgjbteypostoehaiiwjkcpqpnsosdayspyzvdue' WindowName: 'ttdsadgpfcdhlttaaqptbozafydhbenbgtznwaf'