Trojan.StartPage.59155

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsa2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll
%TEMP%\nsa2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'kwgpfjwtchoafxffxmxrbwe' WindowName: 'ehugtazbtwikxijqihitzwnrneqzrwdjvm'
ClassName: 'nkemazpzligxyltvjqfvsfqpgahiubxlvttkyr' WindowName: 'thedaakrpnjxibu'
ClassName: 'bqcqepqhhaepjmdmecqihjxi' WindowName: 'ffgzmxqxlxtakailtvbzubcjcezdrtbwmrdh'
ClassName: 'gqasotuhpnbacktnw' WindowName: 'annnwgadaxdglmyyhwbcnhtfkejhnwgxykcc'
ClassName: 'iazubpnrrwpzqagxndtengpbom' WindowName: 'orqbjxfrbdapgfnbmbudkctvjsxrt'
ClassName: 'eyejhegcwpuspdyqlaceclzmetb' WindowName: 'guxigujrqrrxanl'
ClassName: 'gekkqokkxgmhrkkziblmiqmbapzqhbgeirgz' WindowName: 'eusiutkxldixtgagscsdznpvnkjd'
ClassName: 'krcftlblkudixlpwrbnvwthpplz' WindowName: 'xzkudmrhhndajybdxejjnze'
ClassName: 'exqwsctujtqvzhknajrjvvzktyjgs' WindowName: 'zpokenqluwkskagvprczoxfddrargntyvqi'
ClassName: 'txuhcbpjcugxdgsjyqks' WindowName: 'zdeyfhzbvktprdxpystomox'
ClassName: 'dhojttksoxvqivkz' WindowName: 'wuzhoknlimxgxwxmmgxahkfqwgfhbfyjxmx'
ClassName: 'wscjbimlcuqhxhkwykyliwjdmerjsxqet' WindowName: 'ozgeenwdkoykfdlias'
ClassName: 'yilgvanyoamsdihl' WindowName: 'gojrlsgwkkrtwaifaofntcwsudsvhydh'
ClassName: 'vfbzdkckcwshtqxruajqpikczn' WindowName: 'bdlbavawqdcgyiuwzbzjhmwawfztjk'
ClassName: 'dryclgeraqhxfkfqfxwcmmhaajqnr' WindowName: 'cwkwhnmjqgtamrotijdjgn'
ClassName: 'aqlrszxdrnxbtapvhizzwqkufzughl' WindowName: 'guzcmqouqrictrt'
ClassName: 'qyowcpleaxtiuhvgpzwngbnxxzaaqpxvbknix' WindowName: 'wstcpqpfsxwfabeeszkgbwx'
ClassName: 'rudmycwnbhiqmknzpknbnjysa' WindowName: 'kogqhqjddyzsobks'
ClassName: 'rwilvzorzxkeacstp' WindowName: 'elawqnrntagipbxhamfmloznds'
ClassName: 'hvcbccmawdmkcwfnkfwvwbnoi' WindowName: 'ejiwjeeibmoirbl'
ClassName: 'ozouyjhczpmclgihxracliawqvhn' WindowName: 'basyxrotxpjzxjbpyhrkrwarvmmwywahosgnb'
ClassName: 'dljpcpahzgfxbdmjdsobcnatew' WindowName: 'szkxgbyeutpayaqs'
ClassName: 'xusaqjikroobrkmskojilhfmlo' WindowName: 'wjnkvmzpxssdjtiqncm'
ClassName: 'youanybyulmggrarjisfmdoiqejmxher' WindowName: 'rttbcsrneumcrarmdsnkyzoreuxbyv'
ClassName: 'icufpcfvqlmnhhaegmsbqwxsccrctdmjyrd' WindowName: 'rarpstptzaxdmndmktdqeou'
ClassName: 'ewterkiepgcthywzvmqvaghmihw' WindowName: 'ajbwgkwgvdcyubvzaaywwhj'
ClassName: 'vtvrnuaykbywnetmg' WindowName: 'fbkshtsteakuffkduk'
ClassName: 'xxanewnigggkbxwejiwjttp' WindowName: 'bapwejnifvzwvszxvndmjyiypfqifuf'
ClassName: 'kylswrwxlfebpecenzkkuakvpe' WindowName: 'wjzkcqdmdlttnldhxveksiiuxfhghgpgnfje'
ClassName: 'jxslavefoarqobva' WindowName: 'jrirbjvezlvvhcoavkdehi'
ClassName: 'gpgqottnluhlkhenfgxw' WindowName: 'sinofwddfhhruswmwgeieorro'
ClassName: 'xxmeiabwfysqlqyibstq' WindowName: 'hhbqnmfvujacdtrubxemkzmfvwwkgvrbshc'
ClassName: 'pxhklateepidyuqbdsl' WindowName: 'qkxqsadilrotzjrvemzcxfotbgyqth'
ClassName: 'pirntrtawpafltqmizlxnyaadgo' WindowName: 'yshaccczwtdfjepqjyijdxoezhcucqswwzpt'
ClassName: 'nbkwnkflxwzuwxmhwkunbypirkefxezknb' WindowName: 'fokchrwarkqmhmi'
ClassName: 'gnvrmublhydsaouiycdrxuxscjpvmusgahuwtim' WindowName: 'dhrapfwjswfqncpzlfymjgsxqwznqkrjpjh'
ClassName: 'aaqabplnlkohqxeyvefzqxfkqp' WindowName: 'lualvbhczkbdqdcahysyluyld'
ClassName: 'jgqyfdggbwgrtvkznjpgw' WindowName: 'eqondjuiarxxvqq'
ClassName: 'ypgepbmwztxqpvlkvmbjqvpozaifngvngzqh' WindowName: 'bpjzqznrazwlcnirndwfhlwvfm'
ClassName: 'mgfkrsthjkaatdursplebxzmrnjqbvgewvzcuq' WindowName: 'lrotuaguectqvgzrajqkhbmvettcfmfdqjsdkdi'
ClassName: 'xhunzgaiqvktgizfrypzpygkvekz' WindowName: 'fgbsoymdnlpfvosvghhfekvx'
ClassName: 'repedsfwjdvsnalms' WindowName: 'mgovtzukczduycswsvwwlzhkxvwmvjatldmte'
ClassName: 'ujqhiaoipcjrwlaceigygnsam' WindowName: 'frlhejabjfleyoptwxmvlvsmqqd'
ClassName: 'fglkwlpnejvhmvkopo' WindowName: 'gfhmgjmyvwlpjufohwehvuerquefaneceuonxyt'
ClassName: 'szsaqmisigytrrjhuplqbcadtmbkfrixzoczczq' WindowName: 'fegzcivkrcbihuxyrx'
ClassName: 'kwflvtmgwovpgibsfkfsysyrfjtvjbtvuvdxc' WindowName: 'mgimuivrmbxmzgfkspjeqfomhgzmdlhxfp'
ClassName: 'diyrtwweopndjkrctido' WindowName: 'yazxfypfyhiuorwb'
ClassName: 'ffpgksosudtbyogmrzcdcqedlcsb' WindowName: 'bmaqnnwmslhtyzidpg'
ClassName: 'ebeohtyiplljxotgsgihpivax' WindowName: 'rrpefqwfxdvdthqigtrqsyfmj'
ClassName: 'cjtsscxahsevabriwsoxcljennptqmrsx' WindowName: 'tjaaeyvinqaqyniudxmldyqwjcghgiw'
ClassName: 'hpmeajwtogbqjsbxdnmy' WindowName: 'huiqtqmurkjibceqjeglnywauevlyhohoq'
ClassName: 'zcgunxodvzijfrifzetfmrkvsdbzet' WindowName: 'grucyiacokjmwyprb'
ClassName: 'psubgbppbgrwcebqnbfdosvjkleroqlwhrnrua' WindowName: 'plonwneysnotppwlhzzglhfkbdnp'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'wuhpsfjwyxglahefxfwfglxrnsoxziljidw' WindowName: 'pwmuqmxjjzdwarxw'
ClassName: 'qvyxjgwpkdxlghitaqshig' WindowName: 'rxussnverghlbbor'
ClassName: 'ijroprcxgtsyypshqumzpyjtjruh' WindowName: 'ydtmdamrvztlpahodohygvxr'
ClassName: 'ixrtcxhxclaebed' WindowName: 'uusnixkdvvrobdrwfsaevcz'
ClassName: 'abmfrhsylaintthpldplnnhukcttoftfbh' WindowName: 'brxfhorrhklixdxngqxp'
ClassName: 'uicprimljyzrscjgxzsfdebdk' WindowName: 'rzxtwtbihkgdzxbq'
ClassName: 'udvobhgzoomymedtcnrgcymkx' WindowName: 'rvbjbzqzovyqxsahlkze'
ClassName: 'cqzqzuaiprsuwyvbsrzfhpalxjdducy' WindowName: 'fgmuoxwaukqwbkmnkpvagte'
ClassName: 'bxnfxhcwtikxyxfwarfwxcbnabearmrzt' WindowName: 'jbpzqmtqyqwuebuepvyptqlmyrdlkkdibqfmkry'
ClassName: 'xrawncralzbhzaifchwiezopzhpqx' WindowName: 'bdbxoifgvylulxkvaersbibpbhbnukjhq'