Trojan.StartPage.59160

Техническая информация

Вредоносные функции:

Ищет следующие окна с целью

обхода различных антивирусов:

ClassName: 'bwdavpdzuduviayppjivzbgjbskzuqczjq' WindowName: 'vtdhpetbpnpkjjemhrgyfgqbxpaticxlptaxc'

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsl2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsl2.tmp\System.dll
%TEMP%\nsl2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsl2.tmp\System.dll
%TEMP%\nsl2.tmp\Math.dll
%TEMP%\nsl2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'cbdasmomuearjghx' WindowName: 'qeylxktzujbhgmqjqdxchougzpyz'
ClassName: 'tzuljvzyahcekmkdfgsonoqxdonum' WindowName: 'zdripwwxmmlgjgygu'
ClassName: 'odpclegusznvpofnrodtwgmxqqcuipomq' WindowName: 'btwvrypwriuuutjwlafjrxnjebgm'
ClassName: 'gwrzcptrxrmhwgqyny' WindowName: 'kahockbfpkcikzslh'
ClassName: 'etmufmhtabkzxhoh' WindowName: 'lxhxtlkphxxorcpayrwpxrifhoitk'
ClassName: 'cjnlqpwfkrgqwyaly' WindowName: 'teirmwyyanjeowvdvkfpxetngycsrsn'
ClassName: 'esrkjkjoqzedmxdnn' WindowName: 'bbypojmlkjiuvokcbrpg'
ClassName: 'zgymplkcdzbphlbovrqyd' WindowName: 'qmdewfxqelyipjy'
ClassName: 'pyfrhaznpmpjuqrjwag' WindowName: 'lznicxhvrvrrlguwhfunficbwrsxsqsomjxljtp'
ClassName: 'tnrtdlxmihtczvmmkxurwqpodiycp' WindowName: 'rycgxasokajhuyfio'
ClassName: 'jrovqrdmizkqqsfydgvmwmtqc' WindowName: 'dfxshkuucfobcelqlzxeu'
ClassName: 'cikmribtssbqrjuolfllnkivgke' WindowName: 'abbuchqibmxoovopqr'
ClassName: 'yorjvbhrwrkkgmoyoscqp' WindowName: 'aatybmaixfrbhcptgepiy'
ClassName: 'wrcklyphyamfjot' WindowName: 'vksruwuwwpekpjjsmqpkytlps'
ClassName: 'mmmedaxwkkumxlajqdjbprnbwaeur' WindowName: 'wpprteiyhymhsktmhoodpevaknm'
ClassName: 'ezdxqkpooxgcprschfkrmlojzyrbveduwba' WindowName: 'glkabusbjgzqpyakiwnxmjhopi'
ClassName: 'fbxbyeyzdboqiccls' WindowName: 'bylqzcfdhnektbixnojyoeh'
ClassName: 'tmzvjxiqhkyhdgtdsjbrq' WindowName: 'wsieguvlgdenffjathmzwgcuogxsmqzvxq'
ClassName: 'abtrzonsutibmrzfcqhbpymsyiyxjldmlczkbi' WindowName: 'rkzilxunmjbxyzi'
ClassName: 'adprdcrawfnnumuysswklttl' WindowName: 'fxmlfzjhtfwvbjcvo'
ClassName: 'omkwqvxibhcaraymacaiaeerqjvq' WindowName: 'dacnfykhiivejsotmforzrqzgf'
ClassName: 'rcumzcyquesnbjexbymxtacmagevrzzrq' WindowName: 'ghtnkznzyidjrtdnuojhfmmbfantqlccfnlat'
ClassName: 'qduszkhhfztmjfetsxrizkrobkbukfwfaxp' WindowName: 'swcpjvfxgeeihuigj'
ClassName: 'xumhxmmadtndwvcrkvfkqxqnapt' WindowName: 'yfaszloxzbaenbnic'
ClassName: 'nbfvexcovpjfbndyxaetzjdtjgypgkbsdw' WindowName: 'wffffnjvvmftbixknlrlufodotdcztpec'
ClassName: 'mygnoluujymyxzaevfmopsdjucbmhennlglagv' WindowName: 'hyguplkwyzoiwiak'
ClassName: 'lzfqhaewqiyooijtmxzbgqqheyhtfgybprc' WindowName: 'gcmnsxtyrsipjtvnbagsvzyuyxn'
ClassName: 'thtblferiheqghtixywilu' WindowName: 'xholehswftxrkownqnrjelbinhpydkkvll'
ClassName: 'empzfvklwyxyhepjzgpxhzpintujvvhagynbg' WindowName: 'unjsvqdwllhordwackavqobwwfkdkqvnxrkvjlm'
ClassName: 'bhjtwhjddqwwaivfdewonbokfvbdhwjy' WindowName: 'xwtyrjeutwlpebrxcmfxnxqfrdzurrclprxwe'
ClassName: 'nhatusclqdcjigkbgujcufrlatgmshnd' WindowName: 'sgvjundzghdqkvtxokegtyhm'
ClassName: 'rqwjsrcmuhccnnvolkzcrkxeaqqlmsy' WindowName: 'rvxtplgpsuolgucukgtporskuplijoawhbo'
ClassName: 'pvsqltzotuygxrjpnltcikcle' WindowName: 'xbrcuufgcwutmwsac'
ClassName: 'rqckyonrnoibyqbcdjwgkbsovb' WindowName: 'bncfsoljkpzzchnfhufgvkrziygsxhgmxesvxyn'
ClassName: 'dwhhbdccngqnenucicnapjvsyelosvjv' WindowName: 'btnirpczracmqhnrfawglnv'
ClassName: 'weeohfkhhzsgzaccinyzlintbgrlnliuxsdy' WindowName: 'xvecbtgkzebwtlgqli'
ClassName: 'xswyeljlclomkct' WindowName: 'kjdjwakwnvsbgzysorwanwzdrmwvhrsea'
ClassName: 'uvgawrvktqjrutlxqjayrnrpzczsfdbyivqjgz' WindowName: 'mrscehjvnwisvjfyvcfomxx'
ClassName: 'wrtcwfpidvltbpytkxrnwb' WindowName: 'iweulhlgrtzydrdznozmfklqvb'
ClassName: 'snstothjoseehfrucoupjxfvgoehtqsofxdda' WindowName: 'uruhfmwebfibajqtvgkxxgvrjlxripztuepo'
ClassName: 'mjhxsggmwtuhjgbgsr' WindowName: 'npanbtmbgbehadij'
ClassName: 'jtfqzvypatagqwinaoalsikp' WindowName: 'rdtheaiiqxlguwidxcu'
ClassName: 'mchakacrkzflynhnzopwjkttpmhljghmfhxzj' WindowName: 'izuquhkegdwxehmwrmyxhceoydlk'
ClassName: 'kmmqdrmsoxflwfixvhobq' WindowName: 'lzonnenhnsxevodxvcnxldbhkdzzfylbhqambk'
ClassName: 'upfbxicgbgtpojelfz' WindowName: 'hcrkepkkpiieuigkjnlrkovdmeyq'
ClassName: 'ugvpsuyolizxjsrngqllqvghgkteqbwmw' WindowName: 'koqeajwnnzqkxucgffvkbgknkhkm'
ClassName: 'wgmqycohzvpebgtgnbqdb' WindowName: 'dgbceknmntvmfpxxstwahrzeyxtd'
ClassName: 'qkyycpnrjsxmxzezhatv' WindowName: 'ypjdppvjdxwzzntjpygcwoqpvajdarxfxk'
ClassName: 'rwdmfisohgmfmizkbotlkhcbcylsbexcclunptg' WindowName: 'ndbruqvyufcpidaxqcirbgohnvau'
ClassName: 'frsvkrwyaarziefsrr' WindowName: 'uposebjtmipevzpqsuaxjs'
ClassName: 'zbfmjvskebjnmshuvclfikoasxvno' WindowName: 'xahejrdvmiaqsgfxmausfmwjno'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'savbbccxhhnktjl' WindowName: 'fixzlaoumzlrwzctpthsebcrktbq'
ClassName: 'pjeyyyatieuyedtzsvzgjr' WindowName: 'ybvcreagymjznahsjkuopyoujwnnimx'
ClassName: 'twwldblmlzewrohchmaxelqpqitc' WindowName: 'xbiiohywwyclsoj'
ClassName: 'fptykaebqarvahqootpnmiwwc' WindowName: 'ftrzauilnqwlrnzktqxtsxeuftbklrcrmckgnl'
ClassName: 'mkthujgqocmbqqkboulrgxlghkl' WindowName: 'hvxnbbjzyoztkagbevuwobymmceqxfqrxtqkal'
ClassName: 'ubetkfztkgetcsenpsbbhodfqhoitfpif' WindowName: 'fkdbipyrlkqjzpyvpbrwjrwcuab'
ClassName: 'hjzapdpletelzkakfkyik' WindowName: 'uqiqbxetxvhayxsrkopcyofllnrwpdqhuxxh'
ClassName: 'syojnlyxjhqouuymtsbfaxkxkvpit' WindowName: 'cmukctojxstoqahb'
ClassName: 'utnlslrymhfpnggetfprmlo' WindowName: 'gcpyiphsqpvedbzwraruzbhniqxtmufrz'
ClassName: 'capnpxdwoobtokxwvlzgddjjjhjzjpoya' WindowName: 'xgegpbshaavwslfxykcfziwp'
ClassName: 'dvatgaemqutlrumeyi' WindowName: 'vnyzkxelwfpxcemoulgiae'