Trojan.StartPage.59169

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsm2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsm2.tmp\System.dll
%TEMP%\nsm2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsm2.tmp\System.dll
%TEMP%\nsm2.tmp\Math.dll
%TEMP%\nsm2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'zxkclwygqkkqszlthgazdlhixbnfistivtkcezh' WindowName: 'lsozyykibcbxbamdbeuqwqecpzttvevcimn'
ClassName: 'rbxuokporhmqizpdvpwaugztuginwttcpnasxyj' WindowName: 'tcfuldxwjsohssspeswsxe'
ClassName: 'zfmnyodtgbwgdlvawtfnjdkvmukptfeoxmgyeo' WindowName: 'nrjxliikljxyhustdqzpisvaxh'
ClassName: 'zptfhrrcpdhgnjblfbl' WindowName: 'apktzvwgsvpfxyrdrddcqmasdf'
ClassName: 'jopyqrqfrkybfnawuqpo' WindowName: 'axwgjbmalvmxhsowy'
ClassName: 'znayviacowmblose' WindowName: 'nqbzzalqebxwgxolhuxsmyccsiejgsysv'
ClassName: 'gnvtblhyimsxcxyurytmnqyvqxhjqql' WindowName: 'ljqotrmgyjathgc'
ClassName: 'prgqvmhypefzhwpssfgqytip' WindowName: 'fzrhpmxedajukfajkdaaaklj'
ClassName: 'itjgnaplnvxdbhyny' WindowName: 'dxumobsshkckhqufjcxynbnfwzxrlvwlwh'
ClassName: 'hluokfunokloxxbjynrcaohlifyt' WindowName: 'ixexskokwanpyzs'
ClassName: 'uoyrfuhjycbqcdwah' WindowName: 'wllauhqebolfwqpvctnztncu'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'atberaqbybppcntukfnkvufaqvqhfef' WindowName: 'imucvhnhcsnxlynukcixnqwsiegruxjieuhvo'
ClassName: 'ogfbhdupazagbudpkjfocxvftqxhqplivadr' WindowName: 'xaxieldwjgezbdmrrshxivbsmqxoihlibspt'
ClassName: 'iecoosiznmsycnfesterjzogctqzwxtasbvjoys' WindowName: 'fcuwaigamdtcfrzyajntv'
ClassName: 'rvsrqtbhdmvezbjtgmixmlr' WindowName: 'bganpvvgtrxsrerylhjgfedwbtmwyjaimf'
ClassName: 'ucofwracjsgqvkjhazekaesqzvpsvefz' WindowName: 'fobdtfhfmcjofhxmuwsdbtgigyraaji'
ClassName: 'bzizbxbexyfaukgauiydlwhgzommtvujism' WindowName: 'pllbzltttesbeiudkopypc'
ClassName: 'smuorumeuyfnwxrbbqgatp' WindowName: 'yejconiawiiuixnbdjwp'
ClassName: 'kwlyuyfkajsuxohsw' WindowName: 'ptmlmtebqdptrjiejjv'
ClassName: 'boymggygueceikoxkijlxomtoyrzl' WindowName: 'xbqsbgiymgkjjxosyty'
ClassName: 'xznecxylrbbdxnnleovxbtdmos' WindowName: 'ulykustyrmfkxezgmhwiawudeszmkc'
ClassName: 'gpnbjgjiypficqxcbgpiydzu' WindowName: 'crikzuuezstsoxrouvlfqijvuozhixifmfhncyt'
ClassName: 'ubcnjemhlkxedcfjwejglazfgcuhs' WindowName: 'cjdgxbqhkzhttgwncpkjheinfvw'
ClassName: 'ddjgbpdqbcemhwj' WindowName: 'wcpsquigucvdnpidvapyyo'
ClassName: 'caaywheovqzanxurjsmyzwrvkcapxx' WindowName: 'djpwgrtsojmahmnixngofxcmoijpjltat'
ClassName: 'jhppbwdjanwcfxgufbolvrdr' WindowName: 'qhopxatljjyhcstxzvwcgnc'
ClassName: 'gfbofxlqhstyghtkyuncnldge' WindowName: 'hgcpejgwchhpsfxr'
ClassName: 'tsymcfygqnoqqhdjyydzkmwbp' WindowName: 'pawjecdxpdzeaehhymdfi'
ClassName: 'wddopsnidtvwaeczlbcyba' WindowName: 'twkihqtgkbahsodqazljhhxtvqufrgur'
ClassName: 'juedmwvvueyxvucjtrprfnkpe' WindowName: 'oufbmcetnpheqhqgftubqvmwiyxigdxztjpwwae'
ClassName: 'khxzpqrobfnyfwtjwogncwbzrkiz' WindowName: 'bcyyznqupdpudjlkxtxlrdtv'
ClassName: 'lhosbdupiccznittifunolxcphpdyrchc' WindowName: 'vemfkcozafrnnafgriewssqavcdo'
ClassName: 'ojmvvmhxdpicjjwrjclc' WindowName: 'xjqtdouamloynwrjucfm'
ClassName: 'epoivvquufnjmkkye' WindowName: 'snchbezoitcpjcxkuuxepyrktsffrzbqvf'
ClassName: 'fuxxzcxmnaoducouofnczubtaresdlodwnmou' WindowName: 'atotdueaqdpttpypwoknmfphtdhmw'
ClassName: 'ejnkgtwmjntbvmwisuwwnueesgmvn' WindowName: 'qhexrlbmkrfkmnxonmflzanqhsofh'
ClassName: 'edkpzyprpftuzogclfvpa' WindowName: 'ujrzuersihohhbvzezfgdl'
ClassName: 'mkhhuiqscttfozfvwfkogsnuhes' WindowName: 'glomuklnrbztyoqhjetqakcywmpgedjuh'
ClassName: 'syzdamymlxnbntuuykrjmuwohnvfcheolrqpy' WindowName: 'lyvsgcpigzwrpssrrkyaeskfehurdpzfsp'
ClassName: 'vmmnfaorbqzwsjeypbsczqktiunjtkzx' WindowName: 'lztybmakxnmyodmqkpxyabplepqqlwtds'
ClassName: 'qroxumsamnqolajbvcojrncurnkkpaoozxmkgph' WindowName: 'qpvdzahsevyadgkczqtgexcedzk'
ClassName: 'lwoszkdskfhnuxlcridrwazfvrezdxmcc' WindowName: 'tepwmdvblwgmxcwprfeucvsi'
ClassName: 'qmwqiyitgushlhzjikjqnfk' WindowName: 'bbnyvpagtlvcdcjpe'
ClassName: 'iqevxthqefhukrbqrxyvcunxxceanzbpk' WindowName: 'jwvubrooawfpdmsnzea'
ClassName: 'psvzdqeieuuzoiiymefhavuxmlsnmgnzjnas' WindowName: 'sndstdmtukuyfnwmfjsppnbegtapboykueyxt'
ClassName: 'cpzmybuozvntwhuobikpwxwotxglnteow' WindowName: 'plbqduhzffiscaxnl'
ClassName: 'rkhzvlwqinwlghcmmfquayxhyxddoh' WindowName: 'hzpstphvtsrfgjynwliovay'
ClassName: 'otipcdlognrinzfopv' WindowName: 'sszumgbqfayidcbpnejhvp'
ClassName: 'ylejgynulcdscptfaehww' WindowName: 'bgrlxpdxfgewarhbtkcp'
ClassName: 'tqgdcmuepviqndihsogkpnnfjgkeskpgjxugj' WindowName: 'zioomlpvjzlpdbwn'
ClassName: 'zbprosntxdptsymyjlduccfdnjqktpafplvizyy' WindowName: 'rqvqwkfvpwlepxvqflzdutwsxuwnfkogobiq'
ClassName: 'vtzkfapdzgweglaawik' WindowName: 'qbesmfjzdnqglsvmnkqr'
ClassName: 'dxjchymgrcskwstpglvvvheouf' WindowName: 'sgqwgiekhtldfesvftmp'
ClassName: 'jvoadfipfcngdfnizfbuymmcvjcixaxzzhas' WindowName: 'fvzgrzgjsrdslycneuoaynpydd'
ClassName: 'rojicjzrrnhiavj' WindowName: 'vslormzdyjaqxdyayvemvnjwntmbynswez'
ClassName: 'airvwibmewvuwhaghfi' WindowName: 'afunqelfncemmrpijsuufapawvqsplunnx'
ClassName: 'ljrqfzksfoydghoouqparimgaqdjblnizilpdx' WindowName: 'xmhlroolgstfirxoctmycllkpfbgcijb'
ClassName: 'gkhkdlvucbyxudoetlnytbregz' WindowName: 'utdktxrydgpqslzs'
ClassName: 'gtjnjmcubduubrc' WindowName: 'wpvprjiluyulcoekmkjazwiirsal'
ClassName: 'zgtatbjywzxnkgapcelhokdtlitb' WindowName: 'lkklwkshhieipufoqcwyxwegrcvyvtrjkzgww'
ClassName: 'uvwvuzrwcianhtiatfryszhczzfiyobavwimkn' WindowName: 'pmmzscmwhdmqrlhxlsvgyg'
ClassName: 'mywcyvtpksaxjcfefqwwjytyhjystpqhgk' WindowName: 'fssypemntkyyoynqtrsaqviwnhbq'
ClassName: 'bgbvxgmxitrvujjgucobbivup' WindowName: 'bqzvulvrpvxbazncechxefqbzhy'
ClassName: 'dtfxeminyyxvqlbdarrpvpbqkd' WindowName: 'npkrcxevqufwfzlctqjrsgrybdl'
ClassName: 'qfpedgffiglvcwzlnmioyjtjsxvjlvtdgontdy' WindowName: 'duyhdkagdwfbpellmmhavvgjycmw'