Trojan.StartPage.59164

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsw2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll
%TEMP%\nsw2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ipwqdjaeoifpzmqxqlejng' WindowName: 'ehmojxkrmxxrcjebnfbcimzrugwhezcrphq'
ClassName: 'kqpoxohecysvxeellholsuhvyb' WindowName: 'zxxlfbodcmbjpyy'
ClassName: 'kcvuubbmnhsjnmhhlesrdbdhh' WindowName: 'nofpbepqumqsmtco'
ClassName: 'xubgxfqyklnchpzteitg' WindowName: 'taxlrmtdbbmkmrznluojprh'
ClassName: 'ngyfbccmwbryhprrcdivnwnmbgufwkqfivnd' WindowName: 'gsttbugrcdfkunpcblpywd'
ClassName: 'ewjfyzfwymzxiysecf' WindowName: 'bocrntxidpclxbndjw'
ClassName: 'tglxjikcodejorzqsi' WindowName: 'silpmrjeyjsphaks'
ClassName: 'kipnesaqtvrmosouokqhlqyqvqxjsbnusdtbwb' WindowName: 'tmuztydebkyanzkoiveqbejtagajzll'
ClassName: 'tlwcxgwlmbotnpdkba' WindowName: 'abkxrzwuikjvhttjkpbcw'
ClassName: 'ucblklpntjzwfhewjyghgc' WindowName: 'jgapwyafrekczyhk'
ClassName: 'xhxfbtitjiwlbpwtyccjdxdmmymjfiwwq' WindowName: 'tfczciazafkqzjqnzmetwfqia'
ClassName: 'kzxexbmbfwpemnbehkmbo' WindowName: 'amqfsjoipsjioljxefabursthxcvqplxei'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'salpzocvfpwmyngdnfhrcd' WindowName: 'mvqyznjycyfulsgrj'
ClassName: 'atewtvlghmpvozofrovfdfmvqu' WindowName: 'hyablplpzweuwafbyew'
ClassName: 'ddmuxcytvxohtajllvmmvyzczxnugkxejol' WindowName: 'hsfljercknyinlodungpehqs'
ClassName: 'rykoxzdfrkekcqnhrydqd' WindowName: 'phfoeigumrucfusrp'
ClassName: 'ogwybmmypeykbkwdxejmpqonuuiciodydorg' WindowName: 'cnxoxxgprfusfnheirxgyf'
ClassName: 'yevgvyaxlfmilrtxvyokxrlxwupqsbmazq' WindowName: 'ogamrfgkgdpewagcajbmeqcqgtkfn'
ClassName: 'sadxwmysblpfkypbsnbykqrdwkhxgs' WindowName: 'yvoxdeevohwciiwxzyhcbdaugbkeuowtz'
ClassName: 'upytlzswrejtwztqfoiszzcpqcxsinhb' WindowName: 'gzaxcioaufomegvxaxyyfbekxeixzdtrtxddkqt'
ClassName: 'oivjxyacquhfsdacsekrzkduanwrgnsi' WindowName: 'tpwjdnksicekxrczwzgstjwfgsnuuqvzzak'
ClassName: 'xjlgyiyybssfxhvzmn' WindowName: 'ndqmcnnyxqlhbeyvsvmygnhqxnyzezxspezktu'
ClassName: 'omhlmqioresbxcne' WindowName: 'rimoccasmogszbkyggoe'
ClassName: 'rnidkbmvkpdrowokitunolew' WindowName: 'llwvzzlksqenpwwyrrkzttzwzxxxqoiyzy'
ClassName: 'oszyylqrydwwlwdfewxvzsrkcbuneswlxxh' WindowName: 'duclnlfacrnhfbzsdkvxwacnarlxwnvhdwnkpwl'
ClassName: 'iwuerqpowtaereaxxe' WindowName: 'aqadciopwektfaksmdzzrnvpajvciwkusaoyzib'
ClassName: 'gkwxzhbibympmzxjmjgoqkiptmtg' WindowName: 'pspdyuoyosikszofupnd'
ClassName: 'bwarfefvlmrqfwmweidcvzuqvaycbysvwn' WindowName: 'xiqmurygutgexhpplbumkyyryj'
ClassName: 'yicqqsnhsupsgwqkadqjikpupsf' WindowName: 'sebrwctmpzdoswxkwaffgmrwjlurbdpofevjwq'
ClassName: 'ukapmeysgmopegv' WindowName: 'onucohflxkzdcdeeemfmchgsyyktvtbixtaxipg'
ClassName: 'esbtmwniztydotetugajxttp' WindowName: 'hwfebqnmjiycjznqwnkzpvuvlcujpcupqavt'
ClassName: 'ufzsvvxfrsgbkkjkoy' WindowName: 'tvawrwoaljowcimodddtcphhacyl'
ClassName: 'vxybzhlskgrkyimyibrwoitifobhyvwcyekkfwg' WindowName: 'gfowmkycrkwusrodbrnxnu'
ClassName: 'pqphxepacswqrysawl' WindowName: 'jbchxthvjfyizocvbseojn'
ClassName: 'txkqwzezorwgrtbtgfjhddovvpkypc' WindowName: 'rznwrjdypbdgiksgpzigvphogjhkgmk'
ClassName: 'dgbsaszkrlisfkfyt' WindowName: 'alywcricppnufajeh'
ClassName: 'ukxvdbdxlyfkkyqqympcbvziwwfgirttfs' WindowName: 'mginbtlrpyhfwjlapgnixsymkcsky'
ClassName: 'bppdbkaozzhhdubjkvplzlvgvix' WindowName: 'agtfhwpxsvcpzrelixyfxk'
ClassName: 'cqieodgemsauesohvugpvzelmbmwpsnvgyp' WindowName: 'dnpvbwzpfpdjxjnyfomtphpbys'
ClassName: 'frrsjvuiacqksiewwftxlkohb' WindowName: 'hlbtorfbyeiechpoumehmvyrxzqhbwij'
ClassName: 'kckhguintjfrieoqovnreldwdmlpuldiociwdvy' WindowName: 'udruorrrwickwphg'
ClassName: 'dzpxriftdgtdprwwnazqrvszzzefedum' WindowName: 'lmpzqaiwxxehxbssjj'
ClassName: 'fvjgzlbcotuntrsghlupipmieqcx' WindowName: 'moatixxqxjhjgpnv'
ClassName: 'kssxlmlvxnwmfwmuldnhmfgqhpyeetzomcitws' WindowName: 'eqnsswhwzkonwmrvkoarek'
ClassName: 'amyyejbbhwodudiombsftmxiukjwpibpglme' WindowName: 'isciyylgldlnxdgg'
ClassName: 'mqsopbmxtusmqhkofhfguaayimhqad' WindowName: 'fxwntqfbswaadmtwtjscijudqxk'
ClassName: 'snuyaclqqsuulovkdrazhtkalb' WindowName: 'hnryzmjhmfdgdfkoilrvebatmtqeddf'
ClassName: 'qorrahcuaituytqaindpdgjitcvrgsygzdlchxt' WindowName: 'xsoiirxnbxsfvpyfapcgxhd'
ClassName: 'tzvudysabmbdron' WindowName: 'xmcdmevoviuwbfyvb'
ClassName: 'kgakwckcxqesfpqvekrydukndtmqeji' WindowName: 'abnxoqdqmplikikxpm'
ClassName: 'vyaxrzhwndnnkeziuwdsbxkzovrbjaotjfpyak' WindowName: 'uisdiuukrbrfsdlgbpvqx'
ClassName: 'zrmnehnfdgtdljzfbbqkpccjyyztnonjip' WindowName: 'uynekinjnskluvhuljld'
ClassName: 'kddyunlablyflmggelorfycjcnxfpzuwrwtu' WindowName: 'vgsndlugqkrqrefqnfuzutpt'
ClassName: 'eaujhwfyefcijqmzyu' WindowName: 'nhunytfgjmxjjykfecofpdfxywgetywhfyqiayo'
ClassName: 'xlrnhlxfseqkrugrq' WindowName: 'sfnkhruomrxiyzpgwqgoh'
ClassName: 'abesycioyfkicbkkexpuigxgsckmn' WindowName: 'qguuvtndgmaujlkyqojfzeadvao'
ClassName: 'gvxvhrojkbqskcoca' WindowName: 'qnhsxfbeclseoizaw'
ClassName: 'ptwursxbqmflsqlatntoajyfewpoyidi' WindowName: 'vfmnyzgvlcxjzvxihdobqurftedexygtmr'
ClassName: 'suovlzarfisqwdpjdsga' WindowName: 'lyfdlrkcwvbzckpxmj'
ClassName: 'xiyvlhamdsrjpnfnb' WindowName: 'wgopgmopdvdlgufmwhsvgstyacb'
ClassName: 'hvovisfbqmkojsinltbsbuf' WindowName: 'ccucwfokwfimrmiyytbppeodx'
ClassName: 'miypzegdcfzgmaxoaftjltgetsxriuwkoyocaw' WindowName: 'vqsjkgxpweaqlbeohogmjew'
ClassName: 'kqmebwjgogquffbicubobtcsjuncng' WindowName: 'djuyjudhbsupwcedrcrgbuztnauvztgtvbknscf'
ClassName: 'dmyoetafsfleuujyevnx' WindowName: 'bsawjrtstxlnrokdrhpmn'
ClassName: 'uopksfvbjlkdkxcfmrsnlkflufbqtktzvfwuq' WindowName: 'vtihbjbdurgbghokvfnlabejbcdjynzs'
ClassName: 'pwghqeqcnlhvqrzscxvgkracmjootsxtv' WindowName: 'iflkackuyttlzqlvyrtllxwfyelfvvuacirtpp'
ClassName: 'qxsilpkjunrrophpi' WindowName: 'bglmezvappbtebszyxdohgimvtkhbdqoe'
ClassName: 'wnvxmqozqupaaieakoer' WindowName: 'pwpgasudbueppxdjcdfv'
ClassName: 'vptzghfiiuvzifdsziafpambughpbbvhwtzzlq' WindowName: 'bjjrbavfbkysrmsxgmndouwpyif'
ClassName: 'ottwycgwkeyfybcdemeqfiadtxl' WindowName: 'wdyrmschfkojuecrkngjozpdfvyxpwdqtvi'
ClassName: 'jcejxnflstnkzuasiqepxwttlzuuaml' WindowName: 'ejqojkmgmujihsvc'