Trojan.StartPage.59163

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsh2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsh2.tmp\System.dll
%TEMP%\nsh2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsh2.tmp\System.dll
%TEMP%\nsh2.tmp\Math.dll
%TEMP%\nsh2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'cirmbqwcezepogdlnwyvdq' WindowName: 'vgmjkymuxnhzsongfpffp'
ClassName: 'rdfpnzrhkggmhkccrsfljskiyg' WindowName: 'hlymzliteayqqiyai'
ClassName: 'mnarnlokszurmyivfodlogzfdhkjfgbkccarhtt' WindowName: 'youkqhqlylnefxltgfyjjddgmhztmadu'
ClassName: 'ptkiopcniyqsfizqiugcqdzyqwmjsflfbm' WindowName: 'rtvllqqkkjabopaempnmjambbteoaqodou'
ClassName: 'dbisbhzdcsykkpvhbokvtedlgofjeixgwov' WindowName: 'fmnvbfvdmykqscwhyouinzitxivdedcohjgtdns'
ClassName: 'neksjsxscvsntmk' WindowName: 'ievcyixyugcswccohtyo'
ClassName: 'lkngcnsqjoxmzutfwvljairjhdtvqoruc' WindowName: 'frktwcrafgmmtjbxazludbhxkzhpc'
ClassName: 'vunrvoaplhyorpaikwydceoaveafejrlenjxhbx' WindowName: 'rgvydacinyaaexreqcojj'
ClassName: 'zjawaaulmkaraju' WindowName: 'hhmhqcgdpmfgiwegpagealcqfujpwwyzcga'
ClassName: 'rvctxoxlpjbtjdzqribt' WindowName: 'skwdnqnehkhzxtikexhrfiknu'
ClassName: 'gfamkhgndcbgcxvyikiookkynglsjqwzhzugdjv' WindowName: 'olqyirvwtsapwupkunscrkyrzasfsrmbro'
ClassName: 'osifvmsmxssyiidfj' WindowName: 'nbjznbcyjpoiwgnmeumyicwckzmgkfxsvrov'
ClassName: 'hszsisuwucazczmevcbyj' WindowName: 'xkdyramujnoarmlnltjqyojk'
ClassName: 'mhsigfxjowapbgjngepdcgyhdbeliv' WindowName: 'ccdbnydhwtujmqmlk'
ClassName: 'alzrropmrdrqzsfzftrcn' WindowName: 'zmrqqyceaaalgkpntygnsggnsq'
ClassName: 'zjhspuyrxqmongknnegce' WindowName: 'ozffaulqikazirtyqgclbhvqgqhmoihszggal'
ClassName: 'ipjbwkjyykhrnzjcterp' WindowName: 'uscvpoaizbaxggexhmqtg'
ClassName: 'zncdeolakswznntcplwnmptg' WindowName: 'jfsghrozcmojqyv'
ClassName: 'nfctnvipdorfotueqkysbrssbhddg' WindowName: 'bpvjbvzyhauzwvs'
ClassName: 'wquqxbboszcoratccvhgkf' WindowName: 'vwckifbsnkzgoniy'
ClassName: 'gdfwyjugnntcowzbezfehz' WindowName: 'tkdgunqefsvfywxhec'
ClassName: 'thvxzaesrfgtluedvsy' WindowName: 'rozyqrmexlaumpapqx'
ClassName: 'vdtkwjmiggnbiawywtfjuj' WindowName: 'qqytdgackyzhqabztglwhpgdivnpqmavszpk'
ClassName: 'lwdemqrtikizidhtxyancptqkgrj' WindowName: 'kovkcalgqbspxsqj'
ClassName: 'llmfcgwhsqbpqirfordjhbqbmlvkduttth' WindowName: 'faqcikxwiksxcss'
ClassName: 'dshwxcdzkehotaertdydyxkjsotwmlrwq' WindowName: 'tovvxntgkvlecsyyynihwtdkijot'
ClassName: 'idbjyzpfcmsaqdenuhgxqqzoquewgrsi' WindowName: 'fyysmdaiepgqdmrrur'
ClassName: 'wtnunrmfsuwhikotqjrhjtffhouqbdr' WindowName: 'vldtvwthbgaehcoxrdqpgtajxiekoqfsmwttnf'
ClassName: 'iwamnlvtsckztyetsurgoxh' WindowName: 'jqgyflnzaiuhdapvpuwplykpdycjxpkjorccs'
ClassName: 'kzwprrupcvfopwhoakelszpbviaeeanxo' WindowName: 'wazxzrulvhtonliaboq'
ClassName: 'ejhcythspselpfoq' WindowName: 'omvrtyyjhnnlvuodiyyieprro'
ClassName: 'dfbucqvbqzxsxkldtioeadjzhfaqxoytbok' WindowName: 'potcqkmmlzusobczdbpquhplildcpmsabrn'
ClassName: 'hsddubcmbaaakzdfpojtrapvncez' WindowName: 'mcjpevymdwduxkenxvtastzgfrqoenqswsapayu'
ClassName: 'pvsgkxbuoiniafvtmmoryxnc' WindowName: 'ffumzqtvbwivleqaoxgewxsurh'
ClassName: 'qvjqfcmeudpnozasktbamvvclzea' WindowName: 'oudwprbutespgzoeqskojxcxmwuioroqlqfvoc'
ClassName: 'gixqybbfnkoxrengzlalwzrrub' WindowName: 'zofoofgmbpyuqcagxhggofivnpgqfchvucmaug'
ClassName: 'ucuxtrzulohwxwuzcz' WindowName: 'oujdyubsxxjtfdrxmvrj'
ClassName: 'kwxayjruqdaxxdxwlikwoqrj' WindowName: 'ctagqqttbnxglruapmwjsjnzfjf'
ClassName: 'gqywybkwnlujldrqqgfnfuahablaewehttlfru' WindowName: 'yptikomkjyjcxkbfaolxqfabwdgfggsdxnaxw'
ClassName: 'yysmxplvrajjtyxedwxfpifhgfkfjsiplprf' WindowName: 'rdxrxkcyucfgaulxrdvybfnbemqxpvkqy'
ClassName: 'ycqrdngutlyiqngrpwpwdvppkkgfjwcjbuu' WindowName: 'nkcorlhtatsyjcrjpcnwht'
ClassName: 'yizdrkbqhbfpywperddfzkdtxluvywzimfkffpe' WindowName: 'krmuwmmoifavcxxoldfkmskvyzdtyl'
ClassName: 'euqewrabafgjexsuplsnzscwubd' WindowName: 'apbssrcsdaelvkaarppdwsmqocbrwoxjqgt'
ClassName: 'sczyjidcubqcgfpd' WindowName: 'jqxinmllggckzdneidktckv'
ClassName: 'trvsfpjgyupkpfdcik' WindowName: 'kqxuhokvkbezlygimaswerexoqdztppbomquhxr'
ClassName: 'ugjsmawdzghegbmxmotydclpinutdkgxd' WindowName: 'tgpmgkfpdtqyjsyqmlmsalqwuirzngl'
ClassName: 'rmduqjxnjkeyiikpogmneezcxfnmd' WindowName: 'hsliqitlpoovkpgeilkizw'
ClassName: 'pidfelbrfazazdqxjxj' WindowName: 'dmyddxtwqoqtyipsvawiiac'
ClassName: 'ojmokktvdvsyfoteptlzhoueabbouqq' WindowName: 'ngxbhvbosjcnltsn'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'yaeothycpiseiizchyxlwuaiskupzhfvttdgm' WindowName: 'tvvpizhimyaweix'
ClassName: 'acfehrcsyinrwocuukfuzwzlleailxzfy' WindowName: 'kcpvbsaidvddraqxzupujvapcuyzvyyjavoe'
ClassName: 'dhrvxyyivhroytkzpelxvgdd' WindowName: 'uqilomreeqlzivfehslpkvmq'
ClassName: 'hiogvdhkkghwjpczusxretzcbu' WindowName: 'tzlksbzdwgcwswtgbxqipmozhjhfwa'
ClassName: 'rkintziypwokabi' WindowName: 'utvwfhckkjwufxvpvrqsxmcrgqz'
ClassName: 'ciwfsjplxnjbkzqgopjnalk' WindowName: 'pgglgaxjjdurjkniknbvdslinbqrohhotjj'
ClassName: 'vmvunavjsyhaatlwyrrndkvonagqmkxnlnvm' WindowName: 'orfbjconqvkemwgnlhdph'
ClassName: 'eqwjeprctpzvzqokpwmjtuaijbdqsvgv' WindowName: 'oqmtiuirmxcyrfmfbmybtv'
ClassName: 'ihnfadhmynannrlmhdmsxuiavvusmgremux' WindowName: 'xpuhxicvhemsjtovmrpliquujyam'
ClassName: 'vqtzxeprxmpzlnmmiix' WindowName: 'iwzvpdyekdkqhhbtjayqflahrcuhtkxlkqtw'