Trojan.StartPage.59183

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsz2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsz2.tmp\System.dll
%TEMP%\nsz2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsz2.tmp\System.dll
%TEMP%\nsz2.tmp\Math.dll
%TEMP%\nsz2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'pizghniylbssrvyfxju' WindowName: 'jtxjwsirckpxepnnzdynfkybswj'
ClassName: 'ssfrksetcuqegnfdwisgorzyvscedfzyopr' WindowName: 'oxsahkvmcwuimpdkvntjzwvttynttxjddidry'
ClassName: 'efsbfrizzssyjwnjy' WindowName: 'tkhnkaqgiareaeepficw'
ClassName: 'ggonnfcllvtbylderzzsynfludshdkwsb' WindowName: 'vduvdjakssydydmtddgyhillmgboubhrxrojyct'
ClassName: 'tvhjatovedcdmznfebgrrkihulmmeuqciyx' WindowName: 'vdilalcaibbzoqlwyutsyhjofhdubhpfutlr'
ClassName: 'ztuzkaonyisfouljaeegr' WindowName: 'auqiqxvopslloeyskmwbrsjlicvnqijlenqxh'
ClassName: 'pqlytvkiweytwwxc' WindowName: 'udwdivoopvhosfgwfwkmduovmy'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'wdibdjcvrfikbqvksmxyvsawsvtl' WindowName: 'hiivljioicnehpzeldrkapvprnjgxgjbjmxikqn'
ClassName: 'dxjmanqdhdxcioqnyflzjkomllepvd' WindowName: 'jozgabjbyfmymkkzcadohifktsicmnt'
ClassName: 'ythixiyeuejvdikbwwxzt' WindowName: 'ivdppodhkazrkheifxtcimalgzesgfwaspuwgn'
ClassName: 'qbgkedaurcyqhevwpnddsfqj' WindowName: 'mcuyirmvezoywpdqijqj'
ClassName: 'ikhfzbpgusasgwodexcxppfmacsfxphdmty' WindowName: 'ebbntcpqhupqdaphbvmjxcydzdcfibjuk'
ClassName: 'qeyobnxcxreqhygutauavggnbdmipynjokyia' WindowName: 'fhczkjjnnzhpaxegoyuqrpycjsdlmnp'
ClassName: 'qstoryzcpofuqmbksqltezbzjmxjsou' WindowName: 'skjowiaipubvzwnscvtwjixuzgqcl'
ClassName: 'iuatakghwwuatlemutezqgtwudkwvtvigz' WindowName: 'cfhkcxitbefegzczoqhilsmimxqjxyiqs'
ClassName: 'hkpgnynjcexyztizemxkduwxhvzh' WindowName: 'jxvlqtoceyhhmjisepzhyiubxsuyznb'
ClassName: 'ysmyqelosubccrs' WindowName: 'vuoxlnmlvglwftrqoympynfqdzfdzkpiwzh'
ClassName: 'rigasvgxfswddxfsjsymym' WindowName: 'shmmxgmlqtvsvanloejcmbq'
ClassName: 'iofbjrxlrsucxlctbcxdjiomgvg' WindowName: 'kokneublhanpllyurs'
ClassName: 'dbzblgjbgzgtwkncq' WindowName: 'jnrykbfplyklchoixiepygmpmacejrejyhb'
ClassName: 'mtkbscxeeuldpzztrnbtphinzztl' WindowName: 'rmikxuaygfhgoqpqcuhxwpsjdmrhivooznagz'
ClassName: 'kcfvepkhzeclnnftxumdalwlrqvaocxrr' WindowName: 'fyetpwuebqctloadhiudsurek'
ClassName: 'xneokapagtthcqgtmyuaqqwppvldjrthzob' WindowName: 'yhviiwetdqtcmjjqysevo'
ClassName: 'fifjyegmzvyidfmqeszqmjfuw' WindowName: 'soscgevyhuqkpvrsyqripduqhxnmadsu'
ClassName: 'pwbtzpxtsuymjew' WindowName: 'irywbxjnylooluhvwvnvadmydvkqb'
ClassName: 'swibfphajrkitfyhmqbkgjgfrugpxdlkqotaxj' WindowName: 'qkedrmxukobpdwxkm'
ClassName: 'wmswrfrwduyfnwutpmsmgmlldo' WindowName: 'pagyineiuvrckdhve'
ClassName: 'fugmmosxrvjycumq' WindowName: 'ktdtucrdfqrcokxutgvdqzwyewzbgoaozv'
ClassName: 'kxocguczqdtxuusrfarymciw' WindowName: 'yhpkwzvmjbgfezednfxpjgvfzvvy'
ClassName: 'juluwqmqsetdljwkviksjxdfgikbjbx' WindowName: 'msybmeaohawdgfooow'
ClassName: 'txzaqtsogswjbthqtnpkreukyegsatzm' WindowName: 'necmpfmumrkqbuiiqbhwdhx'
ClassName: 'rxhdmckizgxbumwigdhnfgqbmrcm' WindowName: 'tjdeelncqdoubcvscjbpzckf'
ClassName: 'exmtaofcgqmcioqymzgjyshe' WindowName: 'kmyickkaijauwpfck'
ClassName: 'hqkavwvujegugynjdlpvnazgp' WindowName: 'rdkpiganacszhsovbbcpsswsfwpyjzhnr'
ClassName: 'drauuzgtanprhkxxkuizuypowoeqikincfcqy' WindowName: 'wbxbnlpppomyhvprmvdqplallukvauqjaod'
ClassName: 'obfgcsvldtzeuzffafpzayn' WindowName: 'erhmfnegrejoobjjyvkpzyphdbrigfiu'
ClassName: 'oekxczgyicvhqpeskablrqtlyzljftgfn' WindowName: 'tsbcnomyxbgteulpxrqyvujrawbuuhk'
ClassName: 'lxuusdderuajvoxv' WindowName: 'qtlstlpucqmpxslmwirdfgnulubgcdt'
ClassName: 'palbaxelknohzgx' WindowName: 'mhsapzngexmxuupwbovibpygrisokxg'
ClassName: 'sebejikgkpaqlfywu' WindowName: 'mytiewdvlycwawpyemar'
ClassName: 'wvbgiskkreflesytctaipuf' WindowName: 'cmenkuhgeyeckchkou'
ClassName: 'ypdmlmxkegdixuhakrqbnlddjaswsw' WindowName: 'gtwhhnronvnzeklvxvhtsydihlbgqhfin'
ClassName: 'ngaxjydokvlywwlxbwpwkjio' WindowName: 'auslhdcxqecyemljwajcsrdg'
ClassName: 'rjflwiofszwisdsvnbosdibkapejetxcevtv' WindowName: 'lcwexhgxzeertikmsrk'
ClassName: 'gkhvvjafuxzpjwufpmtiprfyyv' WindowName: 'jneqqmhgnbmsdocklrppouoffgk'
ClassName: 'dfpgjvtxhvrjxuiqpfjkabfcxndwtt' WindowName: 'rkusnmtntfrbriolmyitkl'
ClassName: 'sbdnbigrnatenrr' WindowName: 'fqdyhcvtqvcdkhaj'
ClassName: 'ubwhmrwaafduojynndykflawioxxm' WindowName: 'rohfhvmpisbodpxtzxrvlzk'
ClassName: 'eexgvpepsshcgcsjmnvacvubeitbzerwlcah' WindowName: 'zmmbjmrnqegasntpiaeniqhyng'
ClassName: 'supgjczhhbzhfohsnjnrtxhhqmygdkzdnk' WindowName: 'dslcjrrvdcojstqcfaotccyjay'