Trojan.StartPage.59236

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsf2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsf2.tmp\System.dll
%TEMP%\nsf2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsf2.tmp\System.dll
%TEMP%\nsf2.tmp\Math.dll
%TEMP%\nsf2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'swinxmuoyhkfgeayci' WindowName: 'joshzyxnnaoplkqh'
ClassName: 'xtsudczvyxfbjmsfzbfbtxgxqxwyzwfwtkms' WindowName: 'kkqifroltawjbbvf'
ClassName: 'mzdfspmjhcxtrgbopwfutpuhyvin' WindowName: 'wjmuvjufjepqgrpsxztpxhjk'
ClassName: 'mmyybqglnikvdgys' WindowName: 'ckikscfxeavdvzzidmvospezyuzs'
ClassName: 'ptsinmkdylcknpmavjxthxugwrizscsfmxyv' WindowName: 'ocfpcormofksnkjtjpfawsrgpq'
ClassName: 'xhhtibuoyojntix' WindowName: 'poygzrtrdhvrkvnrvncnykr'
ClassName: 'deapqwwfrvkqkjkozipthsnhdogovejhevc' WindowName: 'bfvizjbrjnaftopbcauubzykioldhg'
ClassName: 'tgcryfdxvviamyoytlzpwzhigrtqknh' WindowName: 'dezfogmblvaeqchtnxgvsgolyhjdwfqfbwxptu'
ClassName: 'kgwqgduuwshazeazhskifoekopeg' WindowName: 'phabjgjiniugmdkdpgyfjmtywjocezwumxydt'
ClassName: 'tdjkybrlyljcltwgvwtl' WindowName: 'cryedhlfsbvkxlvpnq'
ClassName: 'pyshfbfzuvqgenbapooxpmukghcthjigvdir' WindowName: 'tzkdnawhtnkhurjwem'
ClassName: 'wneysmgjwymcdlkxwpxpqdeopexy' WindowName: 'wbemagkavmsxfficildoghuqgautymgbtzn'
ClassName: 'hhrjgcxgjkaohsyqvrtaoxnhuwcxahtyaa' WindowName: 'xdzivvxghlcntavsw'
ClassName: 'hojerkwvzttvbnelmrlmiprxvqwep' WindowName: 'xoefhxijllwodpkxszyyoxkrcjloywkoxys'
ClassName: 'bbpizhutzpruvmemvzgoel' WindowName: 'llcrksdmivqdfgczxrexh'
ClassName: 'vgyfepszumtegir' WindowName: 'gvabwutqcbphlonmcjoztbktikvp'
ClassName: 'qclshsgfhbpbdfzddoecjjlyfrvjraosnnpsyw' WindowName: 'fopelpxcckclnqjee'
ClassName: 'pdvbfvrstlsjdzeynopdwsyfkyoslzryhrogv' WindowName: 'eqkzigpymcorbbbnh'
ClassName: 'myntcbpcmlsseavydqjwvebewnmbgl' WindowName: 'ansyrgoawqxznxneymlffbftozwqcwehuovjwpb'
ClassName: 'lttnrjsgsybfzovvtsyctud' WindowName: 'pjwaflxekdkyzpvs'
ClassName: 'vxtgqklygqqpulhaepyiuxa' WindowName: 'hhcrmgfukksnmwrapchlvbzkjzgkufl'
ClassName: 'siyzcmkesvdtasfxwuinryffwzbiylbdni' WindowName: 'lvarpuvonlvhffxdtyrlbxtyprlczhkdikrmbgt'
ClassName: 'tezcvfitanxfstub' WindowName: 'dtkrauylyckovzdtshypmjjnlbuogqeu'
ClassName: 'dvmjluvfbfedhutebn' WindowName: 'bzdsfxfdxhjqepafpqyjuetrmrrsn'
ClassName: 'lsmozuusupmgebtaqbfkxrspom' WindowName: 'drtodyrfznleglyexmgpwkmifi'
ClassName: 'ofpcceovzhkkaqcq' WindowName: 'kkdenskbxqwsotxwsn'
ClassName: 'mbmwoyohnaucaoefzikvlccx' WindowName: 'zarmzlblyysgdqzahckoozximihwgvyf'
ClassName: 'rsamvtjwgmncfiicdcdkhleghuli' WindowName: 'enadgnetfywewjrzqbiwkbyzwicybwkyqwlxiwa'
ClassName: 'wokrzgadmelebzrryhallkvhv' WindowName: 'hmruhtwflcewunhkzoxojq'
ClassName: 'ytmumbggkxrrxnbfiiebhotdewgdugn' WindowName: 'hgfxiahacqpnsjwkgigtfeyo'
ClassName: 'xmzjdgoirfnaeafoqjdqgqxofqcmadgmh' WindowName: 'mizufjexrspddwhatkcrpetuumfdtvsppgse'
ClassName: 'avtmoqrdjselwjejxxavtwqlwzavuzfgrrgn' WindowName: 'cugsbpufbvzvzwxvlgocsrewkprubmeaku'
ClassName: 'mvlkcgqhinfzpwqc' WindowName: 'vstdhshwxyfhfltzmsqcovgxeumfbaavnjk'
ClassName: 'wfykbxdwwwkqsbwigekzkwwwqicrxjzjxdszgx' WindowName: 'jhuwsnsjodwljhmb'
ClassName: 'hdvbirqltbaxtovxjlfieolrnzsncdapaqovfok' WindowName: 'ynesefejflbktwykxzzuncfhidkppqmiimiet'
ClassName: 'suzkxbwpywlcjoibfcrnntvcgsqpcqaszh' WindowName: 'pxfojsouyyczjoor'
ClassName: 'yybxpkrorkuwzkxp' WindowName: 'unbfymbwpplctwoaqkfjtaefaauvaddkmpsmih'
ClassName: 'squqnkhzfcfftmcwvcevtkghuqlaxpktcqn' WindowName: 'lcpqmuhkindjtykjhdc'
ClassName: 'vxkemtgtlfgsglgwtiknbcazjumpdbbucjyzsd' WindowName: 'npjivubhpjicyrchfvmodrq'
ClassName: 'glxloktrrusanuguzsbjhxwadd' WindowName: 'wxjwptpswcdochkgsfkn'
ClassName: 'itvjtqeijxslogddfuyeihjnqlppekpvyq' WindowName: 'ezrenpohujmprhqlndysuaqcj'
ClassName: 'rbpecegbccucprskelzwnxt' WindowName: 'maptzpreavddqfarqswxljn'
ClassName: 'ufqaroahjklucpdth' WindowName: 'lgdlitfsfhijadvcndb'
ClassName: 'grmnhsccxeerdrelrhceqdznie' WindowName: 'ebfyaenieclrnhakqerggapvoktpsjodxbe'
ClassName: 'vcfmhhrquwqfsnxhilj' WindowName: 'otnbpafbggzrnzsmi'
ClassName: 'vlyffijzkvxbdwakulmhalnbxfuyko' WindowName: 'lrpvdhmbedfhzkqclznxdhodeucfj'
ClassName: 'aqrdxunxajaoggsop' WindowName: 'qnnoljtxxjjlebvvzeyquv'
ClassName: 'jdtebifuawooehgyhqvnyfutsq' WindowName: 'mxaukhhohsvfoysowxylguqzfoku'
ClassName: 'eafpqfpfecayzhsnvuxsbrhfkwnjxbf' WindowName: 'mqdiyveahfcmgkhksbja'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'jslcimlzkqckoyntjpypioracypqtmouruxwpef' WindowName: 'jirneyeotmqeebcsyxbzsxtmubcphwbthx'
ClassName: 'qdxubafuznvtaysaq' WindowName: 'pzlfnrjtahefirquufgbyvmcpirfirgvki'
ClassName: 'imzohpkylmbgbrfmmarpozmr' WindowName: 'owbnhriyiulcwssrlsuudoks'
ClassName: 'yorvnlnjsopgqnubenz' WindowName: 'vuamsozxzdmwxyckskdefeargeiihefld'
ClassName: 'gknhdcblkhnvkpvadggwqitniydqldzhgblwbie' WindowName: 'oqwfggwxraxqpntzuzmftbyzjhphwakeghy'
ClassName: 'srajnsdevtlaadxotfcpwlgjwkzicimleg' WindowName: 'xmeniitvgjanoovnqcpgr'
ClassName: 'uyakdfalghmajpjqmepflasx' WindowName: 'njiqeldcgwanqsrffppjpcixvn'
ClassName: 'dndatlbcdcecpif' WindowName: 'qpbcmgbaydrehykpocktxgkx'
ClassName: 'rdoxbdcolmvzvnpc' WindowName: 'gdeepcyngkrtaheofoxjcgivrw'
ClassName: 'wvaqgcesfngqurvdsdlczdevpgmpafrprhgf' WindowName: 'klnydzlznjwvxiofkpuezzkmwrv'