Trojan.StartPage.59279

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsv2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll
%TEMP%\nsv2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ejrxgjqfblqkulplhawbbmjilaefpudrdhirev' WindowName: 'ylqhjagbyacnvcoifosllkradafvnpebxgom'
ClassName: 'ptchhpoonevfduufc' WindowName: 'eaqidkzfjaenwzhkbgtmzgqjlgu'
ClassName: 'ubafbhgxgqrtdmte' WindowName: 'ixlkdxrsuuxvclnjmtbiwoehxhfcmjektsnapsc'
ClassName: 'mskjwobgocfdbzmhplvfwxsdacfeclwk' WindowName: 'lqzrbbzvaqeqzfbhbmkxtaeseumeunl'
ClassName: 'xiomlyrfuunqjncncfrbndxukhrlmifenjk' WindowName: 'jzvkbogzfvpfqkpdvlsqopybkohtbbtsoltv'
ClassName: 'eyipcontgdezzwyboouczgcjm' WindowName: 'etygdlffqfiqerlgftxmygilknglbwkfp'
ClassName: 'vmsnmfwrevffvkobqokkvzu' WindowName: 'xribphnlmidnmrotrjtuetkikdcxlxfemxmfz'
ClassName: 'tyeulxivcwwnqogtjbmjjvzbmrereyegozwuv' WindowName: 'ubvurmteuklorzvwuikdlbygtipwspagmc'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'jtzqkemswczcmkcctfmqmilbyaoz' WindowName: 'bmwyxxnsjeauhfdnkvabvezh'
ClassName: 'denmaotkkqnprbtdcpalueiwkxjuz' WindowName: 'jfjmrmrlrzdxairxwwduwplxwfykwvbmopcg'
ClassName: 'nwvwtgkroyiupyjkctpxxbwxsvwhf' WindowName: 'gogjspunrmxulrjddkawcnzixygwxs'
ClassName: 'inkbaouqafcexzix' WindowName: 'fnsoqteqrxhjtrazlefykxkjmmahxdqzeqeh'
ClassName: 'wzzwfrtkmllksugwnzwzrntrffnglpfjncpp' WindowName: 'wvptlqelhrxemyuynuzjivyxx'
ClassName: 'bsbkbutrbqxkwvnrepqkfjssxvbfgt' WindowName: 'akujukakfgrpdcn'
ClassName: 'airjgnteamxwsauml' WindowName: 'ctyzetnacsmyosxzmxboahvw'
ClassName: 'iiwjltgeiybrpsctofbnea' WindowName: 'izlquehohjnoobeulngjokwtffvfqehjtqypwg'
ClassName: 'osreytgplymfamdyluu' WindowName: 'vgmdohbmybnjrbwhecnsbznedhmpkegnnwhfyvj'
ClassName: 'czcqrucziigzudcxalrocy' WindowName: 'jmzxztqagdzzpdcftxyoxejeyoedodv'
ClassName: 'yzcmivwxhobpecxmvrljdssjn' WindowName: 'qhasqfmgcqeslkriaajppkttpodmboubxelz'
ClassName: 'bwyrafqijrntailykslindmwk' WindowName: 'vtwbmxkgbgzcrqv'
ClassName: 'ubyjliktrqatoyhqjtfhegkrsabgqy' WindowName: 'yhedkdiqujvttjhkumqbqzxtwmifdn'
ClassName: 'ostezcgfjkvpplqmmfstlnsun' WindowName: 'fojbhqbinrfvosrriglsddcexzonottzxfig'
ClassName: 'sywepbwbbnyzsyshruvpmv' WindowName: 'trmlscrmiytepnlzqxhrwru'
ClassName: 'sadjwcsfxujinkvxvzylepmqelu' WindowName: 'xumboredsarrnxkughk'
ClassName: 'pjxgudresjvqtcbgsxdpnutksjjxzh' WindowName: 'aashuryprgymfgw'
ClassName: 'icgvdjkdhrhhkpoxfzlyttkybvoy' WindowName: 'hgzatbvatncyltjcfajurfrhhmrpuidqofmo'
ClassName: 'nmzkocygqdctcvkttgdwmtetzvaxgnjn' WindowName: 'epkrwspsuabtzqreiwcdkcnnjq'
ClassName: 'ysllihgxuybrqitppnpatcyszhijrckij' WindowName: 'rbjvlzupwekjldcijwe'
ClassName: 'gvhkcgaapmfmdfextvwbhvbiucmkvxgoqtpne' WindowName: 'obviyqnctylelmzjgtvk'
ClassName: 'nwjncddgdahralbhzewxrmlrufqgvxrrrmqy' WindowName: 'dcedyinlovhqvmqhtystinqt'
ClassName: 'dcomdmvbbrznsoqxkpuledsigw' WindowName: 'hvwtafgpdtscwlxmgvpyjmlljsdvjsxrmpjsvx'
ClassName: 'eygmpyixvnfhvkueatvrqedfezwacc' WindowName: 'dfqmsmnxfphlyiglnulctqafkphljwiwwntcxim'
ClassName: 'ymwyikoqmlodvxxbgxshklkamlpkcgsy' WindowName: 'ryaznxqfyyigsvwjcizjfqvyfgdn'
ClassName: 'svemhjvmgeoumddofxuosxopv' WindowName: 'rihnstavqcqzkphaqv'
ClassName: 'erdhbymbmpmuspceyjprnjazazdxd' WindowName: 'ryhxkydtufpoocxseowwhfrcpifqkplm'
ClassName: 'ywszcjyqxsbuellahrzjnmezifrrwtgbxx' WindowName: 'yrksknipwscslcyrynlfqksmj'
ClassName: 'xgvxmbbauvrnoxglkkfqdokqbblgjh' WindowName: 'rkvjeqxfvurtzcx'
ClassName: 'szgzzqmmnuzjnikuir' WindowName: 'hrumhyuydmqwwnxcjwsczgosnuyhra'
ClassName: 'iwrlfpgekyegiawfmqqzzxyztdrdzw' WindowName: 'ykwvhugqoshspdmbczqfppnmrterfftoadphckc'
ClassName: 'zdqfparvkxftmceytiglqbhe' WindowName: 'iinbhqgafysmsjbjhhn'
ClassName: 'sdzfbyqaoawklpdhztgypcmlpca' WindowName: 'nmilkbniuzfqzcwxfkuxkxiaup'
ClassName: 'ufdrngnocibjtvhipnsndxgrlhdiklganiqhqwe' WindowName: 'dptkuykgwcovcloabfjcdc'
ClassName: 'ipmohgpoqmkiqkmsjzbifwnwomoegkgvsxcrac' WindowName: 'colrwzcunbwbzyjxwvncspxihwsee'
ClassName: 'cafqstsijxomewsfgmirwmxagkxflpsla' WindowName: 'grnwdntctxwtalksoiujioaojekgtqeogjh'
ClassName: 'stkgemeqyqagtbcewoqailrofhwtmgivc' WindowName: 'htzbhpjcuiybzmchicurlwlh'
ClassName: 'ijwtsrqnykxdilgcrnkwgr' WindowName: 'rpiunntwobouzgwhidhpwrmpoucik'
ClassName: 'frjkkluzpihhpivftezbmwmngkewa' WindowName: 'wsehrxjaymingybxzjy'
ClassName: 'ndahauqhccqsdvtqilcegrxs' WindowName: 'hjillchwbdmowqbwbhkwwbmsrxdwlqa'
ClassName: 'mloadiskjofgmeregeeiufbdcuugyzqybivbg' WindowName: 'docjrpzdnecabiwcjw'
ClassName: 'qiqjcvlbplrvghfjguuhdm' WindowName: 'ltwbtzslsipsrovxbysv'
ClassName: 'ngbfkdjdestvrdwtqeef' WindowName: 'ltfdrzxvhwfgcjczjonfuymynpr'
ClassName: 'puacyyzksdclkftjnnkfmaudbvsuecksuprsghp' WindowName: 'euufjlfemnwyyvldrhfumvsxhoxfppnk'
ClassName: 'gdwyhfpsctuyxnxtgqrmegfmzsc' WindowName: 'vhcshqtdwabzbgvpkboiw'
ClassName: 'rhnjppdjskrwgptoncwkevhei' WindowName: 'cqufqvtxqbfudsedcifczwguykhwe'
ClassName: 'zfqhkdpxmdmnarzzokxbfhtahmnruhjismxuq' WindowName: 'nznrciehudoqrifrcywjcoqtlsfegnmnmffj'
ClassName: 'wuzdfzcsiahycanrtcidmhorswpbhda' WindowName: 'vcayqgqokfzbwmanfhcxraxsszaqsyvbiquflw'
ClassName: 'xoybjkcnrigcufncfzdmpdhagaxfsxboth' WindowName: 'tsnuqigysddpgwiptblsxm'
ClassName: 'ajieclzrcqymswyzmvhbyqnfyxnoqbgr' WindowName: 'ppkjluhmxywjklbrro'
ClassName: 'pmppfqejxpslshl' WindowName: 'qiacgkotqamkqkgoqixis'
ClassName: 'vhdkbcpisfpyvyfuqduljnrjukhy' WindowName: 'thtfmvaowjaonamrqorllbr'