Trojan.StartPage.59298

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsj2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll
%TEMP%\nsj2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'lfasrygyauabmsk' WindowName: 'sbxrnktkhwiuclmmgtidtqtsgmqp'
ClassName: 'nkvluygesbzxpabe' WindowName: 'jbpaxuexiaxtermn'
ClassName: 'esjfpqojvlevvemhwszgrgstxpcjczqelwcov' WindowName: 'eyckttfwzhidnichxucoafektniricotrvgruk'
ClassName: 'rtfrihlevvkfjeqzpovwglqmufyhvifazwgj' WindowName: 'uivkyvvvzuazpwduxj'
ClassName: 'oqlaxonwvrwhlexqbppkrwdxaeelzhywcqbluin' WindowName: 'eksowixllylctvdplcokdjqkbpgtqr'
ClassName: 'xjemiotjqljhiaznlg' WindowName: 'armxjivpxmjzrmxowtwudnrbnbqsjx'
ClassName: 'ftwhzhaqgdbkbixmekksbzavmylcfiyzqghuq' WindowName: 'orhpwtvuamojavfggibct'
ClassName: 'xmkgvsvpuzwrkubmrfmajycmasiqpuzdkq' WindowName: 'rmnwgmubpalgoeaivujlypvacklbaqpmlkjrv'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'axqjuaaojbhmcjt' WindowName: 'qgopvmlzuwmtnhjo'
ClassName: 'pnowaiqoefafotprj' WindowName: 'ubxqoreihulwvuatcpnziptauazhzferaldx'
ClassName: 'xxcpkxynxjjiyfogsq' WindowName: 'sifeisoxxpyrasyqelpmtosylwpmwseh'
ClassName: 'yyobsxdzwaphttmrlnpnkpmigltydcgcvrlif' WindowName: 'xhyzqxroaaqcbtakoedqkhenqpis'
ClassName: 'txedgtbmdbflgvragfsxjwseovobsztg' WindowName: 'gvfzqswbhqgyjrwljgrqhnoozjtqtnroz'
ClassName: 'ubnzmdezqbcdyoruvso' WindowName: 'jimclsvqbjhgtyexjvdznq'
ClassName: 'zpctvjedejyjnfuzbmsvbmcqmkpdknhn' WindowName: 'julhuuawqprkemvastjhrvzqtfgbzrlzxcjzdx'
ClassName: 'wmxucacozzhpdjpimxpedlzmjxltyxjzoonjr' WindowName: 'lsuwrzsqkxxszgqnpdkinyx'
ClassName: 'vehwzfqgzxmmxddooxdvcjwqtsn' WindowName: 'rbwkiipfykcbwhut'
ClassName: 'mjlglddvxjzyqvxedppbroilgjjihef' WindowName: 'gafhjqastkrhytrzfkpligbtaquyrk'
ClassName: 'wqovpbnfzxshimetzqtairiknao' WindowName: 'gvubzcqsmfbueevrvqwzbivpuhwaixrzr'
ClassName: 'jsktbdeavonvvaxhaerkncyfmmg' WindowName: 'llndseyfwmplsapluwlfecsrztifocbbso'
ClassName: 'veryeniazuhllknjaj' WindowName: 'pszllfucnyadevshwlybbjcxcq'
ClassName: 'ajxwgjqesbyasxfooi' WindowName: 'yiqvaheijitidrnqkukpybcxtwycw'
ClassName: 'stayurhgauxrhzweieriwiap' WindowName: 'wqgnsufslalkbvyvcgxxxqhqweeeyxnwvxy'
ClassName: 'ualmwdkieulvdjywrnywte' WindowName: 'czkcbetuedninnwjamyzzcjzjjpyvylbbli'
ClassName: 'ichbjhtpgvnsxsmhfak' WindowName: 'gxestwvuwzdufyastxqjauikva'
ClassName: 'eqhmtvgzbwpywukqgpszjcrebekkwnpcjckar' WindowName: 'jvvidgmcwtuvsim'
ClassName: 'ugdouscwtidgerivgznyzwtbkulcr' WindowName: 'vdosezuyaszvvqoscfbdvoj'
ClassName: 'gmubpuldpaxakudzeepppmjxitfxjfv' WindowName: 'goikshvxyyxguulfuvnyobyhqtojjfuokmw'
ClassName: 'ucdjmqehdprmjgpvhcabljuxaxggmzwm' WindowName: 'bombcyvvgijxrpdmspuilxcgyiiqiikwf'
ClassName: 'ktfenqzvqeixrsfadtumrspvqzjknqpsdfuwpt' WindowName: 'dwvszrzpfeqoaqjhljowzuf'
ClassName: 'xkgacrfihexlhdeimsulownyly' WindowName: 'tkoyctxvcfnockwswjqxywjelxx'
ClassName: 'sebkhzgqfhpgueaxnsgethebijouuakirvzpuwe' WindowName: 'qsuydytmnxseztzkotgkh'
ClassName: 'trprboxerxrxdyxrcvstzaknzcsoywvedpuxvyj' WindowName: 'mjebtggyysfoyrbsmgalbjwpmdbhmehdibhm'
ClassName: 'fkhoxiyzybnaiuysbvqjnvvsbaostegjxvodsq' WindowName: 'rwwyqkmabftjtyydivtctmloh'
ClassName: 'mspgxennayakjrgjmbx' WindowName: 'wddciefbbgsufdadzzbpdvlxmivv'
ClassName: 'hojtvvmxposkmlfo' WindowName: 'nwrdnxbcbikocht'
ClassName: 'uadwgegeapmfwbfjtacygipznzfv' WindowName: 'lfyxmrektyqxrnhfkmihcuakguehzxynmbdajv'
ClassName: 'lcethjhpjqzsxfjxsvzdaxdjmgdzvb' WindowName: 'vptflcphcdrlcddeegxolwuymdabliu'
ClassName: 'qtrevmunkwvycryyljmeykifmfunha' WindowName: 'ewplzsgvemzdfrmevhnuhbpy'
ClassName: 'dtvqmkaizfnbxzhuakrgpolazdcdmjxjwfgsrd' WindowName: 'fijcbizxpyyngnitkjnewcnjqddcvoofy'
ClassName: 'pqwlrxwlompgyof' WindowName: 'oibojzhkgsxlwlfznchsslozcvztczuvqhuqr'
ClassName: 'ofrrdvnhnjjuwtvlaussgcnxsovpnw' WindowName: 'jtbprgtghhtxyzosxclpvkcubopez'
ClassName: 'nzhglpwsgqnwxvtjiqejzkhvzdoyqprzd' WindowName: 'zwhwcyhhsmujxxx'
ClassName: 'ivanqlsdbdbhcwzp' WindowName: 'minmmweoivdivmkdg'
ClassName: 'mfmtsvlpyfufhgfrdnj' WindowName: 'jzdkesicsadpgmtvbxmabpnmqsmetkmwwpkyh'
ClassName: 'dqemqfnkxyodaypkxrhzyesihftglfxdwuakev' WindowName: 'sqirxbyzyukahuorwnpwoozgfxiavrlyfz'
ClassName: 'doqdrbdimajrwrlzyttrqnatioxdoydkdpxobiq' WindowName: 'jsqfzudencgclicmojboobdgxtcaffdzr'
ClassName: 'sxjxthogiddrnqchjuinu' WindowName: 'dedbqumroiqwkguhuwljbkrdiwygyhgcrozjd'
ClassName: 'wnbhmfopyfhdjtxibkl' WindowName: 'ngebubtbowozydtaxnpw'
ClassName: 'hqtlkhbshvhmdsysfous' WindowName: 'icewifclmkhgnackjsxezzihvcpg'
ClassName: 'eojlmhxdtpbwgnaqmzpozjibteyswpnke' WindowName: 'bewoncvuwwrmgsq'
ClassName: 'dvmbvhfnezwbvpsulvf' WindowName: 'eyusgnhhlkonpkhlxlubkchusbmopetgymk'
ClassName: 'tzjvckzaotawpikejhroopnsxzhlvimpvdvahx' WindowName: 'jnwyenyqrcmyedrfcrupvtryfkfjzfveytqcg'
ClassName: 'llqxxjziukxfcdtjtjwvgklkvmoak' WindowName: 'txknfjymfxbmqamqpacndhfankpqjygz'
ClassName: 'hacxmuwhghbwjzuiqecpuhdacxesolavgug' WindowName: 'tjuzvnusgtwfprubyn'
ClassName: 'jzrfyhgrpqipyzbaox' WindowName: 'lsgqsuyjceglkhgmsytucghij'
ClassName: 'yzrypkmxfprhubjbxkrskzqjzkutzugne' WindowName: 'uqtsgewpuntcsjwgjva'
ClassName: 'auekhedlwxtirminclt' WindowName: 'nmmeaktnkopfmnzne'
ClassName: 'zuxlxskunrunwpzxdjefuuocrwch' WindowName: 'evubpgenreemgxhdhxgmuxpz'
ClassName: 'wahqczulbpjabrfuotdoaruqhiqa' WindowName: 'tuxzjcyudyfyhfosijqjsajbxwjnr'
ClassName: 'hwcqglhmbvpishtwd' WindowName: 'rklpmdgynfnmkfpdlbsyaraecnrxyxlcfkldn'
ClassName: 'fvvpbhggwibjtohezljnrpczvlknxcmsdd' WindowName: 'mvvblbritruoacxdkzmcefwrhdv'