Trojan.StartPage.59297

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsv2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll
%TEMP%\nsv2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'helkwozroppoaozfht' WindowName: 'bjghmtrqmnfshzzlubs'
ClassName: 'qgkriqohjqvsdsqzazcazlluslhac' WindowName: 'ozrqvokxuezvzzfvlx'
ClassName: 'cydvjcfzhxsmsefsuntrbxvxlbslty' WindowName: 'ymtwphwubpmehhgcbkzaf'
ClassName: 'hzbgeoufclhhxjjs' WindowName: 'plczllgugplhorypqr'
ClassName: 'tikbbvurfhfbaqwmwhyrdmntwrjvorai' WindowName: 'bdfwjrakxzvldsssxsqkfslrhsogvnouwts'
ClassName: 'herxqpubjfypfbkvfbzjzuhvnucebrqvqndd' WindowName: 'dnfsalvdkcaitynldzgrxy'
ClassName: 'lflcbpbiladvodxa' WindowName: 'xmjrwkkchgquaveofrngckpm'
ClassName: 'bmdlmyvjuxqzoelevxeam' WindowName: 'dhswuciaueouohalmrwojjwvxbj'
ClassName: 'lholvzdvrhqypygtwehdyscblhvwoewyplyg' WindowName: 'xctddzlmnpixeqgseusiyvczxbqndwr'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'yyqociekcqbhheseqkszrb' WindowName: 'ytdmvcuczdhdendflomxmiyqbxzsyvpvcml'
ClassName: 'grzwlndrojhzqvnrmhykdplttfbuburhdnacte' WindowName: 'atzqdomgiyeevlslqtnynvvrgxrkqfrcn'
ClassName: 'svexwwkefeitozsiqrfcfbcnr' WindowName: 'rugoqryfwllqnckilla'
ClassName: 'jxovjukxylyzsyfebt' WindowName: 'ycmgcxuwaatxsbdkwfpdxgtolzcfbydhzukpwu'
ClassName: 'ltercfmiwezauwuhwefeoesxttaxombq' WindowName: 'bxmmxkrjnlrolliniawyztvaaezhravf'
ClassName: 'whmmljpzkohjdpbcmaivwp' WindowName: 'whfpxmooixfuindpseaeskpjosqoj'
ClassName: 'hiuuktmcbziwwtkmilvqqwn' WindowName: 'tiapnxxlcszlcuygy'
ClassName: 'dalpurvhvzzdqfcnroljrhdafug' WindowName: 'twwycegywjuhuiypchhceptjc'
ClassName: 'yaxjtfkntimuwrvs' WindowName: 'ofsrkmosubcciqbmu'
ClassName: 'pchirxyyyqexbkbcguvrncf' WindowName: 'wmhrjpqeivxwypgphalibo'
ClassName: 'gtndqkxuesbgdqqgw' WindowName: 'reycdhlcmhsrueuuac'
ClassName: 'nrwsczbwfsiiopxyghyt' WindowName: 'vtapcnfbvistzzioaskckwa'
ClassName: 'aupnbfkzqmxhjwivnukkqpp' WindowName: 'usnbcbmomtxrdwplrrzjywzbavjqj'
ClassName: 'vwlgxkmlamciiqxxcjx' WindowName: 'ldadgraibzwaxenjtatdjnvkcrcofgvo'
ClassName: 'fzqzbfcrcqruailsn' WindowName: 'ivgmwoempxbfjsnjtstrvetujakp'
ClassName: 'llxelmcgcvcyeuggtbecjhvlb' WindowName: 'oivfdjmgahrestibqhzdme'
ClassName: 'nbalnjorvdnpecybepjfv' WindowName: 'gsalelddgrlryacvcutzgsbcuyql'
ClassName: 'gdyrbpzhghfjcitwwbq' WindowName: 'asoltdctalwmpohcydcmhjvccybyaglcfr'
ClassName: 'fdpjntztmwiytnbtwabixrmuuiphyjesidrkeo' WindowName: 'buyaljpgthdqgwmpkklxu'
ClassName: 'gqhkjajnsanixprqabrmnekdhlyukltaktcdaig' WindowName: 'eybmsopzdepqqklddkuognwi'
ClassName: 'vxdyrovnvplidqjlgmiogccnxdqsmjwa' WindowName: 'bulssvtfbonwltjpletdpbh'
ClassName: 'nxtvpxzfazlfdkzj' WindowName: 'msiptfzstijrtmhamamqvgmpol'
ClassName: 'erruonypefjkvvfwaeunreozvnsaa' WindowName: 'hsfiwxqeglslfpegukjkmhiqifq'
ClassName: 'ydntvlwxrkynpphuabqjtklpcnpmbmrgsxiqmvt' WindowName: 'jslmifuacnttmeg'
ClassName: 'hsrxlyxsklytchowohcqzgthszngnd' WindowName: 'jbjskefmpiqrbvrzkvovbzocccmnfsu'
ClassName: 'smdozweobisdxpdim' WindowName: 'upwelzhacuddzvyo'
ClassName: 'zrqnsggshgbfzoapkezgoa' WindowName: 'zxbfvkgpgxcjpsfzvtufdblevyexbhq'
ClassName: 'ekemwawruxakotpbqzxpzblmkpqoars' WindowName: 'phccnyerujgpnviufinmjlnrhssbftjygewnj'
ClassName: 'kdtnyfbaxmfxciydvwmarfeurerxaf' WindowName: 'xlmtgefudolxblrhzovzeiorgxfov'
ClassName: 'zywmyvskduxtkxgeeiituitbclrlvlcqygss' WindowName: 'vtmncxwpolgwvtwnepuq'
ClassName: 'mzrooafdfeilgdgeruutrs' WindowName: 'fdbmvieqjlalvfvgycfcg'
ClassName: 'npgcalpootytptrvbby' WindowName: 'iabnongkvskzikwklxqtbgdpeeark'
ClassName: 'olxvhusdatigvjgw' WindowName: 'mmzyjkksagflwrpuedrohtuacoiu'
ClassName: 'kezkjgundqbrrgfpifjthljuob' WindowName: 'lhfmeeszvoklgiengjykckiihalvqeljn'
ClassName: 'hwnmhzsslvnkfmluhkvubsky' WindowName: 'zlbjlutweicgqsolyolgyymsbhu'
ClassName: 'orwqqpolzldqeqijeawjyzdrfscclxrpdcy' WindowName: 'lzqnhwohnlesegiflzuneximakphdmetpmpq'
ClassName: 'piavojrcnjcakwonjfmqkwcsdtwujxbytmb' WindowName: 'hiytphhmimijftkndykbvmdjvinalej'
ClassName: 'cqkujzitohwvxdgbwkowsuy' WindowName: 'poiwargctsmfgkayeaswymhjyymtbzg'
ClassName: 'yyujehwrlmcicjnwbrouujinecxto' WindowName: 'yyzlwsfkybwddcsr'
ClassName: 'aaenrwbyfkoeovtxlucuzynlffpbe' WindowName: 'srqvoqiigucqekwuzwrpvatmzdydmyche'
ClassName: 'nmhijfixmidrvlitmafawylaawxffhpvtxdhvsi' WindowName: 'ibijjenuuwtvrdhha'
ClassName: 'aulrzrdnwfsxifbhnxdzzmsrrefcwlybov' WindowName: 'fsizbsflbnpjcmxuqbtfxsyug'
ClassName: 'ejvbnmudkbupjlolg' WindowName: 'rfwtwcjdwktishwokukafcdefcimyi'
ClassName: 'yewzdmmjlhldtlr' WindowName: 'bmclaulvunidtvipaemxg'