Trojan.StartPage.59305

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsk2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsk2.tmp\System.dll
%TEMP%\nsk2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsk2.tmp\System.dll
%TEMP%\nsk2.tmp\Math.dll
%TEMP%\nsk2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'gjnykjrsvzhnncnyhwpkrrnvzgwynh' WindowName: 'jmtvgyslqdjekycmsasixnqvgv'
ClassName: 'nlmcdijspzzxxwnpzjtsle' WindowName: 'yqezoyxojlfdqtenvm'
ClassName: 'mzpmikkrszwapevrechrcgks' WindowName: 'ljljkoxqpuxtmiw'
ClassName: 'fnbaxoajzivrsjkdyycqytbfkoisfzlmxlpaubk' WindowName: 'uguwehkhclyvxrdd'
ClassName: 'lgopzrqketupuoagogshdbh' WindowName: 'jjndgjgnybxmxhkj'
ClassName: 'oajpxdzbkjwwubfvqzdjcpwquawjaqznak' WindowName: 'tintdhsgsserszxxrfsslyhnibnconkgqwdxsh'
ClassName: 'quazklkywyqhzjqakcskveilkaqtfsuz' WindowName: 'pfyknnigoqvnbpnuppkayki'
ClassName: 'btpxmzsasmnjuujscwjmvbmuvlgkmyqslpul' WindowName: 'cndjhajmzwkadtpuhw'
ClassName: 'lyurlcojjzoklaxszbrvkgvyjpcctvg' WindowName: 'jtwjinubtnueeozilroiryawxns'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'rwtaramzzllcrgwiucucujegbxobssget' WindowName: 'vksbzdxhhdrzcmeaypbdzwjapgvzoqzvoeutgow'
ClassName: 'srozeugernwbujldtpiefpqehvqtnyoxielsw' WindowName: 'nczyhxadzxufwpm'
ClassName: 'vbfwjfmznctlgugzhaigsqirrmitdva' WindowName: 'pjfmdcnovvlknddmmvxixqprpcxwthiut'
ClassName: 'fyzaxyxbkuwzclraqou' WindowName: 'ytsmeezrbmbmloqbjt'
ClassName: 'dwrcqqqxtfwkycmmiukuaausqcmqhzcpvtx' WindowName: 'yxfzojxelmypvvwhfpsclkwwvqbeovxlbd'
ClassName: 'alhgeyssrdjmfuu' WindowName: 'wcbliakrnulujmbiuqqb'
ClassName: 'spfjelyrqkadqjml' WindowName: 'zfghokpghyfnyxqpujfntmxpynol'
ClassName: 'pxyfcxtmyfksbhylxkyfgymgpradglmzkcopkj' WindowName: 'oxyajphzyghiajnzolmaxmpjnnonioxxdlduuge'
ClassName: 'cmcykugrhkpuozktbbvxlwybmdtkiadvtsbx' WindowName: 'aogsqkmuhhexhbkfdkztbvzvowtgkfp'
ClassName: 'zovuvvkcvxqiuxxgxnojomceumjrjiodzhkxwk' WindowName: 'yrhpyjhsetdytpx'
ClassName: 'rqookppopzgkepmsjkdorydepxltfmbyixpvyyj' WindowName: 'ghiuvyhgejmxhztrazoxtnqyzmgb'
ClassName: 'hcycaodlcbgfcxjiccrbggjevkwvxefrckndl' WindowName: 'yikhcwmfovxjfslhkhzeurdgfkhmidg'
ClassName: 'oziwgivmyadkgnsxileiteldnzwhysof' WindowName: 'lfjujdoaeamgrzmeky'
ClassName: 'ejuxkbrixljyacehfdkgdj' WindowName: 'qdtpxjmdsboocmdbbgbplhypggrpel'
ClassName: 'fdeztedeagfuscfollvlzilahpjzjirzden' WindowName: 'vqrulakqylxezpfuzjckakmkrpbedms'
ClassName: 'hhjjjidhfbpqydxzqrxhpblwuhybdbfjknotay' WindowName: 'nwedebasripcjulrjifmhgpkowklnitteyqwqv'
ClassName: 'qfonehmqtluztorwallfredsunm' WindowName: 'ghpfaiodaiqalisomhhjlmglaqtrkoiene'
ClassName: 'quoarjvtidlwoiirkh' WindowName: 'gfhyrnwdyucjkohveyodetujifs'
ClassName: 'wiwfkjddupybqqlzhqnwpmumodc' WindowName: 'adrebmgjigaqftvuwajxdsttagjgkkme'
ClassName: 'vrrrfyboslwfgvxnansbep' WindowName: 'tzngnlwvvmrbcdvxjyvijpevrzcznkydyhzn'
ClassName: 'lenaamvoazrpdhrloleyapk' WindowName: 'spinxzpejurbenwcznbzcctdhcphoxqm'
ClassName: 'jftogidmqgephajxngzjnxnjq' WindowName: 'sebdopzxjntemlkjukpschrlmt'
ClassName: 'ztsqkhyutjhtryh' WindowName: 'akikijzrzhroavujmn'
ClassName: 'ebaoiwhhalzwannattrmzigsztsytkgfddntxyy' WindowName: 'xgdojmcpcgzdfrz'
ClassName: 'rwilrkielxdvmqspmcotonnfbzadr' WindowName: 'csbpjalnvkisszoepntoty'
ClassName: 'lcbvotbvvafhylvdqfvkc' WindowName: 'llaxizbbcmdqslgmmwpyhbt'
ClassName: 'pdiebpdaooukdyccc' WindowName: 'wtxdrshtevdmxubhmsuuirccwemb'
ClassName: 'ojosyohixztjzzdongqgztxakpiirh' WindowName: 'ylwzyjiprqosiwvwcgzggbt'
ClassName: 'lzbsycpscragqtmstwcrnoavjnahqgb' WindowName: 'jzmrqvntmiildbvjvfin'
ClassName: 'genildpjihrevysukbfcjjkpnn' WindowName: 'evaydymjvntxwntienqzferdufcmk'
ClassName: 'rjdoonwrmvkswtqjnnhzkhqtobnwhshwe' WindowName: 'egdsotgyxbwssotucyuxyfoyirm'
ClassName: 'fkwwkhrmzowojldydwhxqhfvylo' WindowName: 'gzfaeruhzrvnkykxjxwygnpqicycdxswop'
ClassName: 'fbhrhcvozmjqyitaueeqkunethkruizwo' WindowName: 'hysibfzhxkicmvlv'
ClassName: 'lnponsfsgoozcwwialepbytugcydooqp' WindowName: 'bskeensrrhlvbqwimixyjvrsioaxibzvcjjvhi'
ClassName: 'uqugzrrtwnopredzsssbtilqqhgewfrrnh' WindowName: 'yzssfgmyaiskacylyafmbkzkp'
ClassName: 'cawwgkivsyqtiayjbz' WindowName: 'jbezkipvnoxccnpstpstvw'
ClassName: 'ncghshcwivzkmwmojdfqbmhsmneohzecykv' WindowName: 'groerxwijdpgwzyzx'
ClassName: 'lldfmcfxriuttgdqyghpob' WindowName: 'qupxoxjrocqpmhdxyliyatwct'
ClassName: 'eewnnqhggfpeudgxnelkbkqospm' WindowName: 'fuivwezchctwoyktxkdcrakzvkzytec'
ClassName: 'zkqmkpnicgpzfttppsfocmji' WindowName: 'hfimoowodaqgwma'
ClassName: 'qfvrgbftxgvybdpcjybuvzudrcgcvjenvjb' WindowName: 'fflsevoeqtnufxhirnzczaihylohrsze'
ClassName: 'srkqowxgndivthdwtuibtrtekfqxfa' WindowName: 'pjmxylfrjgkdrydwiijzuckjnqdtragkm'
ClassName: 'grcuftzeborcfvznxjckqvmbn' WindowName: 'jskyecedzuafdzmedmpowsd'
ClassName: 'jdgookapnwxwbblesbtrsc' WindowName: 'yzhqnefncnlheqoozckjq'
ClassName: 'ckhajvrctvzsqoxqssbtfthjzyedsndgj' WindowName: 'qolgfpdwgsmmyejtrla'
ClassName: 'dumhbozftnbcbli' WindowName: 'itgkydkzhqpoyoeaeanakjrdmzyfighwwxfm'
ClassName: 'xvcqokocwbgetvzuwzc' WindowName: 'czamogbkoyussbeywtzsmbyr'
ClassName: 'zsluzolbxmabmmhvrvkmblsvlqcxeuzirgykciz' WindowName: 'gdohgsmqhxwcrtaccyigrqzudpu'
ClassName: 'cdbveragfylapluogo' WindowName: 'yiuivfjeoorwkrpcaflwyviruga'
ClassName: 'sanxsnfjnvcuojmzd' WindowName: 'zhmuwnlqfmittizpcqofjwvdyagvzjdd'
ClassName: 'pofqshdsurtooek' WindowName: 'vdrkamsaajwwdbyjzquowvnpmszvyxjbcxu'
ClassName: 'fkisxjvkghdmxiozsr' WindowName: 'sskxgaxjbfjnyjxhlgkckyrhybbhrmdsiyjfvz'