Trojan.StartPage.59334

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsw2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll
%TEMP%\nsw2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'uudpluzixukzowfdrfd' WindowName: 'nswhashdfyqggstpdiincfbxb'
ClassName: 'fxoijqclesdfkbeosehziphdmchwaqtldx' WindowName: 'vawuztgjxbfztqxuhuxhgajetdooyu'
ClassName: 'cxrwftdpuhzxcmcrhuhxkmgdnpe' WindowName: 'aofbgnsycdizizsvumaoenggzqeci'
ClassName: 'fkmvgifibewkvygifueuev' WindowName: 'lvfuznklkiclcyzjvzfi'
ClassName: 'fbovcyjhlwmzubtculzvexypnjawbowcxb' WindowName: 'qwirzfnvnsdsdkipfuwepsgvqdxpwgqeptker'
ClassName: 'iwjjwprfpdohhyagxpmxrkdwqhgqpahvkwj' WindowName: 'qubvxscaqdwebibfdcspchyhudsl'
ClassName: 'lrtdmiaonfpvigrivtjeuayr' WindowName: 'mfgxeprnoxblkpbqfubjgxqafomaojxu'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'bpezvncydxrfnjybvrdzvmsftjhckfmjvjgj' WindowName: 'ocgnksqggnvtwgzcdzebokzvlvfeiocj'
ClassName: 'ppbcyaiexoprizjtsqvuqqu' WindowName: 'hrmhazglwadclcgwpfqtvau'
ClassName: 'tsfzqjpkrblkwvauhbsyqltyqkzflnj' WindowName: 'ztiwjgizbdqnswtdi'
ClassName: 'fdrbzhoulbfvnfnietxyhjutadahofitp' WindowName: 'ovvngizmkgrfkvprrck'
ClassName: 'oafohchnhmydldmbagnsgvlsaogip' WindowName: 'kkzxccbyucmuvxxfvhzfcw'
ClassName: 'wjccnfexgibsizhbqkthxecexmd' WindowName: 'kzotjlupfgbwhhsuyrhk'
ClassName: 'ltmsdljoosrnpdspbxivshjindc' WindowName: 'diuiqenefalyqfftsygdizjopfhs'
ClassName: 'xzzcqnpqiqliucuwsgugmheervjgcczfwle' WindowName: 'nsqtlxsqlefqmmxqjowii'
ClassName: 'euucmwadtqhpnykkio' WindowName: 'zivtlsgymlraryksvzanlmzvucaxrpjfgfsbp'
ClassName: 'yzxwndbzqlboilbiolkhjyjfdsawpjagnsrytv' WindowName: 'ctinichbwxufsoddohjeayyitvojdwbzldvg'
ClassName: 'kqzletpleahsdtqqzbgivfgbjugxfwgh' WindowName: 'ymzpbddwzqubyqpsbyycujjvuvwaunc'
ClassName: 'xbgoxubwdawpettseqsonpebqgckjvvsmmvug' WindowName: 'svvmjpepymlmrsjfneedxxjjkkef'
ClassName: 'xgrifvkhvktedgulrzozotexq' WindowName: 'oaiwoefawbqvfmudzwclyefqoanqwaxyzhq'
ClassName: 'bvpffgzjzdjvzbrbldo' WindowName: 'fbqhjgawzinljgthdhgdnerpiflkwtcqbf'
ClassName: 'bwrhkruuscrwcumptrtuaan' WindowName: 'emmfuewnwppimgxgmsdsrsi'
ClassName: 'bdmmbgddrvxduzmgq' WindowName: 'ihsxtofiiilflfbqogesukt'
ClassName: 'djfwsgoqouyjiqrtthhymimoumvaj' WindowName: 'bmhjoejdkspdharkfbjaxuga'
ClassName: 'fdcligpaoiuiitdrbxuajlivskqxtfwlbnivs' WindowName: 'bgbgmhdamhfhfzmpomvhtdkavnznyczihpjcs'
ClassName: 'wyqvpqtbcywrvbbksakzuyjhavbnrdcyfvscrjq' WindowName: 'wleytojzmmxprgkmqgoiptkxijkbryernsk'
ClassName: 'pxwvtfjldapjqsuxiigadhkrwihwvsnn' WindowName: 'klykmgnhcfqnwgdfgzikpdgduqpcjj'
ClassName: 'kvlbkgailkdivzhsalnrckb' WindowName: 'tusavwksqrtnzogaonhemhq'
ClassName: 'zxktkyzcfflonoqnaohhihbzcktxghyltvjwkf' WindowName: 'lcylumofmkahenbyvnbkualbums'
ClassName: 'hcstjrxrviuimorrzasngvdsy' WindowName: 'guepexfbmiyelzqaqjrixbcddtora'
ClassName: 'lnceueukbwxyfdaqwangahrcockjuql' WindowName: 'tnyrpfyckgojymprdjnjvmxtmx'
ClassName: 'ltcxzlegosggucmuzneocvftvfuk' WindowName: 'hnyfzwtaddlvtpqpeggfmardfvbzzzwt'
ClassName: 'qbaqiykgofixwpibpwvzhcvo' WindowName: 'curvbuhgowhthyxlj'
ClassName: 'jvfkkkljzynqcfdz' WindowName: 'rpqvyfxrfrvxisnhijuyclnzbtgreihhn'
ClassName: 'xabnvkpqbgjulohcigbshlgrjvzsddtpygbvsxy' WindowName: 'klfneqhxtyppfopvzbedvqcsnyjifozy'
ClassName: 'nuqhslptwcgagwofcvjzwlqmmh' WindowName: 'tminbpnsfyfjysmfjrxukkc'
ClassName: 'kbheerypaizmfyrplqjazxlrmcplbzbpuxk' WindowName: 'xfsqegsqxmfsjmvl'
ClassName: 'kyuqkvonysqjaikhtzqtrkxxmlmrwz' WindowName: 'wxutvvwzfczqhlevckuzpobm'
ClassName: 'oeigiyvgayeckqujpzlyeeucor' WindowName: 'hmxhpreqomiytizxyfqhfriqlfsbcx'
ClassName: 'lrupvwagjisjrgujpljfiqlb' WindowName: 'rtlcawvykgqlmzxgidcabiqi'
ClassName: 'iayudygtymgvcgxmbrohntiqw' WindowName: 'hauxmqtrttzuljfjhgyc'
ClassName: 'fahrmwiufrlxlhlmwsndzw' WindowName: 'kupkyhpvlaekcxo'
ClassName: 'lbeeaiewvhavtffdebsqaeuxt' WindowName: 'sjaqkahxseshlypim'
ClassName: 'rnwqubosolclpuyvletmjms' WindowName: 'ysvghnlsukrwmjfpyulfhksavdcol'
ClassName: 'tkmomshigzcyoruehoeciud' WindowName: 'pntjffmtxzxtjmkkz'
ClassName: 'afrwjuhkicekotqqm' WindowName: 'fihgwntyesgmdctredknrxpralpkgxpu'
ClassName: 'vuiggptunfokoudyhowlsuhdzxbogenmtydk' WindowName: 'ltfzeiakfsashklnmixcght'
ClassName: 'cedvnkabsxnjupqusa' WindowName: 'unjdjtiivwqdafpcrvxzgv'
ClassName: 'rcbpbgfogfdxlsthiaycruyttcibp' WindowName: 'vswbrxmjmgdfiqgkxwrucagjuxscbzrf'
ClassName: 'evrikzajvvimqfsevngvlvazvmkrkxx' WindowName: 'yfzqdgzvgfjdqjybth'
ClassName: 'mecnicbaukkxbfvbercfmmzxmzrmccsblmiyv' WindowName: 'lpneblnvwugwrsgvqbtdhpehkszampquwaqj'
ClassName: 'qjwdkdrrzxsbrmkpoggsel' WindowName: 'yyakqnexfsluiwhmabssixhs'
ClassName: 'zquiwbfmnekrfarhcnrzbxuep' WindowName: 'cvzfyildypjmtvuweg'
ClassName: 'syzqeflcyvzxyplwjuareceygfypkict' WindowName: 'fsuwicfueseuoybfjsrhlahinwonujdnneuecu'
ClassName: 'nvfjeqxkyxiqpqboxlulm' WindowName: 'qjacjmeusiwcyonvbhobpuwf'
ClassName: 'sconcutfjisithkvmgobfzsicjapzpfbbwf' WindowName: 'vkmvibcpvpvpwycupstfivg'
ClassName: 'pspqbgsjqujhjjppkjsvsspxts' WindowName: 'tlhuudeobgpdxvxeimbzlb'
ClassName: 'zradlqsdoghcsybexejfnyerrmx' WindowName: 'npovqfobxgolibhnhikcoa'