Trojan.StartPage.59332

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsw2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsw2.tmp\System.dll
%TEMP%\nsw2.tmp\Math.dll
%TEMP%\nsw2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'bgoqljcdyayxixlwxkicvlrzdjvpdrvp' WindowName: 'aowryymshnfwwlmxmxgcr'
ClassName: 'jsrgjaxwkoyjojofbitjiazuysekl' WindowName: 'kjwgvabmmgzsoqbupummyfoslustk'
ClassName: 'wixfqrmpqcpcqrbjoppcb' WindowName: 'cqjizijfbcgnkufgsccjeivgzaexa'
ClassName: 'jucvaprpskfscaoutr' WindowName: 'hovvbefzvhlqkvhjlew'
ClassName: 'edxjybjxunklbstzcmw' WindowName: 'cdiappsxangyrtnljswnbm'
ClassName: 'xmbbqfhlauveejblswpmfhcbydprpxaqbsrzf' WindowName: 'jpffucimtqamjdzl'
ClassName: 'noswceuacfrbmvkxdfdqzxyktdj' WindowName: 'ehcoefusdkoboawphdnylrlzvgvww'
ClassName: 'xxpoxzixkzcvfcjokujnbobottsht' WindowName: 'yzqmeqpygenonfwjrwmjvdsl'
ClassName: 'qwdzlvxjnyzyvoggsjfbqkgr' WindowName: 'gyubsmbkdzqbnffqp'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'mpqrnpvytgbnxcbdcuqtptuceymywusfcixzom' WindowName: 'ufdvowedshobwlrjxmbtcovsstpysitjbsjahxw'
ClassName: 'zqwmdcivbjiyrixnseliqwotlnqwtwhxlrowh' WindowName: 'pscatyzoioorccpyraiohxzqhx'
ClassName: 'ifbxfigvicxfkwoimm' WindowName: 'ednrnhkwwejixkeyoiyqi'
ClassName: 'nmkvuzkzkvroiyeofiuampqdczlvpkoucdztt' WindowName: 'bfkcbjfajuxesufmtbkazwqnkijjfizwozltt'
ClassName: 'sqacoiktcohcouojgohfuzkfgznutbsavlaoi' WindowName: 'cefgjfbcqheewmgjsyasfbvibijzcjivqcck'
ClassName: 'xcitjpuezhxpvroznvikeksdofrrmnhchcktg' WindowName: 'twgakosdxlvzsbbeaff'
ClassName: 'vydcjjlbotagwhfaobvnlehsz' WindowName: 'nbmnqaaneomgqwwomddwi'
ClassName: 'nirgfaextknpqagutuedmddpnmief' WindowName: 'ahwjnmzfbfsobhw'
ClassName: 'qcjytahnrombkhtseksntssxeddmcuzlswre' WindowName: 'iwslewgxedsrabtwg'
ClassName: 'hxpjzvhtgukskapum' WindowName: 'suiobhchnwuckquxyyyolt'
ClassName: 'vdgghysgwmpwnscjfyonbihlfowcperwtdpfq' WindowName: 'hqvjeaxhkukrdrcj'
ClassName: 'vrcbqfgyfxcylte' WindowName: 'hydizkttfkgdzrlo'
ClassName: 'ifindrfvwqzxusognj' WindowName: 'fqqgnthbumbieaspppgogudixpherrjn'
ClassName: 'rjrepgiazrgevidajjvszgtyv' WindowName: 'hekbbmheisrrxkudsowxidriikcnniquglypexg'
ClassName: 'mxchecsfonqgdmwfiozuuqpzlrrpmavqk' WindowName: 'bopxuukxmhjipgjszyjfhrtjftxdg'
ClassName: 'xmraazgmwoneyycxrmbbbuealgbtfgsvnsg' WindowName: 'amcuhnqdlhnvllpun'
ClassName: 'grawhxqltcupfpkqo' WindowName: 'etifzdicmugwncvnpqqmbkletnnsklaatvk'
ClassName: 'sbexndvaektafzarxihv' WindowName: 'gerjkozljdotxfxffmkvsbqend'
ClassName: 'xqssdsmmiuossljhycy' WindowName: 'xocalwplagxyulnjjehgymvzqqiqwqcpvdrco'
ClassName: 'xnpnpxjmjyktprvddfsanvicjbeil' WindowName: 'jjlzgabdojpfyftrwjhlmaywqctmcumxgsulv'
ClassName: 'rdjxcfacgcnriashgvzwr' WindowName: 'dsxlxqentjzvewawhitticounuifxhibeierb'
ClassName: 'nyjoqnotwilyzameyurjekdgyt' WindowName: 'kfwnaywyoqtlzepekehncfowtf'
ClassName: 'kfvxmhpqwsmsereoayrloyjmogxqftfxoelbt' WindowName: 'ffddqgmbemuwquflcnzbgapyvva'
ClassName: 'dupandxczpwamsfyxvwsgfmqvddonwmenwm' WindowName: 'gaomiesomoprsxqfeinebgunhxqncelf'
ClassName: 'aokwaeftxcgazwvcoeunnrn' WindowName: 'ohoyduvzmcyrxnzwzwotvdj'
ClassName: 'xxgvvgwyqdstslraqrspr' WindowName: 'hqhlprrqvypnxkfvidyvhmtbxuuqf'
ClassName: 'erpwqmoadrjwzwqcvmgombylrkuwdbglx' WindowName: 'vsrblxzvrgzejqnx'
ClassName: 'efytfhlgbttpuhppsvmowmaia' WindowName: 'qhbmcboqlnpinxqcbufojjoqsxsiuhlyttf'
ClassName: 'kfkvjahatstbchssexyjglgdrfjayspavhitgro' WindowName: 'ptsemxxqaqneembtxzeihuokyomgswgjyp'
ClassName: 'rzqnnukhezqxxnlxnvmhmrnjrxr' WindowName: 'dnspiqveugxmolhzojli'
ClassName: 'gsrxocrjptgbjbduvzyw' WindowName: 'vedckuraxklundfwjbxiaicgqutxqheiz'
ClassName: 'tdaqsiekicrzadkgqogcbpjzsyzh' WindowName: 'nweztvnztqhcdqbqwcnggbtayjxtdfvtmr'
ClassName: 'gjvjmohvccamiaiieckxoqhwbpwnwtwcqyqww' WindowName: 'yyizimhxwwwkejlgsrqojugqohi'
ClassName: 'ssgslybjmrrlazlnhyne' WindowName: 'npwcaekbobpdaymtoqaqqehrkudbmox'
ClassName: 'aytimybmojilakasolv' WindowName: 'hqrqjbyndmnwlrouezxxvhcpcuqlkxpdl'
ClassName: 'iqudcesgoviytjhpyngaguipuhbldtxbc' WindowName: 'zhkbxkbryaxzzmefj'
ClassName: 'mjlkurhaggxsajresusmikepxhvalsujqc' WindowName: 'hffecbhpklqvkdeqmtnthhepxglcbygyatb'
ClassName: 'hzmcfimnrozorxujzpmlehtbz' WindowName: 'piegqqarpckmulkalnuio'
ClassName: 'qdykwglpenvfrmtmehfvpsmipcmgkfhisf' WindowName: 'kjpltebujsxjrizppvsjidhbjaobjtr'
ClassName: 'ayaudhmekbkguhsxeufbiynfduqg' WindowName: 'drjmudkivyiqecvbqrplztpfuaxw'
ClassName: 'pqmteevywedjawzrgnxycuznjkwveha' WindowName: 'skbzvelmuurujxxavzyrropmwkwzw'
ClassName: 'ugersinmkmelwcebdvcwlvzznd' WindowName: 'canwuhsmbmzxjemzfmunpkmcizszqrlyznfvfs'
ClassName: 'qvmamictfuhoqfonsutaydkjxxndnyave' WindowName: 'qlcalpdenlqaiwtepjcaclezyeqfheutiyaecf'
ClassName: 'uloslahekcdppkzcegoxpmwehnrpfehcnwmxh' WindowName: 'ngipwbbnfnugxpxtmcq'
ClassName: 'wcsicjxxtiousyyjdnjcjhehuyzoj' WindowName: 'qrzfopsrirnhmxwarvtqp'
ClassName: 'wgkaszmqkkiblkjancoxjeiitxqzezmpqlkbj' WindowName: 'fdrqdbscyuqfhnxnmrjbjsqelonaagblju'
ClassName: 'cqgndarsklzvkvdedwa' WindowName: 'pyeboabyfnueepozwudjynykitynihhzrlirj'
ClassName: 'bgopvoniehtwadvpqdpcnonmgltp' WindowName: 'eqniataboknxbmwoseuqwpykzojwnmqhpwhyqfs'
ClassName: 'hoiufoeokxxresllskginhairgl' WindowName: 'gohhhkxrhhogcvajswyx'
ClassName: 'kpkdxfqitiuatrgqvcgquzppcsgxa' WindowName: 'cshycwlpedcpplstplital'
ClassName: 'tburuntcjpixqiffsfbnfbntuxltxoaigrsroc' WindowName: 'ipfxrbutmfufgwyskknvaqehurpqffgulzmhhz'
ClassName: 'vdtafioztujqxck' WindowName: 'zqtgnnrpalfqakogasht'
ClassName: 'htzrumyhcahoeregfnddgrroaighpaojh' WindowName: 'zzpckorddkduzjgkyhiqksadevofbes'