Trojan.StartPage.59338

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsd2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsd2.tmp\System.dll
%TEMP%\nsd2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsd2.tmp\System.dll
%TEMP%\nsd2.tmp\Math.dll
%TEMP%\nsd2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'povcmabhzqsjlafmpcumagntztzgapfqmxwmpf' WindowName: 'zajhqulzdoajvxhxpfomccywaqkguzwgfhdnuf'
ClassName: 'zdhzvdhbovtynshvepbxlpu' WindowName: 'wtcxankogfbahqvbncflcllsveluq'
ClassName: 'bforypjqggtdvcrf' WindowName: 'ggqsrwfglduosbizcugdclj'
ClassName: 'tmnidaoceldehaajnypyk' WindowName: 'phprdacvjpwmdxcrvaju'
ClassName: 'fjooaofrafkpzwmy' WindowName: 'tuhdeqqnuwhzhndjtsnlwtatnncapwegf'
ClassName: 'xjihbxzryfgimwmwalapuvycfaewbdwx' WindowName: 'ycgccxsiscfgdynxmejlvpebkrwpya'
ClassName: 'hqkhzrxzzeptzcpctweumqeghnssdcxhzacamc' WindowName: 'bnfvlkonuzpmdlctyqufkicgcazktoyunzxj'
ClassName: 'xoqbnsnlbnpilqyrazp' WindowName: 'jgjvitkswpxlwkutmrywcuwfx'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'cuccgaxdssloievgwioeysvpf' WindowName: 'aglkrxdexdcfterenmcedkd'
ClassName: 'qmfdqgrfytzqmlnqvrynanjm' WindowName: 'gweyohowxbjambwpymvrkckvaqulrk'
ClassName: 'gppmsqkklfahqxlo' WindowName: 'nrrribrasubzhtnmkqxsuidqwhzndqne'
ClassName: 'nyxhgccjxtidavwcycueqfptnclpkuot' WindowName: 'pntnxwpeaxsjsttxvdnul'
ClassName: 'knzccyfwstbqbtjlxxnnlovcko' WindowName: 'imenmuqwkhqdordrjikenqftrmfzpoipjimpa'
ClassName: 'jdqxcnncorzjscpfutcxjv' WindowName: 'okviyheiimfvfwmlowqgafgckshkgkngs'
ClassName: 'lirwkdeyyqwfqitmgddffsrk' WindowName: 'vlbiywavnacijizyf'
ClassName: 'xohnhcxaekgzkazdjzqdvwufvlihltjmkiqku' WindowName: 'xcktuxajbmwnmmgiejuchtqiqwkimhwlffm'
ClassName: 'diilencqsrfpfbstfqjzdiaorazdawq' WindowName: 'uddwkfndejcooffldthemmpdnmgavox'
ClassName: 'zajdhewclwzvagpyphzki' WindowName: 'wgzmfvfbjhyyxbxdpehyzssnylmvlnxrrzt'
ClassName: 'ozipkexfojokfkhlpmb' WindowName: 'ejlxupuqjjxmmfejen'
ClassName: 'hpikuadzvdkflnltzlwznyoidje' WindowName: 'dpmynqteuorrmeiyrfd'
ClassName: 'lkabnkftoxiemhpldpqvsqbmeztsuvnkdmib' WindowName: 'pdkvhxljxyecmzcdnqcomaqyjqxmy'
ClassName: 'fmtgttmxxpivgicuprswzjfecdhdlrfksk' WindowName: 'wxbsqocalegnvaqbavf'
ClassName: 'nwyrajlzwsocooojerdezycuevugarwtokw' WindowName: 'rbnyqtyijklfcvzldndgkcpafwurblfjde'
ClassName: 'rwcpkbbppzvwkjtzybuuozekqgaqct' WindowName: 'ylrqjywzdudylscqmrpksujeqdzbh'
ClassName: 'vnmkcfdcsiheibjbsgzbtlyvawrftymawjwvci' WindowName: 'kpayjdogymcidbwktuyjhjlicylkayidxpxxys'
ClassName: 'ttrxzktjamuggmiom' WindowName: 'muzufccyazytjoueh'
ClassName: 'wwlqttqlwiwbaliaisrnyoapolcgokn' WindowName: 'dgpaimzouxahhgmwuemfqsojobrnwytaqju'
ClassName: 'ocmsafwvklifcuhzuyhwwdiiwteazaqaeyjql' WindowName: 'ygrzbiutvadzgugtbvbsmnfdiunowrieaza'
ClassName: 'xwuchhadhncrotvjnrf' WindowName: 'jtxchvbtdjejwgxky'
ClassName: 'fhaljmelhqzbukoxjpbpddofxaweikxesy' WindowName: 'klyfgwadoaetkxqzvrbpbk'
ClassName: 'pbawwkiknlmhsicbgsgqttehdmtlj' WindowName: 'hscjtxfxdvrgdsdeween'
ClassName: 'yzkigjqgtclagtaphwjeustc' WindowName: 'ptbxtgcpcorqfldxgrxfagzbcyotrchqgfqdx'
ClassName: 'gskibqlzwcqculffl' WindowName: 'rxunmseaonwnsxltczqyqsfyytipomopp'
ClassName: 'pmaokuksijvfhtcm' WindowName: 'bhfyuqgaxtugtdwakjij'
ClassName: 'jowpnnvwmmgdyqzvaufgvovybwpdwzlntk' WindowName: 'gemyirbzwuaoyzgqjxmd'
ClassName: 'uadfflifadkidhudjoozyrfrs' WindowName: 'qcwudsgsroouplyhruwsr'
ClassName: 'stvzqgsranfchgdfttuseiamtujszszb' WindowName: 'mvyradgxcrmtpqcnrjqmbxpdilf'
ClassName: 'fsvuszmtvqbzrnflhnbkaj' WindowName: 'hzqzhwfpttqxjirpixtkgaswgo'
ClassName: 'xggzniwtsdahnfqhcpchdtbsawvmuifpaqvphw' WindowName: 'sbxdzsrtkrrxageemgyjprygvynbqxqriqgjrba'
ClassName: 'efzauelfguxgbkkgjtqrxgrczdcyh' WindowName: 'qzkanolxuazuyokg'
ClassName: 'bsvrvirpmmpkgiflzvlamdndyyw' WindowName: 'lviybnknzoobqxki'
ClassName: 'mfpfzpyodqwxhtk' WindowName: 'ycdzebsrvapxsjd'
ClassName: 'pdbcvmzcojtyzjaojbkutabhwuzbcjmhyjklt' WindowName: 'ygkvptodsllhopxxjkcszgllowmxzshdkvpskmj'
ClassName: 'nscavbsnxrkjllosmtb' WindowName: 'atfrzwhwwnrztyfrrvakpxisup'
ClassName: 'mjwescxucfrdgyuzyallhkgeigdxnvucktrpmx' WindowName: 'hgywlmyqwriswhgfrsrdtnnvictt'
ClassName: 'jnaalbocaqbwipmpw' WindowName: 'qhxzpppevthqrnisykgeowpebuok'
ClassName: 'cpckiatrdjkaaomgdigh' WindowName: 'cgfdmredpfcqbmx'
ClassName: 'hffxfjuggyszdgtjwchhwr' WindowName: 'knovhfxxajiueszilvhcdlyjhv'
ClassName: 'uzkbnxsymgdgbpuwtcvqsdcymmjlvxnef' WindowName: 'jgotxhfrsuluieljrtebobfjgprgohqg'
ClassName: 'rrjssibmgaeuhelwvctehboug' WindowName: 'gmbtqtwmxjiwuiyiv'
ClassName: 'mlwqtfpzdiwhstdsscchu' WindowName: 'plrobjfhthuxtqbtxqhaba'
ClassName: 'tbnvwcecsauuapfznvbnrc' WindowName: 'hosehkgsqkmkuztbqokcsffnpgwdfjq'
ClassName: 'ezoxialrlgjolnqjui' WindowName: 'goxipsklghttnsntpd'
ClassName: 'eifvlrsemnzgnrqqqxcwjxjzjeztvuorqai' WindowName: 'uqfqqxslbudzfbkarijosiyqrjic'
ClassName: 'rtpjgasbfxgbcjrlbetywxqfvcslkxryqkvume' WindowName: 'qpfpgfyxltdcqettszminorzumu'