Trojan.StartPage.59342

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Desktop\Internet Hao123nknk

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'lxmnorffhosrtnrjxzfzijgxutcing' WindowName: 'ebfoiekpiunodnnxoscktkhivpjl'
ClassName: 'vouhrbbclsutxbvntywkocvoxszcpkjkadvdmd' WindowName: 'zdioumsocpggadkzmtdixfodc'
ClassName: 'eupuexdiujgmqydeupczowyayqfxi' WindowName: 'yeyqlagayhygbrpoyhazddmuetzhkldhvromxi'
ClassName: 'bcmroehcgcteplhqbybvigbdh' WindowName: 'dalzfwwdudhqxxlgmx'
ClassName: 'ecqqisrddymtmflinzj' WindowName: 'kcxxxjbwikuqpgxlgiwyqrjqn'
ClassName: 'ckkcsbowwujaghhaqsnivdlhnattbcloh' WindowName: 'mspcudakphbcqtq'
ClassName: 'icjjsbykcdwfqtxokolupcnwtbvcaqf' WindowName: 'qikvqiegyxsbbwcagaoxoxdbjdrrpwtbw'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'tmlhtfhcagvxbrmdmyrrmorbxgxihecrsqodqix' WindowName: 'anbqewtdfasphlnoy'
ClassName: 'hkpxvaeljfgfrtghplvppitxzxcrln' WindowName: 'yvzqgbdeyewycjgaoqlvzphaxvekbibgml'
ClassName: 'ardkogrdjzixokzslvvnmklcpvoqgxuxug' WindowName: 'sleypuvklleautiinei'
ClassName: 'eglrsurwpljpphrbpvujsasnjsumzjoi' WindowName: 'arnwljoklcuvderbakcmdlo'
ClassName: 'txceanwystksvgno' WindowName: 'loaoydubpeitdiicinzexp'
ClassName: 'mjuzzpatzifzyvllqrhruloaosugd' WindowName: 'pasjnrjjxoycujbhsuf'
ClassName: 'ggrbpumaivuhyyrepsglbwhzsekgxuivvcir' WindowName: 'zmwfpkfndwckftsxigrkmnwxniwrntgfsmso'
ClassName: 'ajfjigprgqsgojkffdblfqvommztrldymdaxr' WindowName: 'eftiavnzmhkkfqmsbwxbpjmthtgolaahkvhii'
ClassName: 'yjonftwksldqqvcamkayp' WindowName: 'yajbbhkwvwfrtpijn'
ClassName: 'kkigplhiacoucgemrwllk' WindowName: 'bbzmjmchjimbuzx'
ClassName: 'srgdtlhlhvetxroszmrtepvgojconexytqu' WindowName: 'sufaekqqlwxernmapgotodcwcssy'
ClassName: 'feivwtuborvbihgixtcumztvzweq' WindowName: 'zdotlljxzhzrnraddgchrmoeugyqgmt'
ClassName: 'htrjfttjdfrmxfjjdwmu' WindowName: 'laifqokacngfuqwirctqtxzeuz'
ClassName: 'zqzlqwdzkqgyknfzjnpwkp' WindowName: 'dgohatdqliectpdyjnbzefirlbdsvcwnnbes'
ClassName: 'isvunpnzimpizmuwudci' WindowName: 'rxbiaaawflscextpjbkykdquofizgsa'
ClassName: 'pntyuwuxpjisomd' WindowName: 'rhxveivjoweyifxhmmmwaxdacgdja'
ClassName: 'ipoaltzmuopddgk' WindowName: 'cozypscjanuqustwghorwqkwupkashebphxfhru'
ClassName: 'ceohazjcwnzufqzvchjuqqldka' WindowName: 'joqrrvvkqblvmawvrqzfxlckdt'
ClassName: 'iterqiwxezlkcesbsx' WindowName: 'bokgqkwbiwowjmecupiyk'
ClassName: 'ohevygzvbmiqlcojokqnownicbhivublcoaabfe' WindowName: 'vqhicbshfmqtvhvwymlkhjiduybhhzzvnbb'
ClassName: 'ypwuvfeqxhikjdeylhcoyaiqjgtiuikiee' WindowName: 'gjaciyhqsnsvvtgirddvuikthavulezirvlpj'
ClassName: 'judnmmghxbnuwmyedmgagqfvedkbkrpnk' WindowName: 'nitzsyyuiwzjptjyzoxhfipcffkqaqjwiceclt'
ClassName: 'hsuazhjilwzqwhdjpirodzqcr' WindowName: 'mnybjqasmcbpnntsyqenzielwkemy'
ClassName: 'akhgzjfmjhzmyexcdmmcmbbsnhvfryweogvkeh' WindowName: 'rxmmhuvjeehpvoiuwmqrf'
ClassName: 'hhqpjchxeejupexgzoruxhgguqx' WindowName: 'dybuiwfxylmnaspix'
ClassName: 'dukjbymwfcmzoztbiugyapdafibq' WindowName: 'ghmmzfaqfkeprsnmcjwowgeafnsgqekldmoa'
ClassName: 'hiruuqpdefanrvioidmbwikeeahvkhu' WindowName: 'yzzodgqapcqvaegxbuohbsglxrwnaeaedfxd'
ClassName: 'kqcqxjefqyclrzrqjfcs' WindowName: 'qzazgkeolrlnuvamu'
ClassName: 'vzufhlbizqrdiuxuugkmqqfzclj' WindowName: 'rbbjxeteuutfsjbmrxjmhdy'
ClassName: 'cvnxtepimggpqjuasstf' WindowName: 'phmvyuwsijngqydfbzmmowrttajrhjwhxmmo'
ClassName: 'rzvdqamgkrlefvidvwuyceflkaazykwazjz' WindowName: 'pefqxrjumajxhulujs'
ClassName: 'otrtuzjuhokhvuxossgiqblgfrpckv' WindowName: 'lkubsdeiyjuxure'
ClassName: 'bmsaevveqqcugeuzkfijhgflwapqymbcmorlst' WindowName: 'qkvduxpuoohryngomgofcdmolt'
ClassName: 'hvhnmbryjiuvfeggsx' WindowName: 'oasgllsrdzxfodwtkpbmwdxsdjbjxhjosgvl'
ClassName: 'iopjtkslmpdpxaeg' WindowName: 'wlppgbovimzdebnhvlidyim'
ClassName: 'fmrclhsimvhdivycyn' WindowName: 'rxzatjdkajmlsygyqqalsnriuhnrtxxjte'
ClassName: 'tgcvouvbkcvxhureljvxniajjesvd' WindowName: 'zdpeddurmrmbvthntxua'
ClassName: 'rapnlfnxifbswdpdownuprvoejnjekmziufgghk' WindowName: 'tkuggkjxkcruidmrmalavakeoc'
ClassName: 'tgcvrsfhpsoytuykjcidpxnyrq' WindowName: 'incopnmzdcrbljgdkqfcel'
ClassName: 'rbzmytidyylxbznv' WindowName: 'csaqqhwjpgastplwnprbiupv'
ClassName: 'sptfotpzfbnjzbyg' WindowName: 'ahdwamewkvyiktontwrjjctqilwjhghgfaed'
ClassName: 'vmgfijmjeyejftlq' WindowName: 'tpfkxvtwaaqhsncmnhjuycgo'
ClassName: 'frauqjmbzjfepsn' WindowName: 'nlcqetoaokkrjpo'
ClassName: 'spensmwqzugwvgznuineesrbzwfnvhstvmbfwpi' WindowName: 'mkdeiyigcirkyekomqardnfheiwywlwwj'
ClassName: 'hlvwogkcbuddpxmtfmagafudzmzpwm' WindowName: 'zcoyignyhrvxomcpjhnhevettaxto'
ClassName: 'zqdtidfhelfrsnlkmuitafzysltm' WindowName: 'ssktuaurhhpshzibckeadxccdreqktdbvfhm'
ClassName: 'fspvacaawceqhdlvqynoiuvpec' WindowName: 'jsekasrxvpndghpesmfvucmadow'
ClassName: 'besnqjvbodarbrcrll' WindowName: 'jhtosxcdkzpylziklbmvayeokv'
ClassName: 'iocrnqefaponbwwowqhltokqgzxkidbhr' WindowName: 'oxdaxozvztjbtfxktcqpapdipicpzrhz'
ClassName: 'gfpkuivgjghmacnsiskzprucmnfyqelnxch' WindowName: 'ezxmxcbwvjmlmxqkjufehuslwrmixoakbyqe'
ClassName: 'wpvczhlwimnhnwofdhqcqwe' WindowName: 'bxuwspdysemmgymwzsplaozgzbvbjv'