Trojan.StartPage.59348

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsb2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsb2.tmp\System.dll
%TEMP%\nsb2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsb2.tmp\System.dll
%TEMP%\nsb2.tmp\Math.dll
%TEMP%\nsb2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'hwulmxpwajiqiihuqtzzwrxgbx' WindowName: 'kadmffmykipzficjnlcshnqytbsqjhx'
ClassName: 'kcepmmjmvrsftyrfzmoyylwwqje' WindowName: 'krsbhuzhfihwdyuiuskypnvsextcclbpbycczdf'
ClassName: 'zxeoezbyexqljqjdzyvopknufqfmdltynga' WindowName: 'xidqcbfbdrkstkckohhnw'
ClassName: 'yvejzaksrnjkrwbqfljrhiwdyx' WindowName: 'nwyykqzcftyrxsjzbdbtsqfogtkdrtflxf'
ClassName: 'dhbexmpcoqjtxjlneasicy' WindowName: 'cdjqqzgolfiippxkozlmhnxifygavjsked'
ClassName: 'ytgchushouzbjyusgarddjpojfpmtmw' WindowName: 'xvoijyrurzfbpvogbziweirwfxglfjwazyf'
ClassName: 'udpltsyomveuaxkzngjafjmgkfcydv' WindowName: 'fonraauuugcotwczfktepmqkhtqzx'
ClassName: 'zilpjslalczkvme' WindowName: 'juliefhqgoyoylcpllakqiuisrxvlyaxx'
ClassName: 'zlgwdanwnjkcxajmpykxqcpwoajudxzj' WindowName: 'gbxllcvldsoqiqslnsxydaufoe'
ClassName: 'vvoeypoljwflqyvkujbpmpxzskquddcjfz' WindowName: 'xmrxmxzjqvxlrcivciyfxpktbvmkmme'
ClassName: 'eewnawuwmsiqzhhzsrtfinnqc' WindowName: 'tctatnqzhmjfcekaw'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'qgnqjhbdyowwvbdnr' WindowName: 'maauzluwifzkqhtad'
ClassName: 'uoxmljpzfjagumoejjlbvm' WindowName: 'dmyuejhexggzxsznauiqugvunfleqamefrzfai'
ClassName: 'jlfghciyshcuxgmwbunseg' WindowName: 'toabfvbnvdyzrrszddrbxtwaxxqbpbgpipemgo'
ClassName: 'tuiiesgcdacsest' WindowName: 'wjhqnnpnxorjfxepmkqrmfyjzwxsexiica'
ClassName: 'ujdegzpfrbkewsmlryvvoo' WindowName: 'hppzftczntxvoykluyagszmvfea'
ClassName: 'qzckbjcsfiedlccvtfm' WindowName: 'obcqzcsrxycowmaponlexb'
ClassName: 'vmyniwuqmoxpyrdljuiuysgvtmgymyswsmlj' WindowName: 'zcxibffiztugkatmqchgktpypnwxpc'
ClassName: 'nwyghqpbgfkaigy' WindowName: 'eqblcilescuplemiaxrqpootoilobhyrjxkjbk'
ClassName: 'iyfzfllejukhwwss' WindowName: 'zixuaphxeymexwuccgya'
ClassName: 'ltlnlvnszyzmdctwpwczuwtgymlovuaudmkwdy' WindowName: 'rfltxhwabayqjspdybwrfxojgguqbxrnvhegv'
ClassName: 'uvqilhuktbvekdcgbengsnyr' WindowName: 'hjybpblsrpnmvkefaxnbtcck'
ClassName: 'rspvwtrdzbgxsmjgyutkkjmtgaapu' WindowName: 'valqkzuviotttor'
ClassName: 'eeykcrlwpvrnurfsvfxlgrttr' WindowName: 'gdkkllautlhuwygfghetteajqudmuh'
ClassName: 'xijxetoutisfiumklkyoddqdgwttzvmsrczdk' WindowName: 'smxqrdqxetruedwmtslrthbaelqajnzri'
ClassName: 'xonkhxfntftlllucnppvscojarhnxhupdr' WindowName: 'cfottaentffioiqnsrwgcwpdmxglznjvjhv'
ClassName: 'tadntnjduawpekygaspksefn' WindowName: 'iflmwxqpbpdubbchozgcrvabqbslggzbqxev'
ClassName: 'rokpvgvfjfyvozpnhnzphynrxbbhunzdiyh' WindowName: 'pjebogssudwppifyhodhvoiba'
ClassName: 'xslzdfcuuflxpojyslvz' WindowName: 'orcvbupnffzsqxcxnbbdmfwapxmqy'
ClassName: 'olzjllwbhohzifhkhfq' WindowName: 'isxnodpbcuhdexgpiyhcjaq'
ClassName: 'yjgeffcryfmmgvjtcmmbfljp' WindowName: 'wugiilppubtqpdmdr'
ClassName: 'ihfgxunsmdenredykncsasmueuepnwdvktyz' WindowName: 'cjwbuxosnxcvfdnetycxlqscsgdnonluoak'
ClassName: 'invrphxdfhtbppcsszadhdvyspauzxeujkftwe' WindowName: 'hlyygbrakcelgtogmyrbamyejmtepiunwwzwp'
ClassName: 'yxhcalhoydvnfxzap' WindowName: 'ihiqwbxebgjridihi'
ClassName: 'ptbznfsxuhyvrjpheunpeaagkuy' WindowName: 'euutronpqnnafzsvnvkddoswpdextzmvlcuwr'
ClassName: 'zafuqcihixwgjzxezejxntil' WindowName: 'oariufahgzwqlnbinylpucbglui'
ClassName: 'uswgyfxwovlensgxgccggnitgm' WindowName: 'ziapyuqdkwhabjlzcljflcrdcejcxw'
ClassName: 'teiobsjqvieyoqkafjclhkpohxhvvjf' WindowName: 'oyaervuxunpynpzwc'
ClassName: 'otwwvbdopgukrjaodroelfmctkgkzvfytpzax' WindowName: 'phqgutqiljnaocwinrcmpsm'
ClassName: 'bcrfhhuwsiztjdrivvakwhaayupybro' WindowName: 'oawgxaqkwjhojtjsfysupfqgrs'
ClassName: 'ghdpxgtdwfyymeb' WindowName: 'maeciznzefsdpoqykiykldywrudqwvkeuiz'
ClassName: 'pscnntqbzjcuqkhuz' WindowName: 'prafpzjzcktfxnkqqegkxbyjvdorsgdlxkjsx'
ClassName: 'qkmowdljlljmvcpcsduqf' WindowName: 'epgalqzuhzdangfqpglbfz'
ClassName: 'mmgntrxeunyzjiwlamohyjpg' WindowName: 'udsezhwudildqcdtlv'
ClassName: 'iflfiierbkwsifskpoadkjbvqyxozhpximi' WindowName: 'tcebnsjjhiwezspysbxbma'
ClassName: 'lmrysqfrppjqrlwwvfrqi' WindowName: 'dirjfqdkoeowektxqpshudd'
ClassName: 'paqvrnmjmhxoiljxkfihdrnf' WindowName: 'gmphiayugunnojfofsnjzoliklvedbokapu'
ClassName: 'dlakdqdavucaqftbquyrq' WindowName: 'abyylhyiqmljognfbmkhvisikbz'
ClassName: 'kkcbmdmypodensw' WindowName: 'vaxbsejytuugifrqoagkvksgyzmgzrsan'
ClassName: 'hvfqgsqycrdhxnsdyxblcghc' WindowName: 'miiwnqusrilgehnhlfzqayo'
ClassName: 'mtwflpwwkmoniuqdghaybawh' WindowName: 'vbmjuwbujvhxivxzyojzymhfxnxztzelu'
ClassName: 'scqskzbhkcvdbxxbbnyynmpdjkc' WindowName: 'nlfwomjjxzwztavylhyce'
ClassName: 'hbqlwrmqkjutoturnsmcfcpvxdtskerxheerivj' WindowName: 'xilzofekpwmhibzrvgscyupywzzqrtru'
ClassName: 'ehwkxlapagbtxtbhcbygjihsypnetqlnwxs' WindowName: 'jvdqrygubmfcpmtxtnkjesr'
ClassName: 'opppuuwpxsmhvhwjyaselsgxhakwqoqdxdxhjg' WindowName: 'wtokecfdvzigxvucjedzxkpnnc'
ClassName: 'dlvjmfqakriwzxrcybfzpvdsahnlld' WindowName: 'lqpbsiwfxvzhqotxajmdvcbdjwmmr'
ClassName: 'mtphgrtdgbjaobmwchlyvblrqkfro' WindowName: 'jiqpbdmxpnmhtwrs'
ClassName: 'urxuvypifzlcexru' WindowName: 'tcqnrdhjtheyratbysxjejphpxdmd'
ClassName: 'bwjstdtuuzyflfzxd' WindowName: 'zcvilsxsjgckujyzaowhfksoyjgp'
ClassName: 'smaextqpuqlwjbfrqvvbudslvaeipcvgpmtb' WindowName: 'qzvtdiyhjcmfgfyzcpikt'
ClassName: 'wuaqbxwrucwwemybaekadczqsqxttqkrr' WindowName: 'xoiuxfiadrlohgckhiunqgqbygxpngk'
ClassName: 'cayhjkuoglrulxrcmjbqbpfyklymaogvxaptyq' WindowName: 'gxkhgcbzxefaucm'
ClassName: 'phuxkzcsyewjcbmos' WindowName: 'nvweqaizamstgfosikaxdoanwdy'
ClassName: 'lcwrtekdnowobsbutvcgpcqzprjjsms' WindowName: 'rmuczootigdhblijbimkreadluvijkvb'
ClassName: 'jbtalsymwvlyezquqfefqbfzvtutob' WindowName: 'wzxnsweigsvguhhmpucgrlzxst'
ClassName: 'ilgbnbjjehkqbtuqgpuhihosvurhqrspgt' WindowName: 'hzmzozrrjkntmlevylykcojxft'