Trojan.StartPage.59353

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsj2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll
%TEMP%\nsj2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'jnefqdraaxitczpiluhqrlodjexc' WindowName: 'juorghvsxcmxwbd'
ClassName: 'tvlyrwwiknewwvjvqpzibhxgqfrqjwvouybwt' WindowName: 'eultqvhxdolopqvrljywrikhv'
ClassName: 'yxozvyezzpbtkkczrghuplpnlzzszgf' WindowName: 'ogmjpgidpsoghggoiuwdmrnrmcbdpbhwvxjw'
ClassName: 'sssxglamqsxyzbmvdckanpkpjcf' WindowName: 'trdhnucgfwlflniwiyxmcuypppcf'
ClassName: 'rjtwxpksfibtxdoklaovjdthvurhqx' WindowName: 'unlgeimjehlpralcbpllqpffnsdffznsatq'
ClassName: 'eckltcjmenvlukwjnvvnjhsmnm' WindowName: 'nrbsfduguozhltxmvqhyamcev'
ClassName: 'uwwsbqrwqcxwvmpsluyvlmvakzutkimdpxicbu' WindowName: 'ppcspizsztholympevwgycz'
ClassName: 'melksywojaarafajtskhes' WindowName: 'kfhiithbumzanfvckzadfjgaetwhqdoppreoa'
ClassName: 'sqppnyywblvcxudaltrxkdd' WindowName: 'qvumfejnkvbevmhnbsjjhoscaieeqz'
ClassName: 'dptlpvbhbirlxsrovjdmwcuvkfxxfhmkhrsgu' WindowName: 'ccelubazzkfwbxaevoubvawdfgxnctcrclysm'
ClassName: 'qsivsgyxakbuhwennl' WindowName: 'hfhdrdemxjwriroxgpokgteydssxgoxxuv'
ClassName: 'dzeibrypacibtmgdaqbr' WindowName: 'uajmwdtikqreptzygxtulgbawnnnedeurl'
ClassName: 'zjazxvlfgbnbzjerrsyposxyejczkkupjorlh' WindowName: 'lfigvfevddgcipykmflyovsp'
ClassName: 'gdwhcfoilfprzbygnfqqqzalyqcewiagz' WindowName: 'nvmptlzujhyqbdsucxcfglzdycvlnbcszpagj'
ClassName: 'hqcmpnktffbkhqowcgamfyxtnxcpgryepzq' WindowName: 'cttamtskhjjtmoclcj'
ClassName: 'tbecsdffenpacfehfobjtjbomkgvmfzlnaaguz' WindowName: 'dvsodntmisneetfqetybzaavfjijud'
ClassName: 'uzithzaehepwsflhxksurfvstaeohjufyjf' WindowName: 'ffdssidyktoopojjskievvmmliktktsq'
ClassName: 'uiuqlwfzkrrxvuvpumywbo' WindowName: 'afzqfyomzokipks'
ClassName: 'niuuuufykcncosesxpaspy' WindowName: 'zppzvifjfowhdxuswuuvpsonjld'
ClassName: 'iszcczccivncpajmnylfpdqykfkfkazoqjhckdx' WindowName: 'qwozrvoxedrxfrhseqnfqzz'
ClassName: 'ibhgmqjuhxbleawbgesyqkjwinvwvwfvpxbwtr' WindowName: 'ipaacsylgfgtvzodorjgrzxaybnmcp'
ClassName: 'yxpxlzliwlamdtzcaojmbvucfgtdjh' WindowName: 'ednujnloiypyvdmddqzhjcfocmslywvqmsn'
ClassName: 'sxsclczvgmyxsmasapwnznhs' WindowName: 'irdjvpyxakmncyrec'
ClassName: 'adigadhrvihlzrx' WindowName: 'epxawyhztkzplrtfhll'
ClassName: 'jrxpyvjvwjhqzouieudwwzphr' WindowName: 'uodssddfvvmcirkjdlaztppvdudwlwqbe'
ClassName: 'ixsjlnuawvfnfuktbe' WindowName: 'sljcstdtrfzlyll'
ClassName: 'jtienksssikyoksasioncmah' WindowName: 'tryhshicjwigflxvivbetuny'
ClassName: 'pttcncjknkfmhtphtblperuqbjpsvozxcoyj' WindowName: 'kyqnmuixiouutfyzuzzpnxswhel'
ClassName: 'jjnhpjflfkllfvslu' WindowName: 'lkklarqsqoeuswbqeoffikjaa'
ClassName: 'xhywfzimvinpouyzgyt' WindowName: 'tmkcfojwjptjledoudenmpcbyfdflzqynlwvj'
ClassName: 'fdywzonuudepbrmbbtrstxsgcydjo' WindowName: 'oegtemehzsfhexyxudiuokzxaxwipvrn'
ClassName: 'lyuulrlwwiuokzahdndgkzliofirsk' WindowName: 'dvikvgwtwfdjzntmgolvzmofzvxdjebhivypuf'
ClassName: 'pdhnupynpzvcwlsozbmvvhbknqzlqduvyev' WindowName: 'tpeiipytaexlcxlslofeh'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'vdhziltapuhhchuwxr' WindowName: 'kvcprjyryqzwithgc'
ClassName: 'kiektikdqdnbmcpirgetguy' WindowName: 'flzhscvbvtwishmobvlfdrtxfy'
ClassName: 'ibchflnxrvjwgpjhxzhjdggpahrgu' WindowName: 'zjrfmezmdvliaovtttiilqpimq'
ClassName: 'lgzutltaoxaywbibngmzmhkpwicysrhyupoh' WindowName: 'idkhgomlvkmrfrexzcikicrjyucboyjme'
ClassName: 'tpckzcqclhpdbgemu' WindowName: 'jyfmpdyghglnnpxzopcgjqgzonxmjdavbtervxy'
ClassName: 'rzgylgxksjhcfyfcvklphgrdvwsytjggiooq' WindowName: 'ffdqurhvfbrthylxpqyikghyytyviwczbt'
ClassName: 'nqtyxlnivvtofvztnswhvuhoehhjbjqloaqabm' WindowName: 'cpdndzwsdzbdidvygkkpnzrktxayi'
ClassName: 'velhzqqpjmjesqrhsvmqmzvsphbm' WindowName: 'akbtnvnpjvtwxnjaziegbebudoccj'
ClassName: 'cmucnbyiftihkuckatdxkgzqxfrs' WindowName: 'oxuipiccpwnfepxsoznvyccfagxohcaedig'
ClassName: 'isnanggzekzikpwjtnlarulnbqkrswqcijxky' WindowName: 'xwepsqokdodhaclqgorgnczebmdlhghjahvnfku'
ClassName: 'krjcjosduoocezyuzfjkitu' WindowName: 'wpvsbppywezptgoc'
ClassName: 'psyzwbknzcoivsaborqoqhec' WindowName: 'ewwqnpulncclmvoxwtp'
ClassName: 'vnanidnufiqsgvin' WindowName: 'ahuvzwkghfrghynynymvvxtpmltpy'
ClassName: 'evttsdxenlxswfh' WindowName: 'giclcjapjhuttgi'
ClassName: 'qtibhitgtmabmxfutwzq' WindowName: 'ulgvsetnmimxivffnljokcgcmaohz'
ClassName: 'bzkibthcmwaycwrfcgyvpv' WindowName: 'vhtlqiiplbrfwrdsvkc'
ClassName: 'flnhtbmdljqcjumjelypxmvxnfsbamrizvr' WindowName: 'jwkqdyinqjmzswaowfwhkecfsuzpfhdh'
ClassName: 'gpyrxbbyotrzldgnznztpfbsyxkogfucvac' WindowName: 'wwvftbldlznsbduvcchofqkpvprq'
ClassName: 'vgiflxtcthyqfudrogggcqygvyazxbyuhwgcb' WindowName: 'kzxsztpgaiyvdmwl'
ClassName: 'kxcrmyhfwbsvoljmmws' WindowName: 'yjnuxvekeqzcmhwhsaqewfkwkus'
ClassName: 'qtbxfuadufannevuq' WindowName: 'dmavxbaclqsgqeqzbpxjqc'
ClassName: 'wuoyocidgfijaqdeytmq' WindowName: 'nvfevmbuermipiwzqqhj'
ClassName: 'dwypixznfgxqcesbczlmsau' WindowName: 'oftjzpgjdjapovcvwwcxpmool'
ClassName: 'pphuvdqcxkhfqupic' WindowName: 'gwllbriwbxoxrtgfiobqgvtjcpbgqvfcexz'
ClassName: 'qbynimyvlswpadwekfzevxjvn' WindowName: 'jhoghpprbdnaccsfyzk'
ClassName: 'omonkjussfkydlhqeyxxzjaecdhkupjomid' WindowName: 'tggvqojjnbxcpxairqhdawzzjekmiiinqbkhi'
ClassName: 'lcudazezzfyoxrohdleblgjsulobzietahygc' WindowName: 'hqxaydipcqixbltmzbyqpbmlm'
ClassName: 'yjneiuzjnnkxzzevnqblpkrtfjsbwqvrzcf' WindowName: 'pvxsokrblofsntgvzqpmqsuqilc'
ClassName: 'rqohypcgjdovcuuucfmdsoujewibq' WindowName: 'rfdyrxcyjevcpiawy'
ClassName: 'jhtixkujjydzwiwwsoa' WindowName: 'brbyouyithojqaajepritybikgudfgydkuuxprf'
ClassName: 'erlvuhajutetsyacbzkmlulktspypdpsrvweat' WindowName: 'jhgughmnqlmbpntkipmwdhg'
ClassName: 'lswhmbcvuyyjhsawkwxrelbggwmryenfmrx' WindowName: 'pwstsgdavblrnachneuxiytjdvldsvaepm'
ClassName: 'usnsvqrzzfhhvfos' WindowName: 'huhknamahuuacwzxuypih'