Trojan.StartPage.59355

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsh2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsh2.tmp\System.dll
%TEMP%\nsh2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsh2.tmp\System.dll
%TEMP%\nsh2.tmp\Math.dll
%TEMP%\nsh2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'hrlxalkpcvqygxbtleumyheqjhec' WindowName: 'tlewdyxphxgqdzmjmhbb'
ClassName: 'mgzqcomairvojlvsufvsjl' WindowName: 'vuvdckxrhsvunbicryhbtwa'
ClassName: 'zzesouiokdlqybvpefptvhqtxwjqktxmik' WindowName: 'ufbymytaxazubjgnirkvenoplqad'
ClassName: 'impkyslntnfgmdo' WindowName: 'vezydqzifiptpzymncskghwcpscllrsrpdbhc'
ClassName: 'okmdsboaqipjihiabrafzhomvzcofjaxtuvrtnk' WindowName: 'fwvgycpbevtoqtbzcuwksrhoa'
ClassName: 'mktrwstnraxqdujrdepbi' WindowName: 'ruuhacggmvjjzohxgatvhtxrqcgdusgspiugus'
ClassName: 'jgjtrmdfurobnxhk' WindowName: 'pbphvkvlrqxaacxeiatxyobtqddeuabc'
ClassName: 'jczjetuvhjyckvvylq' WindowName: 'yhftljdlpqrkhhuaiv'
ClassName: 'wxdesrrrcycgcsafooivqimbxbmnodvlvjyflcy' WindowName: 'bwwswrkclyyfempqowgfwqysm'
ClassName: 'webmuohazfazgsojgt' WindowName: 'txbzyahjerywauskucewliksdeavc'
ClassName: 'vsuccpgwhnnsprusyinn' WindowName: 'dptlskpzhjbpzkvztnhmq'
ClassName: 'wyshtmgumfcmexlnvakl' WindowName: 'gqcinnbupnclsdtm'
ClassName: 'htuagmegwaqdojvegikzznyenwghkj' WindowName: 'esqrgyzwjdchjxbefqsewnxarkwnnnhlgtklf'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'cndbhydkatyvgzgicjcj' WindowName: 'eaprdugqiwqmeujcjjyfbagmc'
ClassName: 'jmcvythdylkchbhxofob' WindowName: 'odssqmcjhauesqlksqrpgtigfhuprksjrsti'
ClassName: 'cbejjopgczpflquvb' WindowName: 'daslncsrpkdozduazlneaw'
ClassName: 'cocnsgamekfjbknugjwiaxg' WindowName: 'rmtlkzlaubdwzfcvyukqttdbxrgflqqh'
ClassName: 'guxzzboixsmesbizpetpijazbreeg' WindowName: 'hbssmtvqyzepinrxyqjhsuttzruhosnccyj'
ClassName: 'cuhvyywnkothnujwaxljopispunxxkxhqmxpf' WindowName: 'ovhvrlxgjtdweiidnjnmuambcwqf'
ClassName: 'ictlvfhqzdyeefvseieecymoglahjdthxiqwi' WindowName: 'xqhhpkpvpidqoqqtihcbccpyc'
ClassName: 'rgdhecrmhyiygkpgkvyyergbfe' WindowName: 'ykbqhrcjtxjkhrlfdvfenzbeaabba'
ClassName: 'swxtofrwssfvwrgb' WindowName: 'miouuxmcrspmlca'
ClassName: 'hkbqmhfmrhusqkqcmgvcgfs' WindowName: 'rhjqpujutuzoffjbwnxpxxefidnumkuoeljvpse'
ClassName: 'onhokpjzgbfagoelmbhxwfbarazsrumontmkoi' WindowName: 'itspdaboajwtsjaebcinpplmtiofidnwv'
ClassName: 'bddacvljdhjwwwxzoq' WindowName: 'cylbkdppltllkhdhbbhlh'
ClassName: 'hzempthkvnrdqwxuvxy' WindowName: 'lqipfqzqgudsyguvtwkteyypryqzdhz'
ClassName: 'ilkkeokxqknkzupyno' WindowName: 'yirtinkgaiqdvtjorayfdkoityihlpig'
ClassName: 'zsdvmlezctcjtiylvypaukomttweoatauybof' WindowName: 'ywbliqvmbtafrhyhzcswavijpuyaegrlmnmlzw'
ClassName: 'squevntnzwhidymypdt' WindowName: 'vpfhnrsyeyzkomuqanfjsjwdnapqotc'
ClassName: 'lgeljthssnqdxntgfavrkwjywsvuggam' WindowName: 'ehqaimiyunpxtlgjqlkezxnwlwsuoqejej'
ClassName: 'boprmwdwsriwphpmivibhs' WindowName: 'mvuvcxizzlphzhlzgdzziherxvei'
ClassName: 'brqcvxoxfkotpyognkgppesomrmbtfmnksr' WindowName: 'fhfcrkqzalbrujxjeiiyt'
ClassName: 'apbgobfvbwdaevaygvufoobnyrwalf' WindowName: 'xvkfjnydafgmzyzxejnuvlihqcrjxggjbzrniam'
ClassName: 'tyxvoachpoldgowtqajpsidcdxk' WindowName: 'pbnxtnkrqqdftcdxxyobgjjf'
ClassName: 'oumgbvlfjeiztneilfg' WindowName: 'hqrevkfblwneeejnbwtbnkvwglqepqdh'
ClassName: 'mxpgfxrsbfktujsyjjzyycinloh' WindowName: 'rjqiiecirzqzhqgqxbqjebuvcrhmnskskbblggm'
ClassName: 'mvisujgfquhcobnrpiukpekdh' WindowName: 'wfnujyjcueobbtdxy'
ClassName: 'hukhmtzkzakooqvtuqypdsspzgdwddgtgrnk' WindowName: 'uilmmkmpxtwhpnvuyjnhtzlvkizfeq'
ClassName: 'yhnaraupbwbwexhxayrulzhpuckb' WindowName: 'fmjykfwcvgvstuogfvvvuwtkcldheorx'
ClassName: 'mjgajljzrzyipqfvfwjrhiebjgcgokwbf' WindowName: 'xqgfplawiajwgqbbusknajiukqbxs'
ClassName: 'bgpwubznjjzktgnembodbjjlff' WindowName: 'dibqkyzhtnaurksrjlhqyscgxgw'
ClassName: 'lyfuedpxyofoayilvmqzreiiersld' WindowName: 'jemwqvyhydihmeqh'
ClassName: 'pgaxipigboohghyxjvuigh' WindowName: 'dvavutltnawgtfhxkxsudqhdrlmjlgihqx'
ClassName: 'engfdxogzjndklyqfshyyqywhixyppqe' WindowName: 'zxbfsxmcnmwozywpjgnctqvfgqhvixmhnafgr'
ClassName: 'ghdvgnlcodgmcjb' WindowName: 'ihllzgeyayfvvcrqhbgwtvnysbqzkhqg'
ClassName: 'ggbherndbxsfqzkurqq' WindowName: 'zfruhhclnjuulwstbjmqdnmtnqczphwskrvft'
ClassName: 'pwdqqcahorrspsiytzdbesmziugtwz' WindowName: 'ozonicvfpccqqklzsnwgjxpjfqavykkcenwfjke'
ClassName: 'xodnnpjazrpprhxk' WindowName: 'cxlhvmmdwyapgvslg'
ClassName: 'rkhvvcjhduzxeokfivvcxwcrekqb' WindowName: 'hplovxmjonzammgumr'
ClassName: 'ppafhizpmmrlheksvshhhcblumf' WindowName: 'zcgbkochyoonladphvqzqdcpocteoswvmqwrut'
ClassName: 'rkldtjngynehabfraezmccvdiyheg' WindowName: 'jpkdwflphazhwbdhacgwgvktorvze'
ClassName: 'xwrwokkyocimhwdkxiombr' WindowName: 'ylgtonypcqbohprvikphhmqnqdt'
ClassName: 'ccknbnhhsgrfrxs' WindowName: 'jcunamsyycvkgulqtnghagrehhovl'
ClassName: 'otbnpfzdukbceqofdipnlrwxdrxywgmulyez' WindowName: 'crzqgfdzvgahwcwfbjpzipyraotpedvygm'
ClassName: 'wyuhjqbblkwswzisscfxacjyouyjdbdgbow' WindowName: 'gpdssifiddxtlrexenrrtifcudjkledicbxfa'
ClassName: 'ouyzcgenmvftyzuqxczaou' WindowName: 'npykdhtdpjvwzjwvb'
ClassName: 'tkwvtrievhulivcqrndlrbxmo' WindowName: 'yewdmomfpjsclmckkcfuvxeufyuampgpqgnknut'
ClassName: 'wykozfxslgdrdvadqw' WindowName: 'hkcdijfkbbfpwkojxsunwodxcqepdmro'