Trojan.StartPage.59369

Техническая информация

Вредоносные функции:

Ищет следующие окна с целью

обхода различных антивирусов:

ClassName: 'zagsfwhfavppigm' WindowName: 'sdniwuavzwmoacwivqgrnrnzekaztzwbirozlz'
ClassName: 'wodzhghbnsmbavpygqouzcwwuetf' WindowName: 'nunwzlcsfgwxaar'

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsm2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsm2.tmp\System.dll
%TEMP%\nsm2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsm2.tmp\System.dll
%TEMP%\nsm2.tmp\Math.dll
%TEMP%\nsm2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ptgjdkvyjinhpltrqfnehzcrkbvm' WindowName: 'arankmzqvctfxhnzboivufttvxbo'
ClassName: 'xtmvxhxcevmedsnirzzsmjvcrca' WindowName: 'ofwqwvswknqdazjofaphseskvc'
ClassName: 'zvpylurkqyfdubozshgtj' WindowName: 'ftvuqosidgmitrvbp'
ClassName: 'xtwieebpjqtweldxmsgipyzlgtdaaxyrxst' WindowName: 'rpsytzqbqiugtureqfgmzpmniivfryeigsf'
ClassName: 'hwcntswxzbaoodrpuwxphphshsjeprf' WindowName: 'cuvnuxanmupigyvycwxmqpxwhkpx'
ClassName: 'qbcpdcmsvdvohcapqxyqexh' WindowName: 'vpjjqmvqoyxwiwnkarrselczunezu'
ClassName: 'qaavbskzuldexyxfbqcimhsi' WindowName: 'rwklvhtqmpxhrrdnsptovgjrjxcsbxcfflaimi'
ClassName: 'tclbbdcnortnerqdyxrcfhewwpakzslzyev' WindowName: 'ekpmrizkedzosfrnvhworltvpwvemnu'
ClassName: 'cwrsdfchfmauzir' WindowName: 'mdqebcbdnlrigkudutmxciwpmbtyxcpndfjzd'
ClassName: 'qcrznfmxrteghtiryupmvzspjzb' WindowName: 'jorsadbuuytyxqeszybfxeugswplhcqnmgbuj'
ClassName: 'souczwfkgabvtuwxnnqzlvpckimlxzbbt' WindowName: 'imwexewfzmheruxdikmjccjopwhlgdqaniqxzms'
ClassName: 'bwapjkmwosvvwqxhyymfiardxalfgfhv' WindowName: 'lhdxovcymjtwclpyjczyvkgtawaumvnhko'
ClassName: 'kloicmftnbtdvdbvqihyabo' WindowName: 'enrgwwyubgbeencnunjzofopflswpzdunv'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'imwuuzmsyxqapfmayobdstb' WindowName: 'zdaxryaiusuyhdu'
ClassName: 'gdrpluxgxuickfnkbofqkmqvrkwukwgi' WindowName: 'zzjwlijxsganixftdbw'
ClassName: 'hvhnjaxsdbbluzhqd' WindowName: 'mhsafvmpcoaestfpyxgtgnqaowhhg'
ClassName: 'xyaurqgpvwgfjreegpufqr' WindowName: 'lnetnvacsgubtmwdtorffyyjjxjuinaulmnrczc'
ClassName: 'ohwaxxukuzoihrxlltwxcnf' WindowName: 'sumqkjreplsjlkvarzusz'
ClassName: 'vqpaisuogirgvfywfscofzxam' WindowName: 'gwyuszhbjyfuujhzgtrsqckrndpcnobimuu'
ClassName: 'oyxyvvqvoibqfpohud' WindowName: 'wrdxzwyrwhiiycksjtqgytzuujwyfbdaofesqi'
ClassName: 'ttajcucptgkhfsrf' WindowName: 'ydggbustuxmpcybxznxdzwreyqfhxkwgfb'
ClassName: 'popzdnujgcrjrpksemdqjeswtmtkfzjml' WindowName: 'khatgelcwscgytcirjjr'
ClassName: 'neorpgayoxpqqlnuiikdcmfrpkuwe' WindowName: 'mhbkvwohiiotoshgvnwehhiznnuqwcizicq'
ClassName: 'klkgkrhsmnxiqzptygbprxczyowncjcgxgct' WindowName: 'crlzcixyokcscwpvrd'
ClassName: 'vgncexxvkqncrmhlzifwrpk' WindowName: 'dyabmbcisguwtexrqlrjbwofzojjkykvdblalmm'
ClassName: 'iqrckhhnuwwzdcwsdxkmtqgyt' WindowName: 'csvqrvslygmkbgkmftibatpvots'
ClassName: 'xuyrqyzfpgkicmwnfuxvjxkd' WindowName: 'brcegcduinirzlgkdwzolanofcwjt'
ClassName: 'dhwkhdppzcbqzdzylzxhiumuzhl' WindowName: 'kdmfwevxtsvpazqzmsqb'
ClassName: 'jhneaqusmynsdjdchnumcgrmdtiglubfi' WindowName: 'xvuxihhbtawjgle'
ClassName: 'dfjozqcfkqnvjhafnqt' WindowName: 'nucymlfvudttuijrr'
ClassName: 'vtoukkpyrpjgoqg' WindowName: 'dvcntkcchizlkexanggwmeceepwapue'
ClassName: 'cdulwrckmtsfkqliqjyjdmaqfautbf' WindowName: 'nxaqzxwmzhkdknhhqzcrilcbngjfe'
ClassName: 'isozlgypjkkjxhkqfykzvwpgqjbcpgwdq' WindowName: 'lyxwnpxbzdzwlirhxjehmxaqscqyqphdccu'
ClassName: 'ijowqpyiscnobrinrzevbicjzhtw' WindowName: 'eizxnoqvtzhjzvza'
ClassName: 'ajtlxidgqpuaxymv' WindowName: 'tntseqzxxcdvzwlpiueztjrisntjqppgqddhmtv'
ClassName: 'bunzsfehmzriekagkdrieqftgdpeeng' WindowName: 'inmhtnsvyrgfkzpfjwgymiigacgqalolox'
ClassName: 'vgrqgpbzhfwcdzpmpefzcyz' WindowName: 'croctpceojpdxpfsuthdxoxnuekmgxqdtfg'
ClassName: 'jbyvhvsdsqkgoiql' WindowName: 'zmifbvmmluhjsfzpc'
ClassName: 'eacwxvovyskqcrqmqrcosqwpngzmocydw' WindowName: 'lvooyjykvdbkdmjddixowxkvx'
ClassName: 'shigsjtcbtzglmgogdquaifssbvvvblneag' WindowName: 'yquzwvicfbsbndvklxxgyef'
ClassName: 'iugzlyphwfacelraqjfptgfntvfkqrxt' WindowName: 'jnltsxexqwkxgevhnynyphbxktubjregclon'
ClassName: 'czfvlnbgirmbemromuwltitxwaavizbpen' WindowName: 'bntalcjlkqbvmzpgumdzlarcfkbymsu'
ClassName: 'xugwrznozgmezqp' WindowName: 'jaulqbrbycavadiaaa'
ClassName: 'ysjizzfyhviocouqqmuraruizasaebda' WindowName: 'pwebdrjopqoviulfptlrquqwoeonn'
ClassName: 'yzzfqklhkuoptxhrwwkftbrxk' WindowName: 'ywmgwsxvwiqslvyubtstujyherx'
ClassName: 'iqgvtmazmtfqouhhnnetfflaby' WindowName: 'lqehjwrifxifodfnyz'
ClassName: 'vovbparglnqcyxdqaycayhvstjgyvqb' WindowName: 'qswkgzcfhjlozsnofhjkfziifjjbtrwlfkm'
ClassName: 'oldfumsemqncbrxohqreankkbccnevurpv' WindowName: 'diskxcprapcozwet'
ClassName: 'gowfzdvzonjmwwdbrtdopetpenbuacsramaj' WindowName: 'jlvkveytcoqvkdzajupktuiffiwuvdw'
ClassName: 'qtizkzjurseuksoliklc' WindowName: 'tkecegxwfplcqlehhngwerxrfo'
ClassName: 'auobxrxaajfxszujeohfgjjktdzcm' WindowName: 'qlbzoqcqywchbvmmptdv'
ClassName: 'hqktofvonyuqnwqzcycvokvqgumaukrftsv' WindowName: 'lvimuzjpaowluwdwfgwkyoaco'
ClassName: 'nvjmpchkjkojmucwfg' WindowName: 'jkiqienvrowzivjcrtihkioiahnaqj'
ClassName: 'gkdfvcbnomtnneiamnudtfwkytitpal' WindowName: 'ksedjbehwhapqxr'
ClassName: 'relhviirqbxzelpdublmnmyrwc' WindowName: 'ikojvfpesldnmaxlgjv'