Trojan.StartPage.59366

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsq2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsq2.tmp\System.dll
%TEMP%\nsq2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsq2.tmp\System.dll
%TEMP%\nsq2.tmp\Math.dll
%TEMP%\nsq2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'okrgnqmehbzuriqnpkkfteprgbovxlw' WindowName: 'hfchukwswvpejeacndmkchryorjdhzvzbyo'
ClassName: 'bumkiqhnertwqtqywcqxpokj' WindowName: 'okrobrlljpggxhtav'
ClassName: 'qrdrwyegfpsvgfkqttuwhxjhtlsmd' WindowName: 'jbrwaixqzltmtzfgapgihynidydwjtnh'
ClassName: 'zwnuknvzlwblvjwynjrysfybaqrxppmtsru' WindowName: 'dluwtdivlsjgempytmcg'
ClassName: 'augalxwzfmosweuujor' WindowName: 'xhewhhnuodtapbsiogmgppfkus'
ClassName: 'ayysqjyfoamwwnyb' WindowName: 'jdldhrhmgprvcfpqltenjdtb'
ClassName: 'ddptnqfobxuevrrtkbwky' WindowName: 'rrmquwyazbmzgphwtugxhehjrxkwnxctl'
ClassName: 'wszfxdcmbrbxvbwefj' WindowName: 'kybeaajsejytpsgemwwjzsxqhhivhlqyub'
ClassName: 'cabhqzraqafghyihjoaggwewralxdely' WindowName: 'jbosarvrpzofswcgrzyjvoemcdbirv'
ClassName: 'gxjmbwmitsekmffwllfzii' WindowName: 'xkpsmpywqyhknhfioqlmrbfufxqewogaoxnke'
ClassName: 'mojkjvqnrjvezijlkrzwcyxxopickteo' WindowName: 'wpemznwjdiuqiilekulm'
ClassName: 'ybnlwjpzsjoriinjfoqacajp' WindowName: 'alkubpgpamtnqylihugescbuuyi'
ClassName: 'wxosyrpscpxbgrfb' WindowName: 'smuyjbvrjsjfvljyqc'
ClassName: 'ggzhemwdhevdqindqkqtuwxenzfgrdcwrfqv' WindowName: 'oxvqqkftztyikvgdkrukdlptosjcwhbcozhui'
ClassName: 'ognpsnltdpizgpygzzcjplkjdykfsrt' WindowName: 'lgeosgvzkecrsrzwlyllhatkkckgbhyfkcmkxmc'
ClassName: 'egmypxlmoprpomzrapbrdrn' WindowName: 'xrlqwaovjdvjdzvpqaldkyrcpre'
ClassName: 'fdwctoowctvgeiezeupze' WindowName: 'iujycjrcqodrgezatjbbcaabcbiqhxjnpwvlvme'
ClassName: 'brexmftjxvgcrckuospfypzzesjpbrlqilp' WindowName: 'ibxoideckfatruungca'
ClassName: 'dwqnjxffgviwmfrzleff' WindowName: 'hismczbfyhphxvjoqczqg'
ClassName: 'puxgamucdefiuxhbtdorjjuwlrvhpm' WindowName: 'iowyctwxlkjtabkkgl'
ClassName: 'lywaknldoaxkazaktmjzelzsavwwbjgogeikwty' WindowName: 'vicvtcvyotzkjhgjzuwameimxppo'
ClassName: 'snyizdyxdgyvdumtgezxcsxfldythmtmxgv' WindowName: 'hftwyiyohrhyldjwatqbiniqgerybgorupz'
ClassName: 'afteyzcgrdftqzkllzybpixfz' WindowName: 'cidpgfmqcufmkicmaoaqw'
ClassName: 'jvxtsaxgponvylwsmwxykztlkln' WindowName: 'nosvmfutsqtxijrubgqornk'
ClassName: 'bbckghkwijfzpzcajtsgvrwbbuwaxmmsdrl' WindowName: 'fmqsjmypknkskuscqnpsykv'
ClassName: 'yysqsomxqcgthgvojvccdyxa' WindowName: 'kupiqmugttwnaggjdoemrmaiiagajwlvpow'
ClassName: 'fjoualqkfygdnhivcqmhach' WindowName: 'bftiffrqogailxoiekva'
ClassName: 'msfrfrzmebvddojh' WindowName: 'bxzyxhkyduuoqfkbau'
ClassName: 'ydajetrrgfghmnztpozmdqvr' WindowName: 'gatbzdlwhuzdyzrycsdglovl'
ClassName: 'dshcjflxlnsdmyfpfwkydmnzrfpugiw' WindowName: 'pcxvebjgnmtmjxwfuvutzyj'
ClassName: 'hhrbekmnkxkftfzzfawkhoekedpqccx' WindowName: 'sanuuytdrdovxdsqguclyzhjwhyayiij'
ClassName: 'tgarrdbvkcsqlvtivqbjtv' WindowName: 'zqztelpnyexyagtuxhsqijrpjbefz'
ClassName: 'dquaogzobdplvxenyz' WindowName: 'ldswpmmcowsvfrqbsb'
ClassName: 'drzjzurlyzczmdczmja' WindowName: 'cdraizwrzaltntlieuuiawiacxxa'
ClassName: 'pxxlozydxcabisdqfijdtvnptx' WindowName: 'hbxhdiixwiosxczizewkrrsogevzskyaajddnkf'
ClassName: 'nxqrbppvmqhzjnezgkirohapenqof' WindowName: 'sejbdmsegekirwbqesbbtcbdueghgukb'
ClassName: 'xtefkbjmnhvgjdmjmlontzgilv' WindowName: 'fmvsamkqmbqmlsidgcnampbamhkqzdjpetlf'
ClassName: 'wrqcrgffdzknhqwpzppdticfzelnpgfmjg' WindowName: 'fwtognwuhhreebtoxmbqfhwkhvcof'
ClassName: 'cvewzylffdizxjr' WindowName: 'rbqclatfnklfamntk'
ClassName: 'rpdypsjykdojackvfkifm' WindowName: 'axkwdfdehepxaxjwkhombdhztvcuyaxnpix'
ClassName: 'getoalqzyaroqwgpmmzvtq' WindowName: 'ascopzwsdngusdemxju'
ClassName: 'cjjwuepmumaxevkmylonbgxjmtrar' WindowName: 'rvjvnlfurijbtzxgkdwkbu'
ClassName: 'piltndptfdfrycqvomnutkcifetwrgutj' WindowName: 'arxnnkyinhptmskmvslzynameoyj'
ClassName: 'uohgcjiyzsqqtnficspvtagvmrx' WindowName: 'slqgpzthlvejuzbjsqfiqovioickrgrf'
ClassName: 'lbiwokzwjsrlfmmlv' WindowName: 'ytzzpfrfdoapsbprcgivbpfgwswfkrrjpyc'
ClassName: 'bwknuvvgsmnozzqozazeetm' WindowName: 'aspemyauzprvztujutrfbkfuymxzzprptkp'
ClassName: 'zeckoqzzmvjdldjiknrdeoosxtufeourvynlxbw' WindowName: 'zbopuerbgnjffrntv'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'amltmgsymafgxygvfhcthgg' WindowName: 'hmymodywjimlswfsqiubortwvj'
ClassName: 'cqgvruzysfwqvcujbstrzkubulfpudmn' WindowName: 'wvhtxemrfipuaycohqpmekpnlhmfwy'
ClassName: 'yrboaalbgrftiqeydr' WindowName: 'nhkayugdsnknzrckbdgckopdojxlbtvsrhwdhi'
ClassName: 'wcctltsqwgcauhukxvnuedj' WindowName: 'mopzrskuondokivzu'
ClassName: 'cxvuobxluuvbweapyyzssgkutcvnn' WindowName: 'gsjwmzybxkdwpertxzapyutwmvrwghy'
ClassName: 'wjtmhirixzigvxbhwjytddztkccmpxl' WindowName: 'vpvqqkbjqmwmoenrjqhfdqg'
ClassName: 'fdpoqopskklcwdomvefkufupbnrvp' WindowName: 'mxelnhpjgecxavymbbqrwmeihmxtzpgtwd'