Trojan.StartPage.59371

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsr2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\Math.dll
%TEMP%\nsr2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'evrikzajvvimqfsevngvlvazvmkrkxx' WindowName: 'yfzqdgzvgfjdqjybth'
ClassName: 'rcbpbgfogfdxlsthiaycruyttcibp' WindowName: 'vswbrxmjmgdfiqgkxwrucagjuxscbzrf'
ClassName: 'cedvnkabsxnjupqusa' WindowName: 'unjdjtiivwqdafpcrvxzgv'
ClassName: 'mecnicbaukkxbfvbercfmmzxmzrmccsblmiyv' WindowName: 'lpneblnvwugwrsgvqbtdhpehkszampquwaqj'
ClassName: 'oyxallqthynyhddymkfecedvfbbgsjacqsns' WindowName: 'xsoqdwchveuyvodpiiwslwniargzfkwqwkj'
ClassName: 'zhhucqohojwegzwccdjgkimoqrvzy' WindowName: 'krwfcidcjjgznksedzing'
ClassName: 'zxktkyzcfflonoqnaohhihbzcktxghyltvjwkf' WindowName: 'lcylumofmkahenbyvnbkualbums'
ClassName: 'bpezvncydxrfnjybvrdzvmsftjhckfmjvjgj' WindowName: 'ocgnksqggnvtwgzcdzebokzvlvfeiocj'
ClassName: 'zradlqsdoghcsybexejfnyerrmx' WindowName: 'npovqfobxgolibhnhikcoa'
ClassName: 'pspqbgsjqujhjjppkjsvsspxts' WindowName: 'tlhuudeobgpdxvxeimbzlb'
ClassName: 'nvfjeqxkyxiqpqboxlulm' WindowName: 'qjacjmeusiwcyonvbhobpuwf'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'afrwjuhkicekotqqm' WindowName: 'fihgwntyesgmdctredknrxpralpkgxpu'
ClassName: 'tkmomshigzcyoruehoeciud' WindowName: 'pntjffmtxzxtjmkkz'
ClassName: 'sconcutfjisithkvmgobfzsicjapzpfbbwf' WindowName: 'vkmvibcpvpvpwycupstfivg'
ClassName: 'vuiggptunfokoudyhowlsuhdzxbogenmtydk' WindowName: 'ltfzeiakfsashklnmixcght'
ClassName: 'aapbabmvrdykscklmsxxwhykawcgrxnlegwpd' WindowName: 'wvmvzxjtavdojifwzozebon'
ClassName: 'oafohchnhmydldmbagnsgvlsaogip' WindowName: 'kkzxccbyucmuvxxfvhzfcw'
ClassName: 'fdrbzhoulbfvnfnietxyhjutadahofitp' WindowName: 'ovvngizmkgrfkvprrck'
ClassName: 'tsfzqjpkrblkwvauhbsyqltyqkzflnj' WindowName: 'ztiwjgizbdqnswtdi'
ClassName: 'wjccnfexgibsizhbqkthxecexmd' WindowName: 'kzotjlupfgbwhhsuyrhk'
ClassName: 'fkmvgifibewkvygifueuev' WindowName: 'lvfuznklkiclcyzjvzfi'
ClassName: 'lrtdmiaonfpvigrivtjeuayr' WindowName: 'mfgxeprnoxblkpbqfubjgxqafomaojxu'
ClassName: 'cxrwftdpuhzxcmcrhuhxkmgdnpe' WindowName: 'aofbgnsycdizizsvumaoenggzqeci'
ClassName: 'fxoijqclesdfkbeosehziphdmchwaqtldx' WindowName: 'vawuztgjxbfztqxuhuxhgajetdooyu'
ClassName: 'hqweetglghujzuvpwxsbjeeyeqhajybusipho' WindowName: 'ewarshgojtazrrksxqdvwsntgpfsjedkw'
ClassName: 'posrsyloklyaiskghaepghiourabxyancdku' WindowName: 'decytxbrymombae'
ClassName: 'wfwbdqtyromhxwf' WindowName: 'ovpmkrllrjjpsdvdmpolkpgbskynamyioelgqev'
ClassName: 'gczmqxxltfzcpttclphfcafkxpu' WindowName: 'feipgmnirddbonenweymhxnqtk'
ClassName: 'jvfkkkljzynqcfdz' WindowName: 'rpqvyfxrfrvxisnhijuyclnzbtgreihhn'
ClassName: 'ppbcyaiexoprizjtsqvuqqu' WindowName: 'hrmhazglwadclcgwpfqtvau'
ClassName: 'ejduszcwjcgmgfilptqgigeberyautq' WindowName: 'rfnezdopiakigeodkqeqbjhriyqvatuhndbj'
ClassName: 'duxllbglpqmckhbnrznfouganrgdffihjoha' WindowName: 'kblxizdemwmhtcqzabhsckxw'
ClassName: 'qjwdkdrrzxsbrmkpoggsel' WindowName: 'yyakqnexfsluiwhmabssixhs'
ClassName: 'sovrrfhmvspimybafpnkswteheqnwnlif' WindowName: 'dxgdpauizsnqugvzsfhfkl'
ClassName: 'dzgwtrybdeumypyfsjwqzzscf' WindowName: 'ptehtxbezscgjjgxgalfgipxqjrujmrzis'
ClassName: 'igybetfxrdetxgaqdnelyjbqcha' WindowName: 'axmnehyjkwjslmykdovcnfttklezhkalo'
ClassName: 'ieatpxtvddquckkcyynae' WindowName: 'lapawcwkuhdqawgaxrgelxdhfr'
ClassName: 'tsfxdoyfbfgtdhkpylgltszwp' WindowName: 'jamcasrqkevlptfqfsznlw'
ClassName: 'hjnevxrselwszqbr' WindowName: 'xibjvutxlvqukzcanymcnodpaewxajsjtznb'
ClassName: 'srpvemmzctflswfrsagrwce' WindowName: 'skfohnwhotmcdcalydfdn'
ClassName: 'qnzynkotcfqsicbpnsurwibpmhehegocivuqduh' WindowName: 'xwhaoegcrzdbdgfjqs'
ClassName: 'hrymygscaewvjpmmgqiyhaswtlv' WindowName: 'faiylkxhdiomswszidyeoxlqxjtkssluhzl'
ClassName: 'bfzgxvdhuowhemsfjmsjwzvfpehxku' WindowName: 'qzqqqtnalkqlhmo'
ClassName: 'zwbgzgqeyfeyckauqvlswzzd' WindowName: 'eagjvewcxulzmrngptznwzeec'
ClassName: 'edorhmkgatusnbjjh' WindowName: 'yyznqgdaghzruzfdekasoiyn'
ClassName: 'yttzeykpsxsfflramqpdj' WindowName: 'shnpdiukqnhkmrcqiqeykfywx'
ClassName: 'qopdhcwocdpriqzpvatf' WindowName: 'bwovpvapkozablfqsjqeg'
ClassName: 'uluskkhfbwfpeemkex' WindowName: 'ehloojmucdkvkjzhevpbdkzj'
ClassName: 'rsfiqdppcvowtrfusrip' WindowName: 'dpqkexaiswarstyrwefmgkqixpqivlj'
ClassName: 'syzqeflcyvzxyplwjuareceygfypkict' WindowName: 'fsuwicfueseuoybfjsrhlahinwonujdnneuecu'
ClassName: 'lnceueukbwxyfdaqwangahrcockjuql' WindowName: 'tnyrpfyckgojymprdjnjvmxtmx'
ClassName: 'hcstjrxrviuimorrzasngvdsy' WindowName: 'guepexfbmiyelzqaqjrixbcddtora'
ClassName: 'iayudygtymgvcgxmbrohntiqw' WindowName: 'hauxmqtrttzuljfjhgyc'
ClassName: 'ltcxzlegosggucmuzneocvftvfuk' WindowName: 'hnyfzwtaddlvtpqpeggfmardfvbzzzwt'
ClassName: 'xabnvkpqbgjulohcigbshlgrjvzsddtpygbvsxy' WindowName: 'klfneqhxtyppfopvzbedvqcsnyjifozy'
ClassName: 'rnwqubosolclpuyvletmjms' WindowName: 'ysvghnlsukrwmjfpyulfhksavdcol'
ClassName: 'qbaqiykgofixwpibpwvzhcvo' WindowName: 'curvbuhgowhthyxlj'
ClassName: 'nuqhslptwcgagwofcvjzwlqmmh' WindowName: 'tminbpnsfyfjysmfjrxukkc'
ClassName: 'oeigiyvgayeckqujpzlyeeucor' WindowName: 'hmxhpreqomiytizxyfqhfriqlfsbcx'
ClassName: 'kyuqkvonysqjaikhtzqtrkxxmlmrwz' WindowName: 'wxutvvwzfczqhlevckuzpobm'
ClassName: 'zquiwbfmnekrfarhcnrzbxuep' WindowName: 'cvzfyildypjmtvuweg'
ClassName: 'hyqtyadofuuumnfdxrikhrhirqarrzippcivta' WindowName: 'qchgzvqudlijojuygy'
ClassName: 'lbeeaiewvhavtffdebsqaeuxt' WindowName: 'sjaqkahxseshlypim'
ClassName: 'fahrmwiufrlxlhlmwsndzw' WindowName: 'kupkyhpvlaekcxo'
ClassName: 'kbheerypaizmfyrplqjazxlrmcplbzbpuxk' WindowName: 'xfsqegsqxmfsjmvl'
ClassName: 'lrupvwagjisjrgujpljfiqlb' WindowName: 'rtlcawvykgqlmzxgidcabiqi'