Trojan.StartPage.59384

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nss2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nss2.tmp\System.dll
%TEMP%\nss2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nss2.tmp\System.dll
%TEMP%\nss2.tmp\Math.dll
%TEMP%\nss2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'gljnnhvzdgyhdyypwjfvgmhkycutucujaythdcv' WindowName: 'bmplfejvqnctemlhnhdvmhbdv'
ClassName: 'mbshodhvsluoympjewyodbgetdugtpizuqtd' WindowName: 'fhjsmwitusnyscnvaxy'
ClassName: 'sgtsjxmakknsiqefvtukevdhewqqrm' WindowName: 'xvjyjjivzmvzxbslmskgblpkyrst'
ClassName: 'xalbnhnsqkwlhgnbgvdk' WindowName: 'nfnxyoazxxbgbxjnwiw'
ClassName: 'gjirnbizvfbrqzdqokgusi' WindowName: 'tqymlftasztktbuokaxpnakqxbxmpllwcqwwv'
ClassName: 'pykhqolcisqvvbdfmqtqaskivcxyjwktr' WindowName: 'jvnvutgfsoqrcongqrofsknknijxqpojbtifep'
ClassName: 'eoaxsumpwjczbtdvwe' WindowName: 'ouybaqxasvggdlypfbervfhxwiynbxw'
ClassName: 'wgohiuduzlkexvmxwxeuzfoqjwis' WindowName: 'wrpzsvwbqkoxlzt'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'blskjpznhntrahgoaadjrswifajgfvfkfats' WindowName: 'inbfcnfltgaddizow'
ClassName: 'ujpzcofgvjytoxefeouckonryxkgc' WindowName: 'ihtrtehrgrvxcmmsfuwyvcdglvv'
ClassName: 'axwhnizynpvcvwekqyatausujepdydklh' WindowName: 'kechwhihxtdzpbvdbtdsjx'
ClassName: 'zedlmpcfclhzbvmuccmkjyrvgrjxmqgscps' WindowName: 'dqlftubifoulmxxpklkfovjygwfzhkvmkgtmr'
ClassName: 'isqcmdalbbjekidcygobztcxeqqsfiublfvj' WindowName: 'ruwgntmgldvygdkj'
ClassName: 'yoiqkhrhwumbsbmijnfskfcazp' WindowName: 'hzsqaouepqxydvusazoq'
ClassName: 'eutuanhwlfagslpvcaykqvawd' WindowName: 'fgowmzrwlmmsspnhbuqxafrxavljqwwp'
ClassName: 'qmgtuhihbkdtpxlolyyosmmqhhblxtlcbhid' WindowName: 'gyojlvjwqzbgaixiybztwkpy'
ClassName: 'cdtzohevzefwmcnhyno' WindowName: 'vcfkfubodauhrqmcxpjkpiebdgkeacxdguu'
ClassName: 'qbkpvnrygpxpucae' WindowName: 'dziirnjalwzsbqohzavwxjnrogqjrjufhsm'
ClassName: 'jsmfgsfbnjbdmapesnefsyby' WindowName: 'znsjkiauzfepfyfrsfaidaqzzlj'
ClassName: 'uuecbwvofbsseymelkuuycttfovywngnpulvly' WindowName: 'yaukoiucdrrhbnu'
ClassName: 'czaqbqgtjdnsdcgsejwcdcxogsmrkekc' WindowName: 'dhmjybdrqrldehrxphfygglooao'
ClassName: 'kcypumxslbswdqdr' WindowName: 'yzrfmkgalchlvoifbhzdntbfnbksachwix'
ClassName: 'zvaynsyeiinisnsaxerjlsaw' WindowName: 'vybxvlefjcsyncnmsyohgzsildklpjnsgeiqiqw'
ClassName: 'dxnyhjnrkukwnwfgwmycbslhkyovesjjuy' WindowName: 'dvbvnbxqdoievefbnweoobdjmtjinsc'
ClassName: 'qqtrxflionbqkhrtsqvkqroa' WindowName: 'qvxlkaurckuwqzggutpwnjw'
ClassName: 'kyolinyzghprutzqpxhsmhjg' WindowName: 'vxnqktqpglcvqnfmzyagxpelvd'
ClassName: 'okciceibicrrziiwzyvirbxygjyqdqeakebn' WindowName: 'qxmlzvyscjimhkwngzifqrgnfis'
ClassName: 'lvpxkoddvnktehvwkaiqiubkfqhf' WindowName: 'vpnmtjaicmxbwrunsfyybebhzkeqo'
ClassName: 'unppxqbncuugdcsnhsasqnugwvubeob' WindowName: 'olfdxwqvmhhdreowvbxibvlswztwf'
ClassName: 'bvlnsbdrmdfkmledbqwzj' WindowName: 'cbznrjapmoxtxoycfukizbyr'
ClassName: 'tttphoylyjsjnoilibijo' WindowName: 'tfqqsybwjcorzfkgdzunebuiluvghd'
ClassName: 'uhcinhagenshewtuniuzporkbtqyu' WindowName: 'ubnjkbgkqveoudxxjfzfbewzfcwmpumivprhebj'
ClassName: 'dtwqicvxfwrcjekypezszn' WindowName: 'lnnrgslungmcevrbdbeymnstlr'
ClassName: 'nfzkijlalvxkjqntvfzfgvydchftseh' WindowName: 'rfpaffwdymlrddxeugalwvwhfplxtlamkvcc'
ClassName: 'uirhvvmdsajniuvxdaquokjlclmxe' WindowName: 'ajhpxferskdnzhxuepxwqwau'
ClassName: 'vkngrdgxyrpmreulccbvenpiixvyszpggz' WindowName: 'mbvocoflxibolnzoipcnczxpirhazqzkylm'
ClassName: 'tkezzudjbysiyugbbbeefesngzxtrburhlk' WindowName: 'ywjhvvwfgiencppxkreenn'
ClassName: 'cfnrdmkvjjpppxjadydjucbr' WindowName: 'ixisfjllscluoxkbuotxcgxhoucn'
ClassName: 'hluqknifjtbkdyxysjsaucpfxviyeeqdhyruy' WindowName: 'rflvnksrzevepci'
ClassName: 'hmgwuyibdhqazueiehjinynxxnvzjmcvz' WindowName: 'awinlfwgmzuqnzzxxsahc'
ClassName: 'givcvnlcxvqdsgoofojdfgubvpxrienjl' WindowName: 'yruxrswqqkaoikiggnukwrwqsmhkohxbnj'
ClassName: 'ulsetmumlvlfogkicgqjchlqcixndnustp' WindowName: 'ghucoypwokptuyonppkuvzvwasygthpb'
ClassName: 'udwxfmxbvycnssbfmxbygfmuxodrfouj' WindowName: 'jougvhsfgukcepr'
ClassName: 'agiyxhxrxxupwoj' WindowName: 'jacxdjeokyuqkjcllzsddkjygbedxxi'
ClassName: 'bcdscoxbvioloulmpnpfxylpgepolfcfvnxmrjm' WindowName: 'aejyhkmudfesmxwbkovrfjnjhhv'
ClassName: 'bskzeueojjddhnj' WindowName: 'ukwmbrutilcotryusxbngdustozixfrnwixhqr'
ClassName: 'pmppwsudyrzschtjwkwkwegfvrklfyymtukoi' WindowName: 'afpildohvpanvwevqxicgqgmz'
ClassName: 'gvmwfrdypkucozgowfbojlnmsufnxxwulpko' WindowName: 'zpmjzunzkxqauotwtwexmgtpywlq'
ClassName: 'glgzognukkvgktwbkjshcawzyxsbsamkmcymzki' WindowName: 'wxotftqaacsvjmlzalb'
ClassName: 'cyrdkxwiahjsfjwehwrwrkbepgsjeewi' WindowName: 'bfarifwijdpqfpci'
ClassName: 'xwbymmzcyqswygywgxytrioixqu' WindowName: 'gmwgwrdzhhrgjwwuhgeqetzravcnsaagsyde'
ClassName: 'dgmrymrtwohqbgltnb' WindowName: 'jefhcgfaprmfghrmratrtyhxztmqmkpuhpsphow'
ClassName: 'sttpgqvxtncnhdoirhqegcinkgetqhskalx' WindowName: 'rsfwbhboxpuwwfqghufucyfyyptcx'
ClassName: 'gvfhuuvuqjswzavrohvryscjkivsiqn' WindowName: 'tlgcnpkdrlvlrsvfnnhiivwjjbakqjcig'
ClassName: 'echchyrkfqwttnbptxemgygtgvpdkffksoutpqd' WindowName: 'ipgqtmeriybijetahiabwu'
ClassName: 'ijoytneiydvwcsnprrybfeqairfgfpembolrk' WindowName: 'lyvnjcdjxplwagtuesmvjkqwosjvxi'
ClassName: 'zinzpbhqxsvxotetmmrrzgjrdlsgnvwet' WindowName: 'kgggdsarzjggadplrlbrcphc'