Trojan.StartPage.59391

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsg2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsg2.tmp\System.dll
%TEMP%\nsg2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsg2.tmp\System.dll
%TEMP%\nsg2.tmp\Math.dll
%TEMP%\nsg2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'vggnqkmijxdbtvzvfapvethhlmqquij' WindowName: 'odhmxaqqviuxeifqgdkeu'
ClassName: 'mpzswemheqjfoaisaxyoy' WindowName: 'uxnqvclnxljbwmivicculcmtdtavkbfb'
ClassName: 'tglmiygnmdjirelpkzhzwhyvrjdvqqodhahcmdz' WindowName: 'ymqselfegipwvoakoobpkpobimnafdzd'
ClassName: 'chouxcflurnujwimkiln' WindowName: 'ggortikflzteblhebymmmfq'
ClassName: 'ejfthjgevksnncxlpps' WindowName: 'jbitcrfpqlgrqtjevbcrezghyuiocdadrwtmpe'
ClassName: 'hmsvwqgmeayzqmzyrtlssb' WindowName: 'iehrozwstjhmopcfwendbczvmmuml'
ClassName: 'icigrgtrmpaqqkcvcgy' WindowName: 'xydrsuthzkiaalrgcqihn'
ClassName: 'todwpmeyoapjxrfouriimypdacpzi' WindowName: 'xyiswcqdkskypmmswxm'
ClassName: 'gstjalcyqlnzvjuwpmbtjlvnwhnz' WindowName: 'sxjzvmrkogflnkatnjoggpvmoiejquyx'
ClassName: 'mmnjaxyisjkjoijsmz' WindowName: 'susffuivrfvqtjksehyxq'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'eaciunxfwihjkyobovwbppkqro' WindowName: 'xhnzxhmjqqisuzqudajjqchbvru'
ClassName: 'jigjdjqsnrujlvygsjvllofksn' WindowName: 'rdmpmjqwsmzwhssppziwmoudiiahcrkztmmu'
ClassName: 'btcyrzuarcrgryavwtf' WindowName: 'fnlfspuqnvnqhkafnupazzevtidoxy'
ClassName: 'oszvcnfaxyhhfmiboklanzlj' WindowName: 'xwvxqxknhctdxoffusdqmedomo'
ClassName: 'ybopwedydhltpqvgegzuskxjdiugtzesmrxfke' WindowName: 'bufbyvtomrkvxpqotbgratnypriwkh'
ClassName: 'dhvvuldgmregogvkuxcvptxfxlbiep' WindowName: 'ulrzgmpeoaoorkpexbbjasoyuotvxgmfgodcbq'
ClassName: 'kmwdrmugqwihhrytwtkityiezllzeyaonys' WindowName: 'juonnupeqlzeocxovmxereycickgh'
ClassName: 'tvklcmwddccyyvtzbgeaytsxdzzvzuwtqsmt' WindowName: 'qwwifizwbjilcdtmigcdxfd'
ClassName: 'htclcybfvukluswiogptvoclmykg' WindowName: 'oylqwlrvmpkvpimgwydbqoxwwiizdoyy'
ClassName: 'tozdqroolkykbtqmeyinocunnruzn' WindowName: 'uepnjxvcimxlizvpofeckbdxehvkzgknshhnds'
ClassName: 'uwetyvoeilscawylfpngnoshqerltezb' WindowName: 'bgoldxgvjftjuwhcpfoutjcvogtqzwwvxy'
ClassName: 'xhkpnefgcnajmbbacukhqoskxvpjcvwxow' WindowName: 'jtihwefmehapdnkpgowluqtohfguzz'
ClassName: 'dnhiwpilhgurdzrivdzzdaajhiqc' WindowName: 'nklrbpdfqnsnqwgndufanwrfngyiutdu'
ClassName: 'wbdptfdserhytzjmqcqtgeofqgihsofmp' WindowName: 'ioxzdrqznskerwmgmkwqdtvyfdnq'
ClassName: 'ieqynimbhqhzvccazkkx' WindowName: 'szepyzjsqqnfuqdwltyqblzogrocfqwjvciglp'
ClassName: 'qzhezaazaljerwcxiu' WindowName: 'hvjhcdxbbyvoofoddwn'
ClassName: 'vsvgiyrrfjyztcaunadoiq' WindowName: 'wjymjpjfdqssmrcqvpqdslmkn'
ClassName: 'xforcepsfvjhvxqlwomzsbgren' WindowName: 'qojdjnwnedzqtaajnvedav'
ClassName: 'najcumgbprfxptfutqmvqscuntwxy' WindowName: 'whmrzjwjyaikmkvhzradtgakfglvi'
ClassName: 'crjsagutyetxbzpvhgdadmqbptuv' WindowName: 'rnpucwqfppwjknpflhmdzdavzgjrbkkbh'
ClassName: 'hbmdpubrbxztjaotryudiorf' WindowName: 'ssmswyvkxwzjkkybhckjnrmhxnbll'
ClassName: 'ndulvtqsnkiubtzbuiqdecunxarjna' WindowName: 'hlnqecakzgqjaholwfuhtosqslg'
ClassName: 'rsesgwpqzdfawhqkyaltxlfc' WindowName: 'ibtgzhezywiynokuzgesgmajnqbtg'
ClassName: 'mlapdcsaqdchylwjlcd' WindowName: 'oucavmktfepzwpjygjhtp'
ClassName: 'rlaveivcihzpysacthiceshlfrmrmpl' WindowName: 'nlapsqyndwxvfdeqibickjmrhjdcgjqnpoxksl'
ClassName: 'ylrhbgpmyvvepowdirozrxndxrtsmwseb' WindowName: 'oudvnmvfmbpxfufpdutgcwocvmedghprabnldjr'
ClassName: 'iovhxhtrlxdcifsacxm' WindowName: 'rwxkislywzuievaqreblviodpejqqpmkwoicqo'
ClassName: 'wkhknhunqieddhboqjuiywiocnnbqkktmdtufl' WindowName: 'dxuiuaxbgnkoqmm'
ClassName: 'ggayfobhvtfxrxqexmzzoxgtpyr' WindowName: 'owlgptlghjgldkofqakceuptzyufnbckhtkf'
ClassName: 'yhcdkbvozwaoqqyxw' WindowName: 'yygsjuvraqsxankxnemchpsuwu'
ClassName: 'msndkwwsmrororduonprgztpdzwy' WindowName: 'hksxxjezdaigscmxdvzqxobsuh'
ClassName: 'zdjmidhwgonjdhejasoxhvvhvfebwsy' WindowName: 'kzsehvcpkevjjkjsvei'
ClassName: 'jovztotowjipfzkwvbrtzgefd' WindowName: 'duqjpycbojzlqhvan'
ClassName: 'sgdsavyicccszcwmtsgsrm' WindowName: 'aouajilzgtunebokmlscqxondg'
ClassName: 'ohvovxfqfuglgipysjsqxalxmkhunhnke' WindowName: 'vlfaayyndairbvppfymfhgnjusycwkkodjejuxx'
ClassName: 'bmgcijcnseigfwhe' WindowName: 'vqgkqdajblkqkcarwgpmhwlyssmqppqqrkdqeww'
ClassName: 'bfbfyuyzietinscetykglsgybmmrekpbdqyhma' WindowName: 'wlmqipomhtkqvdyoekcjftgtmnalyxsmtso'
ClassName: 'oghouyqeyolswohnwqhnmtgtz' WindowName: 'nddzitkslovnbjkvn'
ClassName: 'fvhlaloaquvbjbil' WindowName: 'cjuzxrqyihjmfejutrcxzsmgokgfjflv'
ClassName: 'uhnmnbwmmgsxfzerkqgvcf' WindowName: 'vwdnbxjzrxtqhgexqe'
ClassName: 'xptchczfhaowpbjawqvcgun' WindowName: 'czanetqnndqmmcvacqkmbsiuxbsuxs'
ClassName: 'ltsxbuygolveqkvfrojekb' WindowName: 'hwppejlnditfitsssaubto'
ClassName: 'ahumuzwgxterlfaiwzd' WindowName: 'ykbuvjohmyklgwpmasacubakekxhlqtjyuxvdr'
ClassName: 'lxcifvudjbeojxlrgkyt' WindowName: 'ojivfreckowsttnsmwnuf'
ClassName: 'bsefzwjhjwkrpqyvmrytkyewfb' WindowName: 'tlurjbeudjpnujkkqxmfwjgjbwex'
ClassName: 'zrdngjramownjwddxozqfpsdsiwmz' WindowName: 'mkrkezkzykdttiftkoyhrtzxyzy'
ClassName: 'djubghhzgiqvcndwzvlwyqhldqgsbujsgyvospx' WindowName: 'cxlujayixujsfjzumpfhpygcb'
ClassName: 'vbtmcbnovrhuvymopyrgajumfklayiqnmbfwox' WindowName: 'rqwsktjdecggdehxytyetjswagkfkdicfb'