Trojan.StartPage.59389

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsa2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll
%TEMP%\nsa2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ylhdgfsymswmikdrezix' WindowName: 'ofjwribftftnjcpgirzgaslanopvhgqvfqvuffx'
ClassName: 'qlwsxexxmuvyxeonbbddjkjgggmryoaqcnrszt' WindowName: 'nnmaosqguwzhhislgtyfohwucqzouoohjvpyuay'
ClassName: 'dirixxxmmonyiwfmrhkpovltqcyst' WindowName: 'kpztbvhfitttkqo'
ClassName: 'ahzgdfdhmzocnmvigeakqmevlrclxdynmxzve' WindowName: 'nnwexcazazkrkgwjuutbquwujl'
ClassName: 'ahajjdzfdkekqppzecomqodqeuieadrzcch' WindowName: 'zqjakzxyjowhjvecogrjtby'
ClassName: 'yrqhjlezywddsymyuzrrewes' WindowName: 'agtsdqoemguoubw'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'flwzdirlnjaonoytys' WindowName: 'dketrmwqvhbizxznkrdrmviwbchnoqmyvdcfpvf'
ClassName: 'qqxyqhvdjmxhytn' WindowName: 'knaspjfwrvsguxs'
ClassName: 'pkqfdutmywirwud' WindowName: 'nfldauqpwgyuviiffvjjvpawcvheiyxjlxhae'
ClassName: 'qamprecghwylqaoyudnc' WindowName: 'pzeqmuenasovlwhqyaobgnveap'
ClassName: 'sgwacsrmoiakopzrwuzcrizuiydyj' WindowName: 'xgolebkoorzzouszvwyhrmkmx'
ClassName: 'gziefeajxbmkobkfpigofkrmnrzppatnpbwvi' WindowName: 'doxzclismaazuzccintanozyuyjghbmbkxneb'
ClassName: 'qxwbkxkfjchvztmbuxbdpblxnvnvbnwzm' WindowName: 'fqvfrrdhtrhhvurfwxhkhi'
ClassName: 'afvswtxykqcxlopw' WindowName: 'oyqwvougwfohwjzlyewuh'
ClassName: 'zozorobvztnkpjmkytsbwskqptjxtpatahowoan' WindowName: 'xoxrkfpoobwobctcbmijbdmeqzslrmdcx'
ClassName: 'gwmlakfsbtlwyeelwhodzaqdq' WindowName: 'jomtfpltysfmekmuvvxck'
ClassName: 'zbewjwolsvlgiiwectvsqsynoexsd' WindowName: 'jvtzqhguxkiykuwhrepgd'
ClassName: 'doyijsnargaweuinulriyqaqjaygrt' WindowName: 'uldhtgtaojvbgxosoieuactsarkpqbklko'
ClassName: 'lrdsvwvfcnwnkhtzxhsjtfjrpskvmrz' WindowName: 'gwbnrkhhyqrhfohwexiekpkkgzhrxbscb'
ClassName: 'buwkayyrdbljogzycgxfkeng' WindowName: 'vzphluvfanbxyelmcaybdhecvuntre'
ClassName: 'xaqqgbnouochkqbjwqadplcq' WindowName: 'tvjpprtdnaonvnfkolaneyrlpqe'
ClassName: 'xxdgfizqeypxcnjq' WindowName: 'dnqzvevqzssopczmocbwy'
ClassName: 'nrfpmqpzfsarbfzmsnhdbuppjabpmsd' WindowName: 'cshghnmcbmntwmrxjexictcfbyxkvmtru'
ClassName: 'ijkukzhfufauumwnxxjtljzogqhv' WindowName: 'tstihqozpzmzidgimtfkykdzndngnmogkyb'
ClassName: 'ksngxefdrfnnkxz' WindowName: 'apxjapjxmncivvkfkizxebfzijadyorwg'
ClassName: 'dfwtwckeulecndnpy' WindowName: 'bkewhwxouddibibjj'
ClassName: 'xulkvbflsldxbhahdornlvcxdichdznlki' WindowName: 'gfxrfwnmyamorpkrr'
ClassName: 'iwtufyeibjfqvedhjkxjqmsywquqpny' WindowName: 'cysbritdzbtsngrxmgubaywamclixljhj'
ClassName: 'aaqcmmvmausvjscdfjbpftxkqzdzzyrssfmx' WindowName: 'sqtthjqqivtmyebpkmbextzbtuwvummnbnnxwyg'
ClassName: 'dxklgvhyipyndeutnh' WindowName: 'yhmtotoazqxrobatbgxribjtvipawkhsgghehe'
ClassName: 'ihdcecrhndtxopnaztoqaodfnmpfd' WindowName: 'ozueiuiphkegdvsaldixqhgmofiqgh'
ClassName: 'bkxphwzzimfehjeiyfp' WindowName: 'kemxqxksdwinheihamtibfznawwjrefgjirez'
ClassName: 'oemgbdaenehifpatlwvkzalmpzwtdzkegdoutfd' WindowName: 'jdauxlkhagbhmskgtvnxjnppqpq'
ClassName: 'imtjugsdowtzgzhmownvgtxwbnzluch' WindowName: 'aenxnixiaoiylsrwsqleyoefhifmsurrzuqca'
ClassName: 'ygvjwzslgtfytumuhsbfpichvqciznljwh' WindowName: 'pxqxfaxlyouyfnspkgjfhxsveadlucsfr'
ClassName: 'zrcfdkhggupjfysrjbqoqqnmcfpqqpz' WindowName: 'hylystkpzvkarxlpqboserhdoamnu'
ClassName: 'nxahzkjiixpkffrkgkeieibhnobgvxcnuixsz' WindowName: 'wmdgrzqduzkqwen'
ClassName: 'uwrnmstfdsvrqqmdfdkdcicsystoyp' WindowName: 'erazpiaqhesujluutswx'
ClassName: 'wumaekonluzdsxqviiofjzxjszouhavs' WindowName: 'spjuyttskjpponokwiwactcxvfvplavswj'
ClassName: 'ygogpfvenwozerugargtjphncevx' WindowName: 'plyfazhhldpwbrwhqgwvusrlmamt'
ClassName: 'gflwzxpwibcxsvuxgepg' WindowName: 'aluokbutoovfghqvptvewjra'
ClassName: 'rymfvfxnnvysnuzobvkaeun' WindowName: 'zvhbfmakftjjjnjzpuk'
ClassName: 'pyufyyyiysrpdgbpynvncrlhgexnf' WindowName: 'aysubkzzmktnziwurvwqnhnwmeuillr'
ClassName: 'soeoalgwzszqlgrk' WindowName: 'grwpyzpufhlfuavsaozgmgurhtelf'
ClassName: 'lfpbcmzscjihfgcnmdhfhqfifb' WindowName: 'sisizitxykoxkknzs'
ClassName: 'pwkwaebdspcflbkxnhbjrnikc' WindowName: 'ynezivhjxsbwwrwfbqriuybvtnrufj'
ClassName: 'nzzhnknnyegcggkifhtwjrbkm' WindowName: 'zilskksiaqinjcratrcfkmw'
ClassName: 'zwxgcffqpificdfivxx' WindowName: 'analivyejcrogngroqykbeieuuxds'
ClassName: 'qwnwggwendmgdjstmzovraucuazrstbom' WindowName: 'akjvugekgwhfhtmwiguhxmlvwczpokleul'
ClassName: 'ugcguxhrusvhikab' WindowName: 'fdoocyejouvapdbnppjilqnhvlsqiqu'
ClassName: 'vzkusdkxqshveagdbjlqedpianuqaxpd' WindowName: 'lshorinjstrzlraseghmflt'
ClassName: 'vzhyaqbgxnrjhnzayjxdrmtbitce' WindowName: 'mrkezrvwatlpmnacxzwyuopiixh'
ClassName: 'hpcwujqjhfeogpqojhxtdafrjtoyczam' WindowName: 'rzwnyfquzevjmio'
ClassName: 'gtauoyqavueapssvzycdu' WindowName: 'uqsmbcsgjiziifuffocoulzvzhixg'