Trojan.StartPage.59397

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsa2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll
%TEMP%\nsa2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'kiichrmuzrzicemofwcnscfgbuvzkczjaoon' WindowName: 'gnzryicsfubmgbdplljsntzrjybbvipclt'
ClassName: 'bnuvekglqgtkbyhfalbyomhifmqeueuhi' WindowName: 'uffcjasguevopjhxohxhdkphctus'
ClassName: 'vgoydbrrygtsqnpobyafsb' WindowName: 'kjwdhfiiessgsrelkyqkdfqsrqg'
ClassName: 'mgmuvxbqwnzqoffskrwpwrtzjsgjkyvbcx' WindowName: 'ivznmdbxbhqhobgat'
ClassName: 'dltiaqinjujezagndyhqzdnffettgzzs' WindowName: 'bcvacounefwkalahgdjrarvvwcvtze'
ClassName: 'rimsfnhnhmttzahlfmiqytfldvwlbawochrwd' WindowName: 'gpoppljeeefvlred'
ClassName: 'mzcmezpeckrunlnhkzfmuoacb' WindowName: 'adrmasqphlsijeztaci'
ClassName: 'zcmlrbiymjcslyaqjfiimtbcmglfcb' WindowName: 'perhdeajyjkskjd'
ClassName: 'wrdaaperbczbcojkjbovjppjjfngmlioz' WindowName: 'fknuhbvtpsmonpieqdngqtyjea'
ClassName: 'ygjtszyirwwzulxjtbcmeq' WindowName: 'vfespsylvvjinssfrsjfdz'
ClassName: 'lrnqodddkvshbjn' WindowName: 'jrlcvgmzsfupxaxjwpj'
ClassName: 'okufwdjybalrdvqmtwxvnm' WindowName: 'kdivgfblqwfgsstvd'
ClassName: 'dkzmjmmxbpdgcsgdlvhwzrskuonvnwkz' WindowName: 'zroxvhefxdvwhczxxocybjknaphqqholjg'
ClassName: 'qcerhakwghsdaebnbqptwcfacvqz' WindowName: 'hhjebmxlepgercwxfcwiizglkl'
ClassName: 'xhmxnqlnixihvzumd' WindowName: 'hngpkmqqegkknawobuorhmyuwzmkajza'
ClassName: 'myswgqgqrdsokqq' WindowName: 'vuuozpgmoipsvhyogujcttvhiliqmvesekykux'
ClassName: 'adjfkswcnzlqcnztnqjqcphclyc' WindowName: 'kgdmxouvhwhaeprzjkrluae'
ClassName: 'idwiguewfkgwcyvfhnpwtltb' WindowName: 'srhazcvmibvorntkwwtbidruvkxa'
ClassName: 'uzvclkovwdjyyearzajltad' WindowName: 'hsrssnyxoblwmqsmaz'
ClassName: 'pbkukbgpmuajqmbroxkqziwzdkpntzymafqtvxo' WindowName: 'povkylzxjebsqmkphkezqywjofsfffdsuubr'
ClassName: 'wgqzbtbwuaybyhrrw' WindowName: 'rdyqffmtwxmdlclgdvmajgdexjpgcmsbryjbcc'
ClassName: 'frdakwrfmcdyugpbkcfjroqlqfsekj' WindowName: 'bqkwoeaanthqrqfzeadqyopuroxfeu'
ClassName: 'laqeygjqetqsnnrlrbfhitbjbdb' WindowName: 'kyjogoewvyevipraldpjselcrrwvqhpe'
ClassName: 'yzthtzgewwpoacunbjoxqhqlhn' WindowName: 'fuuujxyngnsdtnvifnzbmceoor'
ClassName: 'pawqwdhwhjaraot' WindowName: 'tkmojucgbsiiezrexfevsgzwedpjbqzxukhnd'
ClassName: 'rdyflvmwyadetayndbvdt' WindowName: 'ljafwxonuxytrqfutglgclvyfkmkwlt'
ClassName: 'wavskcfwvtntxjqxodngptxgg' WindowName: 'nvfzltnfmxkhjddnzmajeqkybk'
ClassName: 'fwwcdwaytriqvcvlussvajvnbjdpwkzbyuzlyp' WindowName: 'vngcrpmvynhelqujecivydfhnlvhqqkfoeaesy'
ClassName: 'rqyuxmvahmbobnbwwfzybuqdwydqhmo' WindowName: 'rgddzgxkyhknklkzgxhcrkxjp'
ClassName: 'obbtbnbftwfefmci' WindowName: 'zzqvxrwkbrsqhwnehewdkxrjcltsorxasunz'
ClassName: 'fgwhdjkcmkhtlculzii' WindowName: 'ppwaqryoqyhrdwilpjtdhzrisoytdnu'
ClassName: 'wlmhzbrqrttrxmwwuqttu' WindowName: 'wkcwnjvejkcmvljisvricyszvatcvan'
ClassName: 'utsbdfwwpmmfqjbtotkcm' WindowName: 'ffdinltkzxgrruhtnwhknygyog'
ClassName: 'pkvumwcuvcsboidqzsghhajjyprafboizm' WindowName: 'fzoytutabyuihfehhjcamjrrsev'
ClassName: 'yfwcotfqyxejrmkphieokafnxmmfgycwnxdqg' WindowName: 'mlmuywcruyalcfsyqumozvznlrewtbdnmol'
ClassName: 'buohghssypxdprdvctk' WindowName: 'myvvezweqqfcfyuyhlv'
ClassName: 'tquqvyfunksfvbpuyzrjckhuxjaffvwlgir' WindowName: 'trlgllczzcivdlnawsrwwtxmbnetwhimylsg'
ClassName: 'hryehejxsuvzimsnwkmfrnurxsfjprni' WindowName: 'mexrbdoeckvyvojvlztzzjfifsrvrus'
ClassName: 'bccagkrsupovlyyhohbpcgmqhzfigymrr' WindowName: 'kgaemevjknwvpzauuyv'
ClassName: 'mlutkbegxzziklyqkercjuuwxykosismwoow' WindowName: 'pxnugtdhlzssbcyovwwqdlghldrkhc'
ClassName: 'fnxzczfpkjyrrqboxkkbfqujiilykuagxike' WindowName: 'fooxjppmlmpkpiptt'
ClassName: 'cnxqmbtabhiyrqbpoubmbrercrtvaznuy' WindowName: 'orlyrnaiggjnjicntfksmbunlu'
ClassName: 'hymzfyrxvyuilfaxedplyqyzkujliioyekwtwxj' WindowName: 'dwpoxzzyqiduznkvhzxhjzxu'
ClassName: 'etzmvyoyvjriakzeuywpmruwktskukjqqr' WindowName: 'jsomufrkvmfkvfbbvyk'
ClassName: 'xtvasnhxliktowodujhpzzsig' WindowName: 'peamrvkcteeswwhlje'
ClassName: 'gniiwlgtxlzhmqyelaplokda' WindowName: 'gvertibwomppwsyiawokucbwsgqqqjl'
ClassName: 'vsatzxxzdbvknimxnwudfqnilmrajhqbzprt' WindowName: 'kcbtjkkpztdrpcifevsymylf'
ClassName: 'zjkfjemfxxepojtblxzvgnklfxhqroctsoklxz' WindowName: 'bzwhdiichxhqqsrgjqfftzfnjpctud'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'dvhqcwrvodpckvospyzryrcivmdnjllt' WindowName: 'gurtqtvtwofmnpfcimir'
ClassName: 'yltsojplqfyvzvgvzbvonin' WindowName: 'pllickuftllbiqwykbfrkkjrq'
ClassName: 'stnsbhiizpdszwn' WindowName: 'zucxardueeiwbyvoohvuqxdpp'
ClassName: 'ivgkrvykjguffvkckvl' WindowName: 'qrwylsptlmxsbygxodjdja'
ClassName: 'ynmojogmmmkhubanvsoakkdjqkukryqcn' WindowName: 'zpngkznylxmzuqm'
ClassName: 'dcoitajeffiawcczmogulenlkzsf' WindowName: 'zlamomlqkqwaxndhsyuiznn'
ClassName: 'rnfaiyluooheggsl' WindowName: 'ncpwinltlkppskgof'
ClassName: 'tkbaolwoerzxxnripqyalpmhzlqrlelpelmygho' WindowName: 'wpyssyqazvnnsqwjaqjuhujezmgysljnru'
ClassName: 'ykduzazjojzyxnitkhcfiovgfiqaqhyi' WindowName: 'xiwjwmntniwipztgpltdactfksnc'