Trojan.StartPage.59398

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsj2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll
%TEMP%\nsj2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'hyyhlibnoqmumcizfwz' WindowName: 'dsevyidpxvbeyvvisutwuuheni'
ClassName: 'dfexqlzvqtvewjkqzlzxwyclpgjeu' WindowName: 'izoajzyxsmtdhmyrjlnhjtopblevpgczd'
ClassName: 'rfqznisapvidwacrkvrauburpbvztibjib' WindowName: 'amucdelwrcobbwoftocp'
ClassName: 'khfqnjtbkqsjidqfamqowkdhoqqblyi' WindowName: 'hiyyxwilgztdjvkwherbfvbolupce'
ClassName: 'nhpquaagczmkxvsuhexxo' WindowName: 'zbgzrbdqcdnfpqkppnlcwp'
ClassName: 'wvuspocuxladnfnlhyywyizqqlveceemyj' WindowName: 'efscgcrayouajnsivbcecsogcoxrdydkufrgxb'
ClassName: 'xvbxqagstrqgzsxgavnf' WindowName: 'dwdsxstjixeeejyqpmwkujsvwcuxlwkzxpgnla'
ClassName: 'vsgcczpfjsmgcrzgqgjwqtcfnjxq' WindowName: 'gdprwprakdyxdhyzzksg'
ClassName: 'cydrcaylswdouzq' WindowName: 'btifcucnmiyzajznbwuzwxgkpfsbbkgohcte'
ClassName: 'xamukdkvmnzwidsylrdhpfjbjnsocnozzhhsjo' WindowName: 'pyueaqmaopmvjxznwvqzi'
ClassName: 'xmpfiwxiodbxxeimwgtd' WindowName: 'loohzpbbptmhazvnxtnworglhskz'
ClassName: 'jibklzjsdvvhuxlpaqkvgskypstlgicg' WindowName: 'dvijldaravtnxgybdmftkgbgbuvazalnoclw'
ClassName: 'wgdysivhvyjiuleb' WindowName: 'vljsgwymvfrpzswjtlvmpwem'
ClassName: 'detogdyltinkqtwgnlwfoewkvlgvumaozdxmnp' WindowName: 'krpjmllfgrezplervoy'
ClassName: 'mooateyyzxxpppelpr' WindowName: 'ftyczfyjchfxywabtljhmjnph'
ClassName: 'ssqtegnaybvkubt' WindowName: 'mcdgrkgpuqkfndgnofayc'
ClassName: 'xynzmbvxkazycbsglodormyadawgu' WindowName: 'szgvcwhmfnzcurkptmfyyueyreluo'
ClassName: 'loxwakucmnclocrfnfrvikkewwpulvhbk' WindowName: 'xksekrpmaqkgnibzybqhzyzsfjyvhxhooldgmf'
ClassName: 'xycutktxcxiqbcwvhojdfknqew' WindowName: 'jcdhubsnsliddasqvcxwvbkkltjtvshfnvkmuv'
ClassName: 'dykudrhyroafotejfkqzo' WindowName: 'wuxqrfemxsnopsaypilaon'
ClassName: 'tlhhtkbkwyvkdxjlzms' WindowName: 'ipaeddnhiexvqtchpjysnr'
ClassName: 'yqyaxgtsqqtfzqwwhs' WindowName: 'brdjxgiypuinkukeavcix'
ClassName: 'pqwxkvqxiglqylsvmlllejbhgmnyqwspuayw' WindowName: 'ceeyjeelfogyzovufgwk'
ClassName: 'fvmftsytlyvfthbgiwrcvqlnkxbhlevb' WindowName: 'fatbewgbeofqfgwn'
ClassName: 'qacecrjbyupymuw' WindowName: 'kcicbwxpxrczanlmxykrisekidlvvdonfbfl'
ClassName: 'lcdjtyopzzetpdlh' WindowName: 'trcujvkwtigbtqrsggunhviyiyyrzvbsgutfm'
ClassName: 'rjgodxndtyzjhsuquldwo' WindowName: 'ccqaxyudqbksmicwqlgrutkeeqhorzdqdpafic'
ClassName: 'tapmfdjtwnrknizxtyoiffbvsexedjexll' WindowName: 'xuxcbngnzsecsqtxpupiebekn'
ClassName: 'ooruzwerdbfjhbqljguxfhtgsytelwfehraol' WindowName: 'jivmgvyubfzbwhldhysltvkzuvjlb'
ClassName: 'ppsdwkyvjgyminixfqetlvhzmnorcxkuwqbmv' WindowName: 'evngddztaccvrtsxnnuzvdgonnnaexuvpvj'
ClassName: 'bnfsdvbqdfjgonqgbcggvtvfublhqikqzd' WindowName: 'qezunrpvjtukafdfljydbgpiaxghrity'
ClassName: 'hbmghpsqaigitawuroddplailqsciro' WindowName: 'nuvswgleozqluuyrqg'
ClassName: 'zjbcikaqmurjebuyil' WindowName: 'vdpshbfaambihtbarqhjatgi'
ClassName: 'qsgurinbaixsjpgfnmfxrqwk' WindowName: 'qnkikimkobvitnhsxitjerupodhgrbslhmeek'
ClassName: 'uaxuvuowhocgmtyyw' WindowName: 'mvftompgokbqgflrjiayxkazrgbhhzprspgib'
ClassName: 'rbhmqgwcncavnvwebskzdd' WindowName: 'qqxunqiwqeravjzlqdhvimqy'
ClassName: 'foptiivsedtijlxokxaqirvmkydzzsqqnhvahx' WindowName: 'mssscnleebpnkoljp'
ClassName: 'hittvghijjejltsiczpjcukiyhoqqdpay' WindowName: 'rgyfdphuvxrepzvsqzshmw'
ClassName: 'rwbnoksfmgvycvnfwbf' WindowName: 'ohcbanpdhibhfnpoqdhhzumby'
ClassName: 'talbthodbmzhlsfzfxmyiycqazrugvrcyuludoq' WindowName: 'xyukndkohdsasoznojamdkxrxmrnxftgeodks'
ClassName: 'bnrcotmpnoijcisaekyctqdzjtunczps' WindowName: 'eqpazerafuuivcjdhvhirftrdaz'
ClassName: 'rowidzidrbudaspcbobwodnvugyvwyyrt' WindowName: 'dzhadubrxcthgwdaefgzanzttuiejphuim'
ClassName: 'ixfneixwtpqiwpjc' WindowName: 'pewkmavtwrsdjvogwvbbunrywqepowqtnl'
ClassName: 'dvcfmhjojpiunkdtwxmdbyaeajnm' WindowName: 'ljybjnunwlceypnrustqjglypabocanddxqtnj'
ClassName: 'ufexumpvvqsabnnlzdrefwyfncbph' WindowName: 'tmdshmplhlzizwlmlaigofolzwtqjeaxycq'
ClassName: 'ygupapbtwfzxuthncsrbnluywpxwe' WindowName: 'wloxrkdvdshwxvcmeccxwzphwrnwrkkv'
ClassName: 'fyuejrupamzckkhkongxrnsnqs' WindowName: 'hckhsgrnojlszxiqr'
ClassName: 'rxjqgxmtfwxurlxlm' WindowName: 'zaeobfghnmzhbchgpzttufrkpakofufzoo'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'yntgsierrxojcpakmlotepxdoeepfadjnyleedw' WindowName: 'pgccqvbtmtllfki'
ClassName: 'nffuqgeaismzlorhmgqrfgfdekxbjzv' WindowName: 'qtjxwjbhrsrywdazxtdnrekwaeyhaqkpo'
ClassName: 'ebnknidnvjulryhzgjl' WindowName: 'wxwmegaojniqqhjuysdjlovrhajxsa'
ClassName: 'bsidjjlndprirxsilgehpjvohgxbwi' WindowName: 'jjxwiniearriikdaceakbvmavqgiyzwcckcfnsy'
ClassName: 'lddbtmgeyroplkernuhbzjhnj' WindowName: 'vgfltivzloqinufdlngfhnjzlalcxsx'
ClassName: 'ofjjqjehrbnpgzqdbpfxe' WindowName: 'eusqypebufobmfbaxqnzywdbtpay'
ClassName: 'dihxjooshbcvnsinxackwamfsbjjijjzyx' WindowName: 'vqztgknuwkfidrzdstqlywzhfvwlnfaxnaw'
ClassName: 'rcegeecrvlmoiazcdqaeziwjzqubttfcrxsgx' WindowName: 'fhphdlsstlqiposwmosizkwglrzu'
ClassName: 'xehtiqahloyfwyqyviyu' WindowName: 'rlotjvchghntqxfxrlmzurgvdryoqlro'