Trojan.StartPage.59402

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsh2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsh2.tmp\System.dll
%TEMP%\nsh2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsh2.tmp\System.dll
%TEMP%\nsh2.tmp\Math.dll
%TEMP%\nsh2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'iguawmqpgfnhljlkegcsnnzlbltomfgknhixtdv' WindowName: 'ugdjswdhnzwayotlpxdgvvfuouwx'
ClassName: 'pecbneanthjtcmuaqex' WindowName: 'spmcjcbxinmfdrhhylahhoo'
ClassName: 'wqlgtptyoktqzjpkgfcjbxowequl' WindowName: 'fdghlkvofudbdiewd'
ClassName: 'cvwloriiujndwyqbrfevyfervlfcldpkg' WindowName: 'ckbxosfsvibhdfoqqykhhgdmylopk'
ClassName: 'ejzuhdbvxuozqliieijawsdinyh' WindowName: 'gsdvmgpoxwiqascv'
ClassName: 'rcngzalfmebcampfdltgaovxpuk' WindowName: 'hbszbvdrakoahjvfmgpfkrkpzyemfomeiqc'
ClassName: 'kzjxhpibhmghhehbifziuwqhc' WindowName: 'ykwpaynnlaalagcr'
ClassName: 'jaxghozbexfibuneq' WindowName: 'xxdowtvazajajrmjagqtpibqrqnpquz'
ClassName: 'imzvxntbpcvwmrwuvxkvvgtlrdkmnmxuze' WindowName: 'juhrqhijdwccawpfdlcsavq'
ClassName: 'vcjgajasfgmyopuqi' WindowName: 'vyouewrvgmvwyfkipzsdnwoaq'
ClassName: 'ebpjpmehgwtddfjkzdjwuyzooknhbaeqdozd' WindowName: 'qzfdawnlulmptvsihgthzveojgcgzlz'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'xqpjtndqlgmmxbmzjaz' WindowName: 'hunxxchazpmmrxovngbwhgxqlavljfspzzhdoc'
ClassName: 'bedkoewrecagqdnmm' WindowName: 'mkqwfyeafqfjukoekfhjbfgsuuim'
ClassName: 'lkuejdtjviwxbfgabvvgnonwxclrralu' WindowName: 'qiicovvewpcayry'
ClassName: 'rqypwtbxawavuuredyfeopirdypwpmdosi' WindowName: 'ledrnqpkbexssxpvim'
ClassName: 'uuacmusdoovivrelxbtljvuel' WindowName: 'rrfeutbhjavldsmeip'
ClassName: 'sxirankstqeooluybjjbt' WindowName: 'klhssjhqvtyioxykwnhqbcwbs'
ClassName: 'ipyglihplwodryuw' WindowName: 'znobpwgjowgtqxyxqv'
ClassName: 'alfmdjcvtaogrkllm' WindowName: 'rcbcedxqdwnrljtkcogriivvpm'
ClassName: 'chjeqemivmkpywzfxecwjkeujrwmbrnbbcbwo' WindowName: 'ohakmnimjhrnxoglwrapbwtbvhhf'
ClassName: 'xoeplrkmsnrcrxdguwrmjkkgwz' WindowName: 'dfkbehmlbuutgzomyuenlhviwgyelcosgz'
ClassName: 'ljidqcoodbmccriiwprfqjbuqzydnmcj' WindowName: 'greldpgbadgygdlwgdacdzufpwnhkutxu'
ClassName: 'wkisnwhrpttvnlhhv' WindowName: 'vrqzghzoxwmssqedcwnnreubhdfb'
ClassName: 'aywdjfcadqkjhrpeldsztwfmrkkfmicqxysbk' WindowName: 'gmfznhqbktlqxnxxkfuvmywoybfuvvowksuubet'
ClassName: 'lwsnerbegzvxrclpd' WindowName: 'zasqnnqoapqxrelljjbsvuirgk'
ClassName: 'qypefcmutqgreamj' WindowName: 'elfsrzakhhkereweizcs'
ClassName: 'sbacqnkiumvbaidbgvqmogxtyxeiie' WindowName: 'vmmamauvqrkvxuyxkwkivdmbkqsyfxju'
ClassName: 'pwwddxrrwzrepqoauzuvvjig' WindowName: 'onmfaojqdbhouradhufzaqgxtpdkxlsqfjnsa'
ClassName: 'kktnagmygxijopsvixpbnfju' WindowName: 'ifphegehiixdxsvfbcixyzaajjucunsk'
ClassName: 'fxodmwbnsfaryiufzypuoyosefurt' WindowName: 'ywbudjpidqmwqgybzsskyslmibnbmmgptohpb'
ClassName: 'titqbiulanolwpvdmkunotewudbd' WindowName: 'opwdxwarxnrvesyhtbei'
ClassName: 'gllerynixntahwkgmriatkwpawapnvajnnl' WindowName: 'ajxbmblbwblaejqgzpulgdhkxxmlhoz'
ClassName: 'jiapwetkecobulkpazmaadjcjrzwfqnikrviiz' WindowName: 'dunyhbxcneaknhahuzf'
ClassName: 'eaptoafnkhftivfnbctlnzszkzneztqxi' WindowName: 'vvdtdrdafobedbspysryiyucwtnzmlczpdkmu'
ClassName: 'gijrcfcogycivvsnibwhjlkfypnmcxwonhzofay' WindowName: 'fyaczctzbdsnumtzsff'
ClassName: 'azqcbtvjraumldsihpkgjcmhs' WindowName: 'drxesefvwdyqljyxwztovtehazjz'
ClassName: 'jmbmgobdsgqaejtp' WindowName: 'vktnrvhqdtwznkypocbvrhniphazrvuiibs'
ClassName: 'qwkmnjfbmotwrucvwwlnytbnozuuflpwhcnca' WindowName: 'ookdeykoioiprvqupee'
ClassName: 'rfyaoeccsxxsqortuudnfjtawptiktea' WindowName: 'xqnsvagzifjzjtnbbmeonp'
ClassName: 'htmzlmfjjukdkuhjalbvudu' WindowName: 'hghvoyhsirhwydheatrnfrfspg'
ClassName: 'avrrhoszeforltpouwepzxvlrcfzarqxlrvzag' WindowName: 'wxrfyipybyrcbdooceemnbtycbkdagdgjnln'
ClassName: 'fiptzxayqllnhvwrqldjmscvvdgjl' WindowName: 'dybpelenbncxlznublxczwj'
ClassName: 'ezbayvvhcubarcr' WindowName: 'ylydfhfcubusgkqiq'
ClassName: 'cbssqdzsadustetwwjdqhrhdcdvjxommq' WindowName: 'sitrsczharsoofpaw'
ClassName: 'npjnsfovhfvlcre' WindowName: 'cikqgjblsyzenmciuvzkrbdzborztzmuzf'
ClassName: 'uaytcfbkfajgmsnuhfyzkjkhejbpkwusrf' WindowName: 'tboosapxvnpfftoxocqaphbzdquv'
ClassName: 'kiqitqurukcgblvhgcfqksppqertlxg' WindowName: 'lbpnsbwrhkxnsygsk'
ClassName: 'qbsezzwrxqsmvtqtrqeisgfmltzqx' WindowName: 'nxwncokxbpnuziejczcejwguopbvmsltzmbckzg'
ClassName: 'tdoymdkevcsquseauicnbkwh' WindowName: 'cxiliymcrjpfjfwmcxpknsvimwoarr'
ClassName: 'rveiaiklitghndgfexwazosb' WindowName: 'ryjqbcadzysabdlbeyiytsoxqllcdskoob'
ClassName: 'ymazrpkyooxkiwebjaitlqtfjdkpma' WindowName: 'npcdfnyvviajvyk'
ClassName: 'ojgxlyjllghwvzsjwkgg' WindowName: 'bwivulwqyrgywtjhkuuuqmzmskyuulgghw'
ClassName: 'zkeaookauvoxingkptruhyjivhtp' WindowName: 'xlrykuksyncizkfhfgokalqvme'
ClassName: 'tkbelberbigbwoqazlmmxuwwxajenyxoeilwetu' WindowName: 'axgqrdrvooocpzcoilbqthhwdeg'
ClassName: 'arpauhzsveufzcrmv' WindowName: 'kglcmyabyykdnktefzllhklvb'
ClassName: 'lcjtykpmmdyrgaehviobmmfewvybtrkk' WindowName: 'rxhylwtujoajjblqkspddldumygeqmozq'
ClassName: 'wwblqxdfdjibmwomvougiqbgovucmeqc' WindowName: 'jgoqfsvdlwzmgvfxwywfusoymffpsuprtjwhmt'
ClassName: 'mvxexwrzkjyzrbmqgznunlewwcyxeobgy' WindowName: 'nfmfarbgirexgsykbq'
ClassName: 'ypgmzbncnuivlswdrjccsw' WindowName: 'uwophkrdfhuvofqzhlnqnhfkeksrudnxyonl'
ClassName: 'pqkptshgdxtctzakyiohgitdsdnqb' WindowName: 'wsmomehezoohspehtpsvtfcmuosfj'
ClassName: 'dynstsqsevldbunfryhgixxykukzh' WindowName: 'qykwgcjfobsuumc'
ClassName: 'ceffyjoeygikjyolwbqdx' WindowName: 'pfzwaubddsimaihslcbggximmr'
ClassName: 'qhaotcpzegnumkccm' WindowName: 'exkjdkgxzgoukwaekuybftyrwzipc'
ClassName: 'fdnldkukwelfduvebdnjvvd' WindowName: 'advkzjvfadojqadpcxp'