Trojan.StartPage.59411

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsx2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsx2.tmp\System.dll
%TEMP%\nsx2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsx2.tmp\System.dll
%TEMP%\nsx2.tmp\Math.dll
%TEMP%\nsx2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'tmkcxmyzzxuocjezsuzdhjnoxrqjqbfzi' WindowName: 'yyhjemgqoghhvgcgbkazjwfjddfj'
ClassName: 'nsfhbkcycpobpwvjk' WindowName: 'iwanonrpeftvonzyftsqkcon'
ClassName: 'pvjwviwzppahidopmucwxbndwiuor' WindowName: 'hxupjryqusbvxyewgdpxkxdoiyyvxlhrif'
ClassName: 'fumfnbvdfujghccjjnggxgntqhcdgnxysk' WindowName: 'qiftyxojcpwjtryjqpseeqggolbzzkjfivjld'
ClassName: 'yocukzkavnhwswctktovjuqxvcftigzk' WindowName: 'xdcqockuktdzgjczdewebvg'
ClassName: 'dqgvbzbqxlgckplryzcyktp' WindowName: 'stxeuibsvlqttffizrczihgn'
ClassName: 'wkzathlbnmiqmhqikttqknyirwdpqrrbuk' WindowName: 'ojdcobtpjqhvmqjuzqecmj'
ClassName: 'heyjqbxkmnspfogedvostelfsthwfxupbycxz' WindowName: 'oidydxiyiuxmnlhkdgi'
ClassName: 'dcrrqruiphvsywq' WindowName: 'kzaxicxoihibeeasfttstwlygffwo'
ClassName: 'cvbrhbvriojoxzc' WindowName: 'oigaixcmllcpwsvdqdxujypyagkwslehetmvns'
ClassName: 'pxuszvzfyebtquoathziotojqamnnznvzrawsz' WindowName: 'cjrjbegzjytypaefsl'
ClassName: 'vlpkmliqeknuyteqsrxbpu' WindowName: 'iwtdnfuvjiciiorexaw'
ClassName: 'qxhsleztxkmeuggzocdpmsepskzlzdz' WindowName: 'gdvdwlsoxudlstrgvysexrzbborkztezatdphpu'
ClassName: 'blhkwzfkqruwgdwewbytraqawdmihspcvdcjxg' WindowName: 'kwavarbhtcegdiu'
ClassName: 'fybcyahnwxtbcxkoqcagxl' WindowName: 'xnksxjiqguzbwopq'
ClassName: 'bvjxjozwbzwdwymttntitretslpp' WindowName: 'uefknanqpsjluqzlyvtotggfucm'
ClassName: 'zmskgbpwsjlysoliencgfvedxs' WindowName: 'hjogtqnozebjmbkdwdgswuqmbrucqnoqg'
ClassName: 'plfxjzknbuvpznkhsuarzqzyrnhpaxyfhxw' WindowName: 'ofduohhmudnisfjdivrytlsemwvbj'
ClassName: 'htdqgbliuykkjuqmznmnxepuhpz' WindowName: 'raipentyjlhuputmluorvpqsiyiikhqxjzwd'
ClassName: 'iagbtkjempposippokympuhxzybxocxvbcdblif' WindowName: 'mxtmurewcxclphgilqaxnbo'
ClassName: 'czjxqirwqhkvwizwqj' WindowName: 'nyuudnmtoxmiyxrmgzoylsbqzubhhuthellg'
ClassName: 'qeouunalrggfqoaix' WindowName: 'xueideslwmkhjig'
ClassName: 'ckedqlmndlpircsrzpkqklb' WindowName: 'asdqopsvcgeqcymllvgxnljayiixzidqf'
ClassName: 'divbwniyvvkdvetulppgtnfn' WindowName: 'uqzdosnoomdizvrcm'
ClassName: 'nghltaleecuiwrgmafmh' WindowName: 'svgjmtdozmzezptfschjfvouxuxoezkceotamag'
ClassName: 'txiiswncxeedypnrilenetbzftrisxysoc' WindowName: 'nwheummocsrohsqypscpeypqinhmrlcrutzeu'
ClassName: 'uruioppfmwpllwbuwvbqp' WindowName: 'gokzecixukpoxmtkvqjybuxnv'
ClassName: 'tzibrwhaeszothtfdfuqcpzgz' WindowName: 'oumrwffxwxtubspcvb'
ClassName: 'wzsdvvwilgelaiipeikekdyuuhzqg' WindowName: 'pdaigitgjjetjwfadrxgrivcx'
ClassName: 'bnutnxzddrklayopowvkephzwjbidzziclx' WindowName: 'rzajayymkezcimvqlmixywgpxyhx'
ClassName: 'wyerifdhabhdeal' WindowName: 'gjqhmffvkdbjcomdebsqpu'
ClassName: 'ghjycqbfyyaqmhnbeac' WindowName: 'lxmrqnhhaklxtbcdshorwpcmdsanirk'
ClassName: 'lboirovjkqmrdrkomeczizdjuotfoopdpawmaas' WindowName: 'njqfqjlhiwfisyeamcnixxjvsbsyf'
ClassName: 'zozzvbeknplfmeyzoxwcbhk' WindowName: 'pztqzqssnhqehnzamyvqqgskuwblamdtagkkcr'
ClassName: 'ylffwvekbcafqymusrjb' WindowName: 'jnjvgedpfwtdglp'
ClassName: 'ifgycdnlbpghdrphpvdepqytiquqlrcsn' WindowName: 'gucpyeprylwrlrqclljtopwiuwbizjjjkdyggi'
ClassName: 'mrhborhfdigcufg' WindowName: 'wdcruadnltcugfec'
ClassName: 'gdtddxaejhsbhadpfnsydlbdgsddff' WindowName: 'cidjvdpbdjwjsmqownwq'
ClassName: 'cqdsjecbbcuyihhqllidafyujqjzpabhgtwlls' WindowName: 'blzkmxptxlqmlnfivkpqrrcohvxcfxn'
ClassName: 'zadsqbfizaofregjso' WindowName: 'ygupvpxvdwmhlpkbiwgitcislvou'
ClassName: 'vnzifqcospzqhlbatrrfixrnzmty' WindowName: 'paiunewlpvkezqtblwqsucvcmfufjkzlr'
ClassName: 'qkzoeyjxqticqljjtiatbfptejxh' WindowName: 'oollsknjxbenrqgshhodhbczaxxeigsz'
ClassName: 'anfkpypmvlbvmqnkqduqylf' WindowName: 'leuddmgmlneujflxeti'
ClassName: 'scllphaacgbxvluepgic' WindowName: 'ilspfkcmekvjxltwerysgtwr'
ClassName: 'ggtunubvceafvvlpzhlsnsguwkeybei' WindowName: 'lxucsvztehjqzhiastfwcdseyk'
ClassName: 'ikstaoyschbaetfhhwocyuwuuotxdogy' WindowName: 'yxjdzkgyhmwjnjbz'
ClassName: 'mgwcfknyxinjheazxorgexaeemxspthwdxs' WindowName: 'hpvynqoaaaafbmja'
ClassName: 'ckzdwbccgnhlbzenucizokpwopmdjhoeficplt' WindowName: 'hztmtxjzxqwyupwmsjzqokwebusvfzh'
ClassName: 'oytofxvqvdvaqdbkersbmhkmqultckxueww' WindowName: 'idizvyxuqqchjtvrupndsxurg'
ClassName: 'apxkcmjsrrntckfyia' WindowName: 'itybdvvpebrykdbwkxnonhopwokdg'
ClassName: 'knochsyxgqafzrvviubr' WindowName: 'bsqxlbhhmmipzgrgasmdgbutshw'
ClassName: 'nxeerpvogaxymdvjfanuyfjzemgpbkezi' WindowName: 'pqwmlcwkqnwkzajfox'
ClassName: 'yvlanpndavjwbjpjqqbhmcurcvyuwshekfhzse' WindowName: 'vgyejrhssauexkcrkvugjkesvyaknfssg'
ClassName: 'ibqsfvundsijjfjjnzbbvizjtyh' WindowName: 'womudvniwmshxggfirqhyqrzcrufyfwvsyq'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'fzafjkqhftboxsittppmm' WindowName: 'vfhuxdvvcdgorhqcnsntfzixbkidxf'
ClassName: 'qlyemqhezeufwelepbwxunktww' WindowName: 'uvjeegllwqrcjvxypxbtrijpsqedjsqsyamotl'
ClassName: 'cvpurjwzulpsrqvuliwxadympyi' WindowName: 'kbugzyhpyxixlzxt'
ClassName: 'fumbxztcxfqpfgidofcnfwb' WindowName: 'gywyiywqzfynepevrirkrrtzbytv'
ClassName: 'dsmxgetbmknkkbrvfbluruzseozxqbmirdrn' WindowName: 'xmxjvrqhrgifhsffk'
ClassName: 'akpkikofpbieabftvvhtuhjs' WindowName: 'qgmvdhaksheoycsmhyaztvyuck'
ClassName: 'wppdpuahutdoeavjkreofpfyqpndjxssprhu' WindowName: 'jzltprvdcdlpkjcxomarfucuvhfnglwvqh'
ClassName: 'bewfppzvctdtsytxvhhnwbmxnvyhs' WindowName: 'xvfbvwgnhwefmgip'
ClassName: 'snfotwzwehocsedenftdrfzewydn' WindowName: 'xgalucjfmseznyjucmebvukyg'
ClassName: 'xcqnfzdlgmcvrwqksefdencqeqrxxjqcphu' WindowName: 'dpfmumkdjbezxnkuvgkwedbyzrxvqanayicaxh'
ClassName: 'rbftvqozvoemqjfdgzvgekbzre' WindowName: 'eloihlilabnxoewzibfdk'