Trojan.StartPage.59417

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Desktop\Internet Hao123nknk

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'jukesvlllyvmqhvlwurcfulmnaskcp' WindowName: 'dfanxqtpbfmvknhjlv'
ClassName: 'qdkbfbpwesinkiroseqogkqgazdkjiqevhxlgao' WindowName: 'tmfkgtuzatsvmlflawteocmgoxdsbosbfy'
ClassName: 'fmdpwnnmqtinebapalukhfdijopwrsllj' WindowName: 'bxqukencsixerwszrsqvnfbzfupcqdywo'
ClassName: 'nvqfmofoecptqurblqzcrwdkjpflnfn' WindowName: 'nzitdukllpljuqkdvfaazihtcaeaswsvq'
ClassName: 'bvdbuhbnmapqggefxcqrjxze' WindowName: 'guegcbymyhtfbigzughsdxl'
ClassName: 'tgnmeintczkrpbzgsxcnrxoy' WindowName: 'txkssoseoruaakjafuraqdxkjvoeptevt'
ClassName: 'rcbcmdkaqiwxwegyzcappbn' WindowName: 'hsqkjjboqcuubnvtnnmtexmqfl'
ClassName: 'fyuguyzexwffyzhlpshsuhhn' WindowName: 'oiiovsxutgkbeszbslztjllgrdzgdhmse'
ClassName: 'tdhxnkpxvlkvklozccyakqicx' WindowName: 'bjoezujdakvcdrlrdc'
ClassName: 'sntrfkcyttmtznsagomstbfucutfsknhhh' WindowName: 'nnseqsyyzckdokeskmofaveckkelbsnsbtth'
ClassName: 'htdxqojdebhwgzqdyymmkcmqhou' WindowName: 'uxffdbzgelcgahnrmqyrfujbcc'
ClassName: 'ivxhwgvtyftdsviqgjxttnutc' WindowName: 'aqgfgdotnsyhigrptroyaypmlkh'
ClassName: 'wrdqtbtcseqoguhlgplfhadkuhicfkyoeha' WindowName: 'ipfbzckzjvqfmiubm'
ClassName: 'lbisxqwhknnkibwbqdwheeytyyrwfkvcmeqcu' WindowName: 'dyhrfhuksmiahwawkshm'
ClassName: 'ynizgquqkfwgxqsivexzfmjdangkosytfzzzb' WindowName: 'xjnbxolujauzxzhzvnpcwnmmeaquwowguf'
ClassName: 'echtdjfphnhqziwredopavxowvh' WindowName: 'uncgnkosgpdjkhtacgijamvykswboehjmyd'
ClassName: 'tcufbkuthcvttzmtqpupil' WindowName: 'nrwopgrljajoykvxovdryhuevooerwqqsmziegy'
ClassName: 'iijuixzntrzjzylwkyjptmgemmrmpscyalfbm' WindowName: 'ejeouarmmatijesqhozuamzig'
ClassName: 'cnpmpedcxqexnrfzty' WindowName: 'yxihqohaywfovkvvtnuuxjopbeinqinqtebxnu'
ClassName: 'rkdffmbfbpknqqxnjjymuyk' WindowName: 'kxaootomhgaucrnrrwushclmpscmn'
ClassName: 'axljocyvnhnpmdhzeyxpxcfzbvpir' WindowName: 'tabznitdmjfuqzthevrjvdzlvzpk'
ClassName: 'tvzvqiafgzitqbmxikyqc' WindowName: 'codjqhksalssgqvmxbxhavzvszczhopwe'
ClassName: 'govllwlldbyzjbqdcobuzfybozeudjin' WindowName: 'nthqvwbfhrwaxykrwlsnyathbuoqg'
ClassName: 'dnyapewbkypbzuwlzorrklpxqwosuqkn' WindowName: 'dhtelzhccbazyzyyqlepqfvehxghyxpxdnlrp'
ClassName: 'kvtzvcqbmnhtktvkpchumxezrduhtnjlzy' WindowName: 'lwisdbuagufjggbkvulhhhtgdjchlnpcu'
ClassName: 'stcinwgzxpojqosikuhicgl' WindowName: 'qcasdvgcjaldgnvbsfg'
ClassName: 'khaofxebxhtfzzxtzzqhhzdnihbespt' WindowName: 'pxiqcmeygjyliqlgfe'
ClassName: 'hufjnywbslfgpbujluturmckzasjnoeuyqokzh' WindowName: 'kxqmtdhdezxcgacpimofficdfajbguvsu'
ClassName: 'ugileszvwoyjmzlmolmfawqrffixudh' WindowName: 'uchugdfobidhbekgsdflumlsu'
ClassName: 'qltbcxfnblkryyjuxaqpjykhejzqddapyfqh' WindowName: 'bikkuhabjeevtiraa'
ClassName: 'syzevuuzjvutpjdobcar' WindowName: 'ttbpnvaayeeecgjvvpeoeeemyrawjgbhlxxvf'
ClassName: 'wizmakcrcfxcdxgtlwxvrfyawqcnzdqwdyrbeqq' WindowName: 'vlrrypwcqzzclmqrannvpkwujlbiuurvy'
ClassName: 'vovyvdvbtxbfgzeauoy' WindowName: 'ourjsimyjqlfbmbwa'
ClassName: 'zttkylbxxhmvyuhxnvzxgme' WindowName: 'dlkuvphexfnynippua'
ClassName: 'nnwsihyleobtfwmwrihijgahlpmbbc' WindowName: 'tvfbjrryzuunusvdrkppqyemapgddpmoqtagn'
ClassName: 'lbekixwprpxsjfhdywulbblsl' WindowName: 'ydrjaxsjxtsvqgkwrshbanjqrkieuiwrw'
ClassName: 'vgidtdusldmfuts' WindowName: 'ivjagicpxcvfkjrtzuqtxz'
ClassName: 'rexhbicnrpvnpofawtlkpmhpvemmqkgdmvyya' WindowName: 'aucwkzehgivvmcvuzlabkivfj'
ClassName: 'aojehpvboublacjqonrdlpezagveixv' WindowName: 'scywbmcvbuihtbbcfmpysgiv'
ClassName: 'kghebdjgsejushwckzjeqyyuyculmghxma' WindowName: 'ovqwooivisgoqwsnpktehmcxlprwk'
ClassName: 'fhspbhtjfciimbut' WindowName: 'kbkswwptcppkgbygja'
ClassName: 'hymtvhmntlbbythwmruscjynmcewhwsrbyod' WindowName: 'cddzpwxcobujwlru'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'ldeiesmzbwxmnjpurgbcwm' WindowName: 'nuytiwrbvnukqidnapogcfukfesmylceueuqkir'
ClassName: 'eioaknmlviqqdvfc' WindowName: 'dokkakrxquiphqueud'
ClassName: 'gtnntjdltsyiegximcqvcpjxqstyyptuszyod' WindowName: 'dcrszbrsdmlcbegunmcyspnf'
ClassName: 'nfllrnqtecganep' WindowName: 'fondiyiutbhdzoivp'
ClassName: 'usldbxvvgyedaebnvjfmfdulmjjmagybjbghou' WindowName: 'ybzwkeirtagiviionkqwqsxovbtemu'
ClassName: 'dvafsxutwfbsochqjfdyozzydnlkkjnhjybod' WindowName: 'akcnbdlbbgpsryfvsb'
ClassName: 'oqgbgvgusanzogwuywhcinqwwxkmsbrs' WindowName: 'xssibchcrealraplwvxy'
ClassName: 'jzsgkwqgawpxvyvjcynem' WindowName: 'qozbhgtvqkulzzatilaiacoashczeanigaq'
ClassName: 'qceumvmjllbrlndjgmzqqfuzfyhx' WindowName: 'dzfefrsnckbhhwpuikkrsojhaa'
ClassName: 'qfxsixtgfjztenujkltfjsmvpxnyv' WindowName: 'qwbpymnzeebuiigdjpnlue'
ClassName: 'hwaihoqpovpcuyppybwgflvrgqs' WindowName: 'yjwwpmbgibhrhydcrxjoznelpacyjsespsmortg'
ClassName: 'istdwytzcnsazidy' WindowName: 'yiqnbnmyetlbxhm'
ClassName: 'xnogdcckjflsjczuwprsichbpthk' WindowName: 'mgcmvatcgdpbhidlmmxuekywtqkhiqny'