Trojan.StartPage.59419

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsv2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll
%TEMP%\nsv2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'kmwzrdpedxiuqissregtahkvrtuw' WindowName: 'llgujhzpueowfluxqkcqzueajwchnawtrblfp'
ClassName: 'whkmtigjfhsafzayi' WindowName: 'pgovvqootybsgwgubcoat'
ClassName: 'voybliwgpvlkviapjylhldccwlqqjhz' WindowName: 'igkgnggtkhkbvnuockvwjxyaujzy'
ClassName: 'gbtjdgsbjkyeaqedqzcqjyyimfqakd' WindowName: 'vxuymnoebkphywsmo'
ClassName: 'gkizatbqddvrphnlz' WindowName: 'gqxlpdmpqjnaiwnjginrhlqnxsnqothfkambj'
ClassName: 'pdpjuoglknyqcpsbhasmw' WindowName: 'jaoaadcsjgfccjxrhcdyd'
ClassName: 'pfyllvauboyxbgilelepcwarazr' WindowName: 'qfypeuktztfhahjvldaocwsucoqnkpc'
ClassName: 'mtyhemldnwtaywjojdj' WindowName: 'hlbbxjauqukoqandayjnwrmwgceq'
ClassName: 'ssxdawbfsjqpaiycbbpyrxigrnxg' WindowName: 'tfrnmiunebehgytiyr'
ClassName: 'uriugzqhvzpryrvqabdb' WindowName: 'jroenuoonmkhhnqpctfpwqyngjdgameng'
ClassName: 'sgmfgcogiggdgoljsxgwuele' WindowName: 'lmqmaljfmiranfojsgmzlhaviayie'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'bimkmqpjvbawntqkvbyhdyynrqeiojmh' WindowName: 'ypuixpxuzbpszhzilwuzlmaujydab'
ClassName: 'csbfopazswewnlqhowbxsmaiblcsay' WindowName: 'ecsemdiqwqbzdnjyg'
ClassName: 'eqjwcptnphoxkdqfdaorswuutfdjcxflrfvko' WindowName: 'kqtdltbceandnpmdud'
ClassName: 'pywbtizmhulksgsswuevyymoyp' WindowName: 'hoykcrdqrqarhardurnfon'
ClassName: 'uwmwxbhshwbnrkigxjheticbptsyiiv' WindowName: 'oyuvejecdyzsrhbxbzvlshiszmqvimjylc'
ClassName: 'juftpngyzhncfxkzvsgmzqcvpe' WindowName: 'nktqfbauidrutxbbxjtgdfvzukdqft'
ClassName: 'pfyhtkytboabqhclwlwcbfeoonarmvll' WindowName: 'jbmmtammwuakebcchek'
ClassName: 'xuxcauibjyrpoiwcwamlddertkmieljvjxbter' WindowName: 'jzytenclgwnnhrjgfxucgmo'
ClassName: 'rhlkxkirdvgdukw' WindowName: 'nvxcxzfksnnkfjimcctgojientzqyyeuyos'
ClassName: 'qdjvfkynzlgjsuwxm' WindowName: 'ztrioguyxperdgeodjlrkllefrstbuqaqztmuk'
ClassName: 'pfjucttswaxstqemcodega' WindowName: 'rkefovatrnncatqimzdooccrrgl'
ClassName: 'zyuhfdborjgupbqamxaxuse' WindowName: 'tjuasqgkdihmwtxadwqtaotyuizibiwkcsxoz'
ClassName: 'vstbeujkwyjsplquddzitylarwrju' WindowName: 'gsauagdmorjwhfoevmuucgeoocsbxspyiakxt'
ClassName: 'pbvrckonezhfknpjaltwogxgcvzmabh' WindowName: 'tlobtfbiptygdygtlqugxlufovtixbg'
ClassName: 'zedxesvyonijqtoqfxbbnbmomcbqvlcplno' WindowName: 'qoxswawzhvjczsxqajfokveq'
ClassName: 'xiznsncsdrhqrklndplcclajvbjfgddvv' WindowName: 'jeabrkphoukbdcredcuqcnmxjgzfwcavlfbnl'
ClassName: 'qgideoesafpodjgyqhricbr' WindowName: 'xfiyvpfdhkigdgljfcpzv'
ClassName: 'vouxzrknecmzbehjzeiggi' WindowName: 'prztuhsvxuhbdbnnpmbghwohyzxzqeav'
ClassName: 'pajlwwjcpshhtxoduhkdtxmipdmqnbs' WindowName: 'vxiujvnqctemcqbrz'
ClassName: 'ncbqlmzvawzdihlqjpg' WindowName: 'rbjwfmzenevvwmftstrgf'
ClassName: 'pftwqkvnnjhhetfkjvgyhdzpqcl' WindowName: 'gqkyeunisvcorubyxkndyizletzjegcoqaaarke'
ClassName: 'nijkiscvjajphkpskzgmrcxksdkxzi' WindowName: 'suaetxzzuigjpmuohmwjuu'
ClassName: 'uhcntcyszuymzudncfbahldntpe' WindowName: 'dmddylbsxucpmqmvyaovrriuiogjhreutymouzz'
ClassName: 'qsuqgxfnrpadiebfztuocaffbxcsnvaxsrgjhkp' WindowName: 'ryrogdugcrprtvtfbfxh'
ClassName: 'fennxpvatygshixatszstmeruzmchru' WindowName: 'fvmlyvqvzllfzpezlu'
ClassName: 'uwslbshobkdgejukesbyaxdbggwyti' WindowName: 'qirfuulwizevkuwnpveqkeykt'
ClassName: 'cmlwpzduluiabixyitq' WindowName: 'rkwctiopiorgnrdacxqgpklxbat'
ClassName: 'kuvvuunacacavdxpkjougzhfaypvdprnylk' WindowName: 'zeumjrbwrnfbprdjwraeyxtzc'
ClassName: 'holmpccwseaszbnedzzxzaqbnczoblaatr' WindowName: 'fexicusdsgehmukfvzoopepobkmyjajazvqltkr'
ClassName: 'jwfijrxlncikocgpqyfesau' WindowName: 'wiljldgcymiiahmjyrcrvunbyx'
ClassName: 'fsiafbflaaiaoaqxieczbrdh' WindowName: 'yklozhdxbiajalnvnebuxuylxyqcioj'
ClassName: 'uretjnmgxtsgxhzxoufnqqagpqmhiwuvdnyk' WindowName: 'afgxijqitwqujogxxepcrq'
ClassName: 'shnxerqilppicjbmrcuauxmuum' WindowName: 'zfqlzpymrrdlcozxgspbwvkcrneblhdh'
ClassName: 'leghkyerabsbacexfscnkqwqzbjusuwxhnpmv' WindowName: 'ikkmiljgberlybuctr'
ClassName: 'jpaaexhecwhiukxo' WindowName: 'vtmapdmbacufaqh'
ClassName: 'geaxzwdebwyuomucoevnrkatgbdzbj' WindowName: 'lsgrpyhtbofvvyiqqbfrdjsivgzsgdmrbsm'
ClassName: 'ftmpwkkuhyhjquppygijhjnfnijigcodwrku' WindowName: 'rjnahfiuzoznoydxoftmvkldetltngexnim'
ClassName: 'bblfkpovkzrofuxqhpocyhsmpgthe' WindowName: 'bjgiqnyumbgpisysstrl'
ClassName: 'monrpzesulzesxkisfsdnaycow' WindowName: 'hvkfnsruwizveckwqghwcloft'
ClassName: 'sfknqysddsnsziplpptswbu' WindowName: 'sdgyrkmndtqztttyvjbmgxu'
ClassName: 'gevrhtvwqfoalmdzqkwbwocxfkxfewvmk' WindowName: 'fskmwzgxcflaronivdqcnxqspocsqxtan'
ClassName: 'egrujugtwcbybohlpiicjrbwqqdqhtg' WindowName: 'dngwxxslcnsyjaj'
ClassName: 'prabndyssscpfpxbzdrmoq' WindowName: 'auqrqiiehvdupfmzlydmknj'
ClassName: 'gzyojcinpsfzdetqjgd' WindowName: 'iiefledzzbmfibwbdoykpj'
ClassName: 'dledcijwohdexndgygkeukbbhkihql' WindowName: 'epncnxzhmhxbehjjyepmukapmbxzdsl'
ClassName: 'znkgoniuthbdexrxsit' WindowName: 'abxmumrablpobcvkfceejtqiniyxkejdvy'
ClassName: 'rnuktlryvfphdkmplbjckkmbfzk' WindowName: 'issvxprnnnrjwnzsjwmfmlvxtdcorupxpove'
ClassName: 'zuymmovrmaemifngetaqlransrrkinl' WindowName: 'lcdyuajvnqevoqphebdmnpwcrc'
ClassName: 'ossmydljtnjyrsxdtickyctzwihgjlvkcpoeqbp' WindowName: 'jjdrsbxuiawzftnjtzwavvkyimoztsf'
ClassName: 'zwshyrlgscfuaxjufeeihki' WindowName: 'uphhijfgougegydavusartk'
ClassName: 'kjeuenqrhkadujhjmgxehvohmxnblwkmitpngy' WindowName: 'vsdjelcekxokkuuesrlplobzcwm'
ClassName: 'autoptsaokmzkpfbxtfqovfmmvrqzsfnqwbprcq' WindowName: 'jgjztpenapoiqeytimbjegbtkbztxsviqiwvm'
ClassName: 'loikhlwhxirmmlooidjn' WindowName: 'eztayldryvebosrpxfvwf'
ClassName: 'ehblswdqkdjkidurgwrqmdlnorcyteteeyjid' WindowName: 'ybdrrcwvoiijisedj'
ClassName: 'tvxchqitmeqeeyixdiqbkw' WindowName: 'asrjyzzjcuxaiduyplhozsscl'