Trojan.StartPage.59425

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsb2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsb2.tmp\System.dll
%TEMP%\nsb2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsb2.tmp\System.dll
%TEMP%\nsb2.tmp\Math.dll
%TEMP%\nsb2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'yytdodbcfivrjchwofryhwqjbslbotqbrsln' WindowName: 'vevktrajhrzcehbe'
ClassName: 'vtohwndttaoborgkyfhwabajvldap' WindowName: 'hodmrizluunplkoagbw'
ClassName: 'lhpkosqssgkrhhkkvfg' WindowName: 'msxtdtywwbulntioacnxmjpuzfvooxp'
ClassName: 'wgbwolwcbhbwtsdiawkn' WindowName: 'kahpkbvfyoqtbpxqbtwobqepjgw'
ClassName: 'izidpnfiynoqhqzxigwauuacuivzefskdeian' WindowName: 'bqttuzzerhfodxljnnooiorjhgwtmnedeq'
ClassName: 'notffgycupxwcpbmpmckvyiovyijakdblvr' WindowName: 'ksmijqwwxctqjnbycg'
ClassName: 'gnhtymijucvctbb' WindowName: 'ypddzlsnxywatrwezcviyaqebvyhynrqxlhfrbm'
ClassName: 'ehhxpkgiwzakupeinaiundpvubstjjaqxgula' WindowName: 'vazzhscvjzvrxaatxlogucz'
ClassName: 'auesvhmqeqtnprmnjpwtpme' WindowName: 'xlrzfemvnhqzongpnacweafxt'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'oymthrafincfeshbjnqticmjjs' WindowName: 'sjpywsrfokdzhuwgpdxgyggicj'
ClassName: 'bycyyplhfuqaqxtwutxeybiuakftvcpwwolto' WindowName: 'famenvnuortwgcorgccujfnbffwprlfoxy'
ClassName: 'hgfpgaohbnaeqegnmoonpnqvmbmqkjloyzwm' WindowName: 'lcbswshotwkljeyacjjhkqmp'
ClassName: 'nskqffvpzholywwd' WindowName: 'jmzzqiadwnlfwlkuyphmovdcriryklwysi'
ClassName: 'lpfpnjqsjtivapywnr' WindowName: 'fcxbrkwtrquozrqhxamwydjdilyshaawoun'
ClassName: 'qkuamosmbplpmbykkubtuabs' WindowName: 'xmgqltsrwyjsndwvwrgxlbdhijdezgn'
ClassName: 'ffqynwxijsunktsbnasmpvh' WindowName: 'ibsyakrhcqturnkxr'
ClassName: 'hijbzbakmromrknychvghjcouocqpsavyuc' WindowName: 'vizcsatzdxfyyzvgchbalsmvlwfk'
ClassName: 'jhxlzapkxwvfpveltcom' WindowName: 'haqezkkzacgydpiw'
ClassName: 'foimvxwcgarmdkjrjd' WindowName: 'hjocqtsaczqcanaulzszlor'
ClassName: 'mmotcjkyojwpngvoyxyzuflwxxjbdtgbfb' WindowName: 'ywiftkatevdedfpcqvepkhxbmxaj'
ClassName: 'slaayqlkznodvcz' WindowName: 'zkfzlpvrrcsabteswoltiidifiufbli'
ClassName: 'xhgbohqeoglrswwhlwwx' WindowName: 'rnbfoffcykzexsss'
ClassName: 'owwjdrkzueczcugtckty' WindowName: 'vgushvkzszjzzygzkyjiaaucvs'
ClassName: 'ygpkjxfroacelqfzunybntowxavbakpjkgug' WindowName: 'psqyigwofoxvamkypglcouefiigdjl'
ClassName: 'jjdqshfqfmtkwejndwlldxosgvqt' WindowName: 'hggwlyqydxgfseymthdmewamzxartopx'
ClassName: 'hkhlimmipkkwugyfpjdolecppnjkhguinrkvxa' WindowName: 'smotxqlkolvtabtvzlkddvpykw'
ClassName: 'imnjxhrzfhhqoyyguugbkd' WindowName: 'eufilzklakduzpsajvujvpvbqjfjt'
ClassName: 'dcvnlsceiniqfqxrila' WindowName: 'ifxlenxnsgosgeijrndw'
ClassName: 'pucsfmzrxrhfyzix' WindowName: 'zmiijrgdttkbjsmrwknopgtwzgxqhcsj'
ClassName: 'xtiggxnyoashaqjxtgbbtronboutqeyqdxdd' WindowName: 'zgqnbgujvcitqibmzjpcxkdvpxnkd'
ClassName: 'cklmqaomuwqepzcbpcaqtuocgdgnziq' WindowName: 'tfcsolchthiouqhbkcvxetyaqgttz'
ClassName: 'zsluzlmidjsaxhnjartzxxkd' WindowName: 'hdejoeudzsmpbmpiboz'
ClassName: 'pfptqsvidbmawgdxgujgnsuwsofx' WindowName: 'kyipdfajfvngndryxwwidweuai'
ClassName: 'symnpxfatbcpqrxgsuvignb' WindowName: 'manmuniwbgzypojefzjdknlvhirxvbsqxhdmal'
ClassName: 'krykoxksvwgnfsqqnzndsnswhygb' WindowName: 'esyuvulgayeuatu'
ClassName: 'lrhgnhntakmksyly' WindowName: 'vvfwiqzctsuxfojcyhzgsomabavsqygmr'
ClassName: 'uzxpxbhalxcbgpfyrkjcvzdlgiuzgavy' WindowName: 'mypdcsurbpzspwplhqvbdtz'
ClassName: 'lqkufzsbvfxtgpwbbvspkkkuitsl' WindowName: 'xhgimektslfqifqnholhycoeeehkhaaxavouy'
ClassName: 'vlwvyillwclzbywcwlghla' WindowName: 'drlcegimmoxylmlhnervxcaskmtjwelz'
ClassName: 'adbulmqwucohvasgeyjinhvmdvoc' WindowName: 'bqcqfcbfamzmjgdbreipf'
ClassName: 'erdcnlsysvnhmwlqgbakhgwwblitpwlsf' WindowName: 'hbsjpqhojujwclbbteolarujpsbb'
ClassName: 'rqnagcrogyerwgybtb' WindowName: 'tgcraeipfptknieqgwkbixkfwrnyoztieece'
ClassName: 'bdducaadrgefhejolpnajluzpm' WindowName: 'qiwfaybdtfaawcushqpakacraoqabalsbu'
ClassName: 'sxobzkvlgueojgshhdw' WindowName: 'dxqkbucsctfagslw'
ClassName: 'rqsfvoclnlchawgvbtxmzzil' WindowName: 'ohjklxrzvbcybgfx'
ClassName: 'prprjmabegagrpzakdfditqj' WindowName: 'nsxxxullitfyxddifwxygxgqf'
ClassName: 'bndodivowdbjscw' WindowName: 'ihvgaafpwbowoqvhgtwoqrzfzpsc'
ClassName: 'lemsoeflacwmcllihrrpuhtvbjoljfzfneb' WindowName: 'rvuuerudaadbxklxmemddtzjwk'
ClassName: 'htnljqwbbtdlxieokxavcvmfzxw' WindowName: 'mykhleaxhkgapdjsgklncyu'
ClassName: 'fhfkdiaoxvsyggbobbwvvmyksqijxkag' WindowName: 'mpmrlrpdepgspcczkiatdfbryjlapoe'
ClassName: 'hddyyghtzmgijcyurqqbijqnucaxncglu' WindowName: 'cuvnikjeyorsftyvmxlroumblbvfgykk'
ClassName: 'ixpdxpwveqluygrbyleycq' WindowName: 'etgrhacyknwgjhfws'
ClassName: 'ynjtoqsdawrtexbxotouhchrjcbadyls' WindowName: 'gptafgtutevbvckzwbkvtsajqplxetivjkxskfl'
ClassName: 'tjhbabfxvgviejmorktnohv' WindowName: 'kfcxhpniqdrgnzylsozafiilzyf'
ClassName: 'kuawznbfsdrkgjlwjpmegqi' WindowName: 'rdacepkuejcamhznpbbgqgkd'
ClassName: 'atqfyyceikmvvxxrmyenmfusi' WindowName: 'cuwjcbnsikojftabtpuekecsnoqbnyywec'
ClassName: 'uqpltayookykptqi' WindowName: 'ybhxqkxatnnrthtemyfufiuwuc'
ClassName: 'rvwrnhlmuzsbsqclywjsiptynvzmli' WindowName: 'qglyhhywsurxsxynpbckbhsptyw'
ClassName: 'bzeunshasaczfgcwxwdojdpyznbyumzemqavf' WindowName: 'muuvrfjcrpkrbfrbqkrj'
ClassName: 'sjvnvjqjebfhajqbijgmveiqag' WindowName: 'sailuhaaaironmcrunkqttzkqsumbtymqaiuos'
ClassName: 'tyorvxzwfxcyhaosbylozqiehvfloeajpop' WindowName: 'glkxvjxrldkzzlqdkbapkdnjotwzirioxz'
ClassName: 'zwjhclvrhdxhgphgvoczdueogfprsiy' WindowName: 'lzyqbopmaquhmblhioswr'
ClassName: 'nodqsolyefzlungougzq' WindowName: 'hcoxzlqhranshadgmsh'