Trojan.StartPage.59422

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsg2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsg2.tmp\System.dll
%TEMP%\nsg2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsg2.tmp\System.dll
%TEMP%\nsg2.tmp\Math.dll
%TEMP%\nsg2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'pklhhwdiqjvdypcffonabli' WindowName: 'imyiibmjrcdsqxsgpddlmikmnxy'
ClassName: 'kqlkmoaxyrweyjvwbjluusbecfkeiudblqq' WindowName: 'hynyyogfleienopdusnldwfdsrfnbotmyijynno'
ClassName: 'krrvrxojjwuauyivrjreqf' WindowName: 'suchdgeffoisgkburdcpowh'
ClassName: 'yurykqxuoffdumzcfxqqnmloxpwkvm' WindowName: 'mplenkzeckejrlfspuzyztebyivcopunwslij'
ClassName: 'pmpinzwgsniuttadniaxp' WindowName: 'ixqsymptztqdwvfgatfsqmevhbpzpgupshswy'
ClassName: 'fmoixdaqprjhmulmkvismiysifdwsiwxnom' WindowName: 'znwmrfwjxtutcvnovpkbafdtvfp'
ClassName: 'txeuwpvnxwhtpxuffsbclejpvfbcszvwcxdybb' WindowName: 'rqcbxgflasaqghlgxlmpgnjivdoxrtbdcx'
ClassName: 'mrjbqjpvkndzyhtffaac' WindowName: 'fbonygvvffuhdyjxyirhprmxsalngh'
ClassName: 'qfxywxyyaczsprkwpxkslgsctfetddaixawchoi' WindowName: 'rcxbvdvcrpfzcyl'
ClassName: 'vspbfnztmydfbalqcjihw' WindowName: 'riolypdvshbiohztpbelhu'
ClassName: 'klftmpoumnmsxdx' WindowName: 'zzmerztzflghoslqdewej'
ClassName: 'kzitrroasbdcuyelfgivvzvwsdvd' WindowName: 'rfnusdnfwafsgoaafolyqzlestlhliaqbzsjfkg'
ClassName: 'chetdxhcmcepacoqinglulejnarynlf' WindowName: 'xvwzubjayrnsmbqkvk'
ClassName: 'mxpbhyboswvjzhrjqyktkxx' WindowName: 'jjcvfgsukayekjeimdqfvwhmmbm'
ClassName: 'giakizprwitkuszcxeabrwofhdilhh' WindowName: 'lfokggnjolotcwnqsr'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'irvlprxgsluhaeuxlsvmoyfrjmyrgxtl' WindowName: 'rdozfcbfrczqnetmekiwpve'
ClassName: 'zjmxjhgeymlibfslxy' WindowName: 'expwlkwvvmfyuzhrssndj'
ClassName: 'ogusfuczolwydavr' WindowName: 'vchzymqurcayytoaacngg'
ClassName: 'lerercxjurqivlgfbvqnjyfodzabuhag' WindowName: 'yxmbwgudpjpwupcqudfvnoek'
ClassName: 'txhoqxabpdbhmamklatg' WindowName: 'qfrgyolalkxnswlb'
ClassName: 'pfubtplqlklpluxiistddtyvu' WindowName: 'qrdlxhzuonwdsaz'
ClassName: 'wzkgzkegdvcixtjyfqnuglyvgagbjfzaj' WindowName: 'gyarywqbxyqyrzj'
ClassName: 'fntkbmbkqdlsqmzdqdpzgvav' WindowName: 'vkcxjyxutzdphlrlgsqzcx'
ClassName: 'noaualknumccvvfkxdksiggjlrhjaurzwr' WindowName: 'vyhkmzbanoznwyzwivljmumvreyxtm'
ClassName: 'wxawnbknvrdnhgofrgrcxtpteunihcgrc' WindowName: 'dtedrbaeumrzwirsfkhsynnprzx'
ClassName: 'szrimmtojymvjbfmcpbenlzzraujrkxcrojgx' WindowName: 'njhnyvyuprtuzotewmixyjusngt'
ClassName: 'ofczsbywvishilhlocck' WindowName: 'btznncjcbpxidvik'
ClassName: 'nymchdmleajvfbjz' WindowName: 'mpnjizyeprxolceeeuojtuuqhrngdkgzbfj'
ClassName: 'ixzindqslcjmajogcomamrmgml' WindowName: 'iwetdouvywfahawzjoqnvvf'
ClassName: 'efzcyzuznthhiqocmxyjltcfdfymdsniie' WindowName: 'hmyoiyffuvfhtsyryr'
ClassName: 'ngxicgcfasudnngojuvpdfnxaqgyagzshvntzhw' WindowName: 'bjuwugpbyggvwnes'
ClassName: 'rirjdxkmxqfbqlju' WindowName: 'iklbrkjdbvcbnnflikeuiuxcqkyi'
ClassName: 'ehbeywvefgutbmsuiwbbb' WindowName: 'zgqfbeuricttglqbojfzvp'
ClassName: 'djtyjzklmmcounizsfn' WindowName: 'eqpdfwsiyufhfgabxvhzwcsolzav'
ClassName: 'iwlwpuevdsleslxlwnalqevvsnwiy' WindowName: 'tpxummqoxwqcsofliaulupdhmyo'
ClassName: 'nqnshsmawmwnvzpwqer' WindowName: 'gewmocpsdscjyzdbgltfixelucitecaytimfh'
ClassName: 'buavgyayelpiblahhrzt' WindowName: 'guprqqtfskgrlwebcoxtjkgzizrendgw'
ClassName: 'cgsnohnmhzleqvfwqklnrashhlbugrof' WindowName: 'ewhwsdnwfdxybrccgduzm'
ClassName: 'pszlsupiyueeibaqfweowltxaicxc' WindowName: 'qufgcacruidklwnnzadvzfmqjeiu'
ClassName: 'odbvhjqvifasaxcriwiqucjckeswpcocabsfj' WindowName: 'wwdbsgukmfdcctbndga'
ClassName: 'sqgmebawrjifkarzzpxufoyavurctmdpjlmebs' WindowName: 'xzqcrfbfxuozlhjogsgtaeaxrkgp'
ClassName: 'lshshcorsinipyoruaqgjefboiixlqqo' WindowName: 'syeoqzauhzyxjytjfabiiabljzc'
ClassName: 'snrqvdvqdulxjhwoqbbqo' WindowName: 'jygqwfdntpsnjjayxupiqleqfjpwkmahqbtb'
ClassName: 'jppqiqgqbbcbfhjxegijhnufpxqwzol' WindowName: 'ybsdeohcwkkkftub'
ClassName: 'wtqtarrabqcfwxv' WindowName: 'xsmnapmgqhajrlvmijtcylzeaumwrecwtb'
ClassName: 'pmeumrnvbwbtyvucyif' WindowName: 'yvcllqbzvafimabvchxiqhxxxiigd'
ClassName: 'jltzxsrpetyyhxfyxnhrwkbmjjqwvgaqfyka' WindowName: 'cvcclysbhfcglprogsjqwyevkxirmgflzflq'
ClassName: 'raruvkzonttjrrljiumlyhnjhxmnfamkrm' WindowName: 'bgjkmakymvamwnrgdxqbigahbnwgv'
ClassName: 'nlajeoravnudhusufyhvzbghchpnmsfe' WindowName: 'mlkgtavtqcqnafrcjuvaeqszrkyyzowrkpwols'
ClassName: 'snqmpcuishdhlbyuuloatjarrwikeb' WindowName: 'omlmgzocoyvaykqlyvbujlplbecwwkbtzgyjfzq'
ClassName: 'dpdnhyfupjqvwzajegent' WindowName: 'yuwpeqvgswkhwygavqsmrszvsorez'
ClassName: 'ljutnauhjudgcblchomuepisqqiztniur' WindowName: 'kziynvovazzwgnaot'
ClassName: 'wodqdbguawepwgfdwjbb' WindowName: 'htrstjavlepmfdjejkikieylwlzowqlu'
ClassName: 'memjphrvxkdwgcwlsgofqotunvbhjrai' WindowName: 'kaubxghsdzsrathlmkmikyesbhaddqosfnpogza'
ClassName: 'iwukfnxdnixseil' WindowName: 'vyuhfqqjjeiqujguyh'
ClassName: 'loommhztadfimhucrp' WindowName: 'parekjrzcbfvczuusyvnohsop'
ClassName: 'oaxgpxtsyrnhfxvoxirsyiukdudp' WindowName: 'ldyxasrlfewnkdzgihrrfqjdktubsxxisycteu'
ClassName: 'zhyqxypyngfocafztrtyplw' WindowName: 'btprfsohshareljkdtkrqxcofzmxejap'
ClassName: 'gnenecxerdcxsdprcmovbaersnrvjmsb' WindowName: 'xqlkqbrugmdnwnzoophbqabrzjqtls'
ClassName: 'vddzltjchywjpalplgmeawsxyxv' WindowName: 'qqepdexvjnkfypphdjddkhvpoibgzopr'
ClassName: 'yabzhmzqmbpzwxwktlpbdqd' WindowName: 'rwtwmfodwfwfiwxmgqeodvmfqr'
ClassName: 'xfunxnxosltqanlpm' WindowName: 'kmdroflrtlnphqiweghsoauftqergmthwrjvg'
ClassName: 'gguxkokdbwscfcahfwyaxbaylfbi' WindowName: 'ghrtwnfescounserzwaxugcsckvhyvxyhpc'
ClassName: 'wwzuzlpgwccmnvusqgslmekzbmtvzbbc' WindowName: 'veuiowtgaaitaeunvwwalkktr'