Trojan.StartPage.59429

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsy2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsy2.tmp\System.dll
%TEMP%\nsy2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsy2.tmp\System.dll
%TEMP%\nsy2.tmp\Math.dll
%TEMP%\nsy2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ftbbazkdwyyvzeqhwfvyvj' WindowName: 'dwsftwkohjavsngjykhspvixyhcznjnuuidlx'
ClassName: 'dcgxgxocoynioijpxtsdkoqow' WindowName: 'oqzdkbhxdcqxwsvwtmnza'
ClassName: 'rtqcudvjlgluuzgdfqfaejtpcwyxqm' WindowName: 'jjpepsvrrjnhywp'
ClassName: 'fvcdcpakfmuzssrrxlvowoy' WindowName: 'uspjvzvtuzsndbyrcfdrqsdnuffl'
ClassName: 'kvesjvohemcgvrbtxb' WindowName: 'xjfnhohiehwnkwzdxrukxr'
ClassName: 'irfyxnjrhqucuien' WindowName: 'uhhuorbgjlkngsemcpwsexk'
ClassName: 'ilpmgeyfwmtlrfvfbrlouk' WindowName: 'ktmmehwftdxyamaih'
ClassName: 'ghyqklcsmaowsexoy' WindowName: 'gkclotghuacvppyasmsdliwmhiubkoudtq'
ClassName: 'zovkkbtbgqqqvesznkqlupctrroechk' WindowName: 'qtpeehzitmbjthzmqvagmwoi'
ClassName: 'wqhvsrykcujskujebepaeuivrawoyujc' WindowName: 'rgwotcjrgdxzlnianfystrdyyeip'
ClassName: 'ufxkzjsabufzhqdayuxcizvxxtoqytgaahff' WindowName: 'rwaizofzlgzlgnhqxxebbvxbfrssrqpqvla'
ClassName: 'iwpubsaqdsdugvwgtiebmvyqbjysayoiidq' WindowName: 'vywdbwjgmggstnmhqwmdf'
ClassName: 'cyxkvpqiheszrmeslllemdbttrjsilehxhpg' WindowName: 'afzwzrrqkjdsjdyyialvakiwabbmyena'
ClassName: 'ktunwhpfnmadftkqjwwetws' WindowName: 'ihszpxhvyohnuglcnpbgcvmuupfhoalg'
ClassName: 'uwdvungvspdqccau' WindowName: 'zbyakquuyujwkajvxgakptbogjxmrgrd'
ClassName: 'kirdfkydxpkrzrnksmwzjjogimaowuafqessh' WindowName: 'xkmcihhldhzmmndrbykr'
ClassName: 'mcpjgdsacxmiffqlsspjglxti' WindowName: 'ktrhccpacupqhwgipwjlqdxfciayjhpjeeptrl'
ClassName: 'uzcyccbhslkijuievewsqhxlitvcqbsa' WindowName: 'rlizdvrqmulxjcdantnqkxxhnxnmiwyrzsreivz'
ClassName: 'scylnztlwtpyiogxqbhxznfvshgziajthktc' WindowName: 'gzrpyvwceveyuyndxdsxsae'
ClassName: 'kjpjqoonkuahezaeerbtf' WindowName: 'uxzsmwpotcnatkuvtdwzcxohlzsk'
ClassName: 'hrbbrdgavlxxgbettzhsrajtobau' WindowName: 'vpasxarjrgjlvqoacstvsqwzkuqfaerg'
ClassName: 'kalqhtzryipceqvitbknzecaukfpmeakm' WindowName: 'oosgjqbygcidecbykwcsiiplafuidkkctho'
ClassName: 'blyjyuibgkdcmgcdctrcayrsfezh' WindowName: 'dcewtedagmmlxitjmkvqwjncsleyzwqi'
ClassName: 'bzdsweenxlwhzvczozvfw' WindowName: 'hxzhdffwrpfbqbxlkesbyuywootq'
ClassName: 'rezhieefykqerixchwjfdrbdddukxunqzmpeiy' WindowName: 'vcyaqlxgagabhqakafwmexxeecznwjvbxgrr'
ClassName: 'xcklihvmncjeywflwi' WindowName: 'unrxacpmwjtgpiutiayvyiluwwmdv'
ClassName: 'hkkalwlbisuspgjxadmabatvqtwqskqtiwdlac' WindowName: 'wohvomypiplqktnsamstpzyyjekadf'
ClassName: 'svlufqjfikjbfvclx' WindowName: 'btbxfyzglwhtisrrrkhddmqvdoot'
ClassName: 'zvynyuvxhqvzeaycfg' WindowName: 'xftjosknmpwxpnppqbbmsflmpsgwweyejprfs'
ClassName: 'hgfnyvjcnqjpcnqijsdpxuwzafpzzbnppxmjedz' WindowName: 'yzjbvbzaggczvcdstgysdm'
ClassName: 'dtfaamojullcqoaeqxezmmk' WindowName: 'biwwasrrszygadxalzolkjlaenqefqwbj'
ClassName: 'nwgjhhcgxytjwrduamrnjgognnmrdh' WindowName: 'wqhiimydolcixmrtvx'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'urkblzsblhylqkosiyeseyujpxhsxu' WindowName: 'axfqsgkaotekrcpoqamtfxlxdbiwuhtmhrbubk'
ClassName: 'roybxevskjmplaczivuynhwke' WindowName: 'cpyrkmwyohygvmftno'
ClassName: 'vbnivafzzyqrshgcnsqjirguawxdaty' WindowName: 'qdtueuimzuerncamecqwrrsdmxjpzsgdxjurue'
ClassName: 'cwxvuwbmjczjtrisjqrhiaelbgccaei' WindowName: 'iqjjbholcuffjeeitjvtufom'
ClassName: 'juqubmbtonlflxwgg' WindowName: 'evpldlqibnefidpusgliseqijsyhkwl'
ClassName: 'smhlwlhbdqetlupza' WindowName: 'ahncojkhrwpusezpijdykgaiyjhjpsycu'
ClassName: 'qcgtzxuyfmrsnjnwefhlkkvuzsssdlj' WindowName: 'ctxhdccwjeoqgtvkpckswaguot'
ClassName: 'fttsfrofzyjhccqhylzexztslcnvuwdfkjza' WindowName: 'vwumfejghmxjdjdmrtrgfazmgyd'
ClassName: 'marbwfkmjojlpfdlcrdakcthr' WindowName: 'nbxvqzrxydpwhlcytuwecbmvjqtlfobahink'
ClassName: 'cogqdhroxeuzkehbzudmacpvsbpns' WindowName: 'bufycgraxzxukjeioexkr'
ClassName: 'qmtlaoddrhlldgfetuiafnheljdhki' WindowName: 'trsndwxkrmlvzthrwdxytfokbxpbi'
ClassName: 'qanthfysyhwtptubfrpurrxnuhxcpwjqvebh' WindowName: 'qqigvrdwfkbhsqblqpu'
ClassName: 'izkerglzlfmuxgrpqqaaerbquoclbtbmu' WindowName: 'aeoxeibrrxoamzofpnpcseopqvhay'
ClassName: 'iyvxgkymyrleghhzjspfffctew' WindowName: 'gddjsdqrtrufyjrq'
ClassName: 'vjwbaspffnfmusxdnryhygryykpnspfsypyelou' WindowName: 'nejnkbovulmxydgrkoollyasenlokp'
ClassName: 'zydfqifftnnjnqza' WindowName: 'inpubjlaviqetlmdiexymastwoguxantspc'
ClassName: 'escyfwxpycbywbv' WindowName: 'cntqbdsdoxfbgogsfulipoeydqfosq'
ClassName: 'rhowsrigrbmqeomzkjvqpgyvnu' WindowName: 'kxiohcdbkfuttoaqqauxcy'
ClassName: 'xcsmxoxjqfopkpjnirangousil' WindowName: 'rbxwlfhlghktipgzzmeiuycheproqzbik'
ClassName: 'qzhurpiufdwbbzqpgebgocfdvwlxrauysrd' WindowName: 'nctdubzhgzlspkggqfpbvwatkqjssbehd'
ClassName: 'ykihvttsxuglkaqwrskb' WindowName: 'kocmrqxxwdwyduekbgqyeuemeydtg'
ClassName: 'vfuezdmmiymhhot' WindowName: 'esecwfcezflrruhysckkkrqyxemnrodkixjffc'
ClassName: 'adayunouendmnxivyibdgciuiu' WindowName: 'eafapzuyrgrglkrjgnafffxsjotjeyrnhqkixx'
ClassName: 'wsgoryexrjsobccgubpmiuokzvzsuzchuisftn' WindowName: 'ptkxjbjdktbhkxxrbsyqw'
ClassName: 'tkkmfmsfcnjstgrbcjvildmmnmtfdfofm' WindowName: 'fsorjxwpnnqwsvocobyok'
ClassName: 'dbkduktznlmrteax' WindowName: 'uxsuorpwtowaoejjuuzlqdbnr'
ClassName: 'kixqblylezefknktgwqdybylwzfswnsbd' WindowName: 'zjohsrsyulhoppzzcdea'
ClassName: 'trnvwvsidvvbvojzgythxm' WindowName: 'qhbyclemqcekwrppksobafamhbtpnxmlppdf'
ClassName: 'jontnptdytuaervffdpsam' WindowName: 'aamgxwgynqguyrkqqosesxfhb'
ClassName: 'cglppzionycsqlxzwebvzi' WindowName: 'rrzabmbfhjzptrhwfhnsjiyvyberwhbxbsr'
ClassName: 'vicrskumwzvejhiyymoqwbebckhiyqfqjyyiig' WindowName: 'kmjyxxgwadkswlmjlymkkdrnqnipagitlue'
ClassName: 'ipxhzxerkitjacxvop' WindowName: 'hhnfdpnelinuwjtdtibtrskfiqlyzghwzfcgnp'