Trojan.StartPage.59433

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsp2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsp2.tmp\System.dll
%TEMP%\nsp2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsp2.tmp\System.dll
%TEMP%\nsp2.tmp\Math.dll
%TEMP%\nsp2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'noblxeeruizayzospigdjaonhvehdg' WindowName: 'cuiebudkrcznttgd'
ClassName: 'nuisxyekinxcahtjwbbumlficekhfstror' WindowName: 'msckuveyjancnqaxyvfukaopi'
ClassName: 'yoiwrkrehoeyvnbkbmisornczwpnvuftjqyo' WindowName: 'jtwkcgbigaxmaswgytnapcpznzvm'
ClassName: 'ufwstpeehoshorctlchvxefrylpfqadtp' WindowName: 'bstswkizeztlrqildmhbchleqwtemaawrk'
ClassName: 'wjfvstrqcexzeprgdselnagrj' WindowName: 'wxsqzleozcutpxnhmery'
ClassName: 'pkcrtfiqkzjhzayrbsh' WindowName: 'ipqnozhxwoxvohqalqivzbxrnwuvhh'
ClassName: 'jbzlyxbblfkzbfqetqdsxna' WindowName: 'vmsvuhqsaenybegmoodub'
ClassName: 'ocnptpksggdgvyhoykvi' WindowName: 'pkdkaxzmtqchovgmww'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'ruglzqnzqsxvdawafvsplltzzdbykxevpdtqwey' WindowName: 'wvfijnedqwnbqfqlgxmwhorvixckzlda'
ClassName: 'ujrxahixxevepkabvtjihy' WindowName: 'xxgduwmmoccnnvdfzpeidjwis'
ClassName: 'tchuixsjicwzemlprrmptejlrthvhqihlcy' WindowName: 'tlveoxxbolznexzzehsiaehakwocvmnniycff'
ClassName: 'hnyeiqovpehrpqihiwx' WindowName: 'yowvviwvygjpaygjnyoac'
ClassName: 'skqhhpobehcmqzpzshpmozwxtbxpcrd' WindowName: 'khqhhnpezysnvieoxnnh'
ClassName: 'lwjkgurkcocacvrhrbugufcywrirxn' WindowName: 'tnxhcexuszfkialwdpeaslucosodsot'
ClassName: 'yzawzaqnruxqbwnuxbjgkssacaqkedptphbwlsa' WindowName: 'ydeiwidkxxqgqaopjgep'
ClassName: 'llvjlyuyodqgsddkwzssobhsiuwnxkziameo' WindowName: 'ruprhwarbbxdmwuolxslr'
ClassName: 'qrgvywugdtpvbvnrfdm' WindowName: 'ipjdsfwwsvuqaqplgmrmuamwyybs'
ClassName: 'zoaeoddrycqpegrugbvikmfgxxytxq' WindowName: 'zoeitltfkejksnwgyg'
ClassName: 'ulpsnwgcjtjnwrfuvvlrvjjtuhonuyo' WindowName: 'ltyxwfdlbggyxphkhepghtlwxzrhhblidzyfvy'
ClassName: 'mobgtddaekvdcxpdavchtscn' WindowName: 'fupazdwakgvekxdhwxj'
ClassName: 'vlbflbhpspvyvlvjejsqyjqruaxuvdvupcc' WindowName: 'jboavsbrofoehzfxxbgaxxnuaqfzosz'
ClassName: 'auxmtnwbazxdfagzpjzqqvbxujsyr' WindowName: 'vjcqgctrokcbodi'
ClassName: 'dskucsmvsjyzqxmwsknphthscu' WindowName: 'tocfiksxgewpigypnimguw'
ClassName: 'bejvecailpusmugtrotedqmeotumb' WindowName: 'aqjcxtrbmzztwqzatll'
ClassName: 'gikutjyspqoirpynvbknvbsgptj' WindowName: 'betjcpbpwqbbloohccebpdhvuqenjnwtpq'
ClassName: 'seqhwmlzgyxryuzqetgjgvtiiaxeymltcpu' WindowName: 'ykarkcfpvmyknvn'
ClassName: 'tzyvxwtftgtydeffmvevxx' WindowName: 'lzouiugrynioukyomxhn'
ClassName: 'waqibiyaxabsmwcujdiqiqd' WindowName: 'jjzccjkyjjqsfbaak'
ClassName: 'tzewgyucrtvjrxowlvdyyjulhontoskmrsiopg' WindowName: 'wbewtahnnbacaqiidvillakflwivhbfbwb'
ClassName: 'uxcmascvpdmugwbinw' WindowName: 'lyljbswscvibtlyrjowjkvzf'
ClassName: 'lnmjnruxokzquygoannbofgescbstn' WindowName: 'tpecvfrstzoxqga'
ClassName: 'dcgemmsntuucfidbrjjoyazpjfjzks' WindowName: 'omrgplulvixiymdafyqtgvyqcc'
ClassName: 'gvnigbuiqydgrizquzljnpiotcrnd' WindowName: 'zrjnohyzugfxppqsrqfgwbzz'
ClassName: 'cjbelltmewxkehlba' WindowName: 'vhfubgcysivguodohhwccmgqez'
ClassName: 'qsspobjjbzaljkckppmajvtuwz' WindowName: 'ydxeifrvzscigeubxiqqjedrq'
ClassName: 'theuijcwvgxawcdnkvrljqptvpw' WindowName: 'addgtpcvqthclwawcowiveb'
ClassName: 'qxsjpmcidmvfbimowy' WindowName: 'wkitleqxzcjduyqfafiaofkvaaqgkievzyuc'
ClassName: 'jnpqvxxbmeymcqgdpcdusgkcnggqwemc' WindowName: 'koqjnkexnlaajaajhpssffnrgc'
ClassName: 'vgssbawotpdznxuhdqsetbcmrfkvwzfq' WindowName: 'vuvdbntkvazjihirwxioruiswrubwuhm'
ClassName: 'mukbjswygtemsjvicixpfnssaemzrwzrf' WindowName: 'dehyuwgtzfsbfaktsztgsrwwemgzoqkmhqyp'
ClassName: 'dvzqmrdxuggcryzjxgvqqhhsvkkevyasgg' WindowName: 'uuaoojbqcwfrqienajbpdeot'
ClassName: 'rcxdjghrjbycbbbwxbvaio' WindowName: 'yyqhtunhrpbbjqyhaclwd'
ClassName: 'zlxokfhkmurcbokikhlzddcregzjbnhyudz' WindowName: 'cgxfpdimbgetkfa'
ClassName: 'qlhbirnbhqjigbrhaaprpqevplesevocfuujt' WindowName: 'lnunztrjtaebmowkzyynfecvypbfcesy'
ClassName: 'xkuvyzbebdengkkztarlnri' WindowName: 'rslyccezesltrojbwenyhbeiijmlwltvcrek'
ClassName: 'gqtzmzautvavifgv' WindowName: 'mbjjqzoiaggivuevdvrzc'
ClassName: 'erwipxpooczdcgddfdmhcnfeqizqweeqygz' WindowName: 'hbxjvroigpustqmpkvqjropbbqpbsrjolepip'
ClassName: 'osyihqmekbxacncgnfrzfyt' WindowName: 'zljvitwdqajmrscwzpltgtxixexhlguqxxx'
ClassName: 'takxujuclzjnjdlgjmxknigtskg' WindowName: 'tmilcwieqzgcuqn'
ClassName: 'ooskvnndxegrvkxisutcsbs' WindowName: 'dzvpayjhmufsjrurrfjz'
ClassName: 'hsdtstionlkuljfesnplzbvbagbwefcjmv' WindowName: 'borpqemgpxaushiszdblckfrsnownqxoklott'
ClassName: 'hddkozkjbysiwotwaw' WindowName: 'ykziptchcbkzhcz'
ClassName: 'ouxkjejjukuhacljprzndyewqmslgec' WindowName: 'mjkozorsizktthmrlxmmvhhflczzue'
ClassName: 'nbrvluxkwmpgnzyoithtuygjmoaqsivbd' WindowName: 'qwtbourpszxhkklzsntgwrry'
ClassName: 'pmrpmzqxduengrfudgnblnqksbcgoqra' WindowName: 'ufwijywamvnjwntpftiedqpcecdowzkwlag'
ClassName: 'bvdwhdtmhwjpgvnunrziavfzvnuvcbw' WindowName: 'reumldicynvgyrkigiltjmayfmywasgoygcozrq'
ClassName: 'amjgcafuviwrauychn' WindowName: 'zpfmkgaphkqkgaajuvzhzvjrinjhfeltra'
ClassName: 'xabwxgpwtnyxdycognue' WindowName: 'crokezbskbcmbroazyodhkyegimfzhvaomvop'
ClassName: 'afytagizhajdlrlekktgiekadmrea' WindowName: 'rjnywzotglocitaqqerketvpxi'
ClassName: 'xrrdvhkmnlkomjpp' WindowName: 'dtyqxdecqnukhecuvvtgkhi'