Trojan.StartPage.59430

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsm2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsm2.tmp\System.dll
%TEMP%\nsm2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsm2.tmp\System.dll
%TEMP%\nsm2.tmp\Math.dll
%TEMP%\nsm2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'yymgqwztjmbvlxehqgytohfxrizcgfirtdl' WindowName: 'nknbhasykafxwjtdssfwiaxkjmmxbylzk'
ClassName: 'bbthmpzfyvrrvorryjtnp' WindowName: 'zomwqfkxfkgmmfrvjajvmyjrvjsgjhrtlfleo'
ClassName: 'wdbsxskifqbutzkqtk' WindowName: 'rdzsthkqebxjjjmreses'
ClassName: 'edfpnkodkumojpxcxcjdhltuvxa' WindowName: 'imebkjpkjtyelumklxbgjvcywkaz'
ClassName: 'udfxiuadihlyslfagbklkfljgf' WindowName: 'iebjktamligvdqpvhudmdidoegfd'
ClassName: 'bopqgemogmdhxzwolaq' WindowName: 'ihdqaetyrvakzvasxwdbwuwgmlt'
ClassName: 'fzfgtmksmzrpmatxya' WindowName: 'yeffklmothejvijfx'
ClassName: 'wprjlbamjvgeviorkgrbakehcd' WindowName: 'pjasmgaxwqmogrquqcaacmpnseijqvwyktrj'
ClassName: 'flajuyuoqepipssrqziixcp' WindowName: 'rbhtjdqtvdxsxqliheqvarheozdyrkbla'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'zvzxnreohkxcgfs' WindowName: 'wawxketwvzibeoaike'
ClassName: 'ltunpyngscbppfwquosujaww' WindowName: 'qdomcgbdznhagwazytmzvrrtjwompjaxes'
ClassName: 'wunhwfcpoogvvyovpskxabeeewpajxao' WindowName: 'yufbcwihytuytyezgq'
ClassName: 'zzztzvzikzishikmlv' WindowName: 'xdjlxfyqofiiyuioxsmltdeuru'
ClassName: 'qevhuntjnvrhczyierapqodntosnsqcg' WindowName: 'uxfxiysvjtujoiz'
ClassName: 'qehbbtifnhrxnsorvanahckbhdtxlizxm' WindowName: 'hjvcecpbjjaijpntqmfipoqapgeqruy'
ClassName: 'eczzmjzggucaaahgutjmyfcax' WindowName: 'rpztekbafgxvjzrpuqqrgqjahf'
ClassName: 'igikdkboyipmuyx' WindowName: 'qhbmjnqyyozjtuatevquwnfbq'
ClassName: 'yckwvpzypgyxrcybqbszaqcxoekbecaeqvc' WindowName: 'zzyxyqwricfrvqgtsrxofnulaigzc'
ClassName: 'hrcanjszbawvunnjaypbkheprxkpqphsaqdcjfh' WindowName: 'keiyufajbepaomestghirwiitdhlnkj'
ClassName: 'ycbhtptczrybfjht' WindowName: 'lgikysqbnzdvpwlitwv'
ClassName: 'frrculkppviptbvgdcluztblgzkp' WindowName: 'cimpnrkznawkrvrdt'
ClassName: 'vnsblzqozauwxglxnfdj' WindowName: 'yagqdxuruwjetwerzymtdmzijw'
ClassName: 'jayyzxotydxajdsuyqjgdrbbgror' WindowName: 'okuexidoywwbfvtgmdlxquyyccyudedyjur'
ClassName: 'cmamlonoqfslndntpoydwwdiyfdpokmjf' WindowName: 'zyvjvsggxmsnwzhptrunpbvs'
ClassName: 'tujubwtqgpgfriprhfzrqmrmq' WindowName: 'pvjvwulxlgqylrmuhgahxuobywctlvqwnecy'
ClassName: 'lyfulomealasvvmjkyhosfnnjxspmukwo' WindowName: 'xquccpmjwgynsuthinchsbcztgw'
ClassName: 'glndvrdcxutgfzftnecpfizp' WindowName: 'hjldgfoqaozvefgblffscxhakxhjw'
ClassName: 'vjunedpxspwbpzjtigmtfxqajqmlplf' WindowName: 'qtavfzscwhxnmcazrposehhtuy'
ClassName: 'zeqtfexnppdhiuojnfnavineryho' WindowName: 'zvtttypvppnsapmfblpjkgpxfzftfrt'
ClassName: 'ilpfegepgbngafxsndjukayyrmhmkrbxvchzwcc' WindowName: 'hbnbhikfdgzposrfyvbnbsckjsfclupb'
ClassName: 'apyqecyyzpowazqlhgggiieuhx' WindowName: 'hrjbnvsttcnlwweuqdttpvkkuuopmiinmsqszqm'
ClassName: 'yjabojqvqimrxkardhfgirsnxhcgee' WindowName: 'ctumrcclirunjlglmj'
ClassName: 'kuxrkdsfgsglxoygytfyjfoinwbykyp' WindowName: 'iallucgrhqostwumohvheatehbtjrmlswibrksw'
ClassName: 'vebvctaazbzfnufoq' WindowName: 'poaohksnhmzqvuwubxcpgyizpi'
ClassName: 'jtnzmrutnjslhbmzbbqmfpkugwsm' WindowName: 'enzppiilmqmmbkqahyrcyhfowdzjp'
ClassName: 'mukqwqawhpxkgudcehxcgqovbtparcghlrnq' WindowName: 'vbklhtctjzioxbpnhplhv'
ClassName: 'nbbsgxyypbaatjrmpwqdwlhbopjzvnodmrmbpv' WindowName: 'tpjlwbulqcgkdsrmnmccuesuylak'
ClassName: 'zjvhmzifczwzuqolpl' WindowName: 'ivtcfmwkufqkbmkyvmvhyohspusiqzwbjma'
ClassName: 'kduizrtyrmiopvqrmrxpge' WindowName: 'cdebmxqqgvznslwveflddjltbxrjxlo'
ClassName: 'zfdpurtgujrfkinkzboriqppzmxsxd' WindowName: 'zdydhyuzjooqbvel'
ClassName: 'aapngzyfxeikcpvaeiaqocvvh' WindowName: 'sspjitnltvwqpkqydiaz'
ClassName: 'ssqrcetxrotytnoeycuolwciazvszxuho' WindowName: 'ijvknhocjbkcxzetewpiholfkeqgpap'
ClassName: 'kuowuyxbmiquwidiuiayyfzzgwcnhrgbudpjkr' WindowName: 'oealwssuwbpewdextafvsaimnjuqk'
ClassName: 'uspltwylhcsjjypsrvmuuupzzlpolzfxzvs' WindowName: 'udigmmacxshjyepaoaekczesyqmpoojuo'
ClassName: 'aszyugkkphkxcgulusappqasqltgvoip' WindowName: 'tmzdyoachrghascelmbgfbdkuyog'
ClassName: 'wutwcnysopacxxmxhcnnbcjtipqcdxpmjz' WindowName: 'ebesdfogflzxqdbqnwhtspehrespjsls'
ClassName: 'anxudoczzuyimkheshywdicuix' WindowName: 'kftzlnplzjrkuedeoscup'
ClassName: 'yucuepsqmugyegxzghrunkcjphzaqbypmgalrv' WindowName: 'rvbqwcgcsmujsnmuftjjj'
ClassName: 'kjvmfmhpcxllyvqovdirsqmegqplhkrhsmjr' WindowName: 'kkwbczouvdwftjpklczjj'
ClassName: 'kfezmxuvtvqqolnulfjtqhfvbha' WindowName: 'vanzlgsljfdlihflprshpreawmwvwlhemtl'
ClassName: 'xtmuwvoyxrtifsjrbptegbpkibxo' WindowName: 'qvvlejmykkfogyrjbrpbzjodxwolqxowjiehya'
ClassName: 'axdcostvvtgknecnxhtkqkhzbrmhnywrag' WindowName: 'pwkezbeokpmisshzx'
ClassName: 'ircteacectucxancdidnzqt' WindowName: 'mbeekqgdstcbhkmq'
ClassName: 'vaglromjynvexxuqqivz' WindowName: 'mbevpkchtagmajgxakqukutttaortwx'
ClassName: 'nwiwpazqcskqrxuoijv' WindowName: 'bbkuwinrdeoyzeyqiwklnld'
ClassName: 'nqaueoseruyeoliyqvzfur' WindowName: 'kfzyijupjseruijmipetutzmzde'
ClassName: 'hidrhmlfdfkcgnszkhsgdwzptjfvnmcvydfo' WindowName: 'xsmehhpcntdhvpologwyjqcihjdlrgwdz'