Trojan.StartPage.59461

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsq2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsq2.tmp\System.dll
%TEMP%\nsq2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsq2.tmp\System.dll
%TEMP%\nsq2.tmp\Math.dll
%TEMP%\nsq2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'odvfxufdbbwnitpsqckijdtytlepyzntq' WindowName: 'tjvgzwdqqafdxqrdfgiebmoejlkoquubi'
ClassName: 'qqqdpyonpapzkphibzhzscporjzbwlaqppj' WindowName: 'bvgkldqavkebvgbgs'
ClassName: 'kwwdxvklrclmtpzrejdeovyer' WindowName: 'bnutesciqnkyvjtkjir'
ClassName: 'gjjblnetiilbzqxiyffipwh' WindowName: 'ondpqjudkfgknlpgvkqtssfjohemmyp'
ClassName: 'eufetxvhmotyllchqs' WindowName: 'vbviirxnwsoghixpjprkojajbgelffzo'
ClassName: 'egmkcjothzlqrymewwznxwkyogcuooswfumeokv' WindowName: 'fogyrtkalogkxttobenoqlqryylrsaeuq'
ClassName: 'qjzxnczqvmkqnulscftqflqkw' WindowName: 'qylkqvskpsvikdyfpqubzuvlxqsorgutnhn'
ClassName: 'qwtqjnzvstvkurmszhgzbdymuuwpn' WindowName: 'bivgjndsncipgpuj'
ClassName: 'zbnxcmudtqgyuedyx' WindowName: 'cgqctcxyahlfoolhqazecbek'
ClassName: 'lensmgzfjvoxhzspqmtftvijaulxroeisr' WindowName: 'ljlaecczpkhmmrpfliwwlce'
ClassName: 'khuievjmgavvbyscvagdlctewdklx' WindowName: 'gfemjrxyziuwatojtcvmhmdcpdj'
ClassName: 'hrxdsfpxprcvyzaxvqiwbztnulxamnnowa' WindowName: 'xbzjylmhimhgfqicsjgttmp'
ClassName: 'pfexzorksejwvsouqtgurdgprj' WindowName: 'ditodkwojhnioqsqpiochaunezz'
ClassName: 'gkucjazsoocjtatuc' WindowName: 'pzgpbfhrsdjxovrekbdsyldvppdoc'
ClassName: 'ufnfxjpachujshzvjheiwv' WindowName: 'ahlztvtyknjsfhqjrgtesrnlslvhupaxxtjyb'
ClassName: 'ddcqbmtzrjwjzqpnjb' WindowName: 'ledlywfzlavinchcxzzxzmbvrftv'
ClassName: 'pdixvhlswwhkyvlhfev' WindowName: 'guxfaxeagrkxnrisccukoqqcqosmqcxitpws'
ClassName: 'zlcdznbxueyvugwvmakwfudlmxdux' WindowName: 'oysjawypkkjedvpojplzekybde'
ClassName: 'xjpdogngwjgvnoikjsdlfvmrjsjhpvcpvyh' WindowName: 'rgotyujbqtdtxhjezbganuayfyuewewdolbthgj'
ClassName: 'lzxvrmzswawmida' WindowName: 'rhtcxiszgzcscvaeydnk'
ClassName: 'hxpgdrwdegdpums' WindowName: 'arykznttvbichbbjhrzmj'
ClassName: 'uwbptlptqlipgwwczkfuiexefkkxewevy' WindowName: 'vggiuqmiloaqpdigpokjvq'
ClassName: 'jirdmoqeicqywgdoufemcmpkdpq' WindowName: 'ncexoqnlgvreswyplmczcfelpqesvoaewmva'
ClassName: 'avsjqalrtxcrffmjolyxtyrx' WindowName: 'syiqbghtkehefsstshqkrphindmvac'
ClassName: 'wfipvyuikqdrfuovwped' WindowName: 'gfhufmogoogkcdnggpkkpkdpsf'
ClassName: 'skcbsntqdzszyqxlqzafsibilzgyljabdyvjxxy' WindowName: 'gyjfabmqztfusezjkmcwgpeuttevpzft'
ClassName: 'coxpuyqbvosizmazhpkyopwzjtjgzgwytjnlhp' WindowName: 'mnubevhnzrglouhvnboiuzqdjsgsvmawnzeas'
ClassName: 'qglotahwslinxuzgqwcasdkkf' WindowName: 'cgjanxmlspfjzdqz'
ClassName: 'bgmrylafjfepofzzoygjzaihmqjwokjlnituz' WindowName: 'fqmhxwtzppqsdofeakbpoytaqzyfuudzop'
ClassName: 'kptdudtdmhinjblbwieemplmdfvvypzlc' WindowName: 'vjnlwmdwuxwfvydsjnzdduhtyouwgutydomyfm'
ClassName: 'ehdshirrvnlwdbfxaokquyhkxktj' WindowName: 'gmfhxezcwlxkaefcgpgpeszbehxyv'
ClassName: 'pupvahncdtqufhpqsgo' WindowName: 'oqkkacinkfowdmlcjnzrklaq'
ClassName: 'llyabcjvtaqmeolglzyedaksioegwkavsvw' WindowName: 'iwinxqfrzrraihicpbrhsuhfne'
ClassName: 'pdmuqmrbtinqyeoxbsejdrzi' WindowName: 'ejizscbioijlychbhusmkyat'
ClassName: 'zukhubnpjndobhgbygrzrpneaqgmncyb' WindowName: 'pqeckjpojeszgdblslztcoxu'
ClassName: 'olmnffbgdvcwctztmetvirouheggjcwntctckgi' WindowName: 'luvpxyqeoivepjd'
ClassName: 'obsqmotdgrjqrbcpzqadrouoryzzluhsbamfqvz' WindowName: 'zyhiuhimqcluwtxcnklng'
ClassName: 'dsuhjszfxubqhmi' WindowName: 'loyfmvklsofipvo'
ClassName: 'awlyswuykiorhvyxauoizrajgqn' WindowName: 'vprmenjcwiubvsbwpagxfhompzvuhnw'
ClassName: 'yfzfyioandnvahohrekthxvcf' WindowName: 'ltbkznmilekrpggrf'
ClassName: 'hmbuvbutfdlwdossjnhkabzeajmn' WindowName: 'ztsorkzkhibliawfkmzhfkykiodiifwtgssdvi'
ClassName: 'krovajodaecvqjelrkxefyecwjne' WindowName: 'cxogaidgkulckyzcbepqljus'
ClassName: 'pechezarzzpecvbps' WindowName: 'ucojdiddcrugkuqumjw'
ClassName: 'ychmppqoxgriuritpqcfkffrcxmlm' WindowName: 'eqdixusmttidbjrjqzcgenvkhseklmulil'
ClassName: 'dkrtknbbwoqehsxtrexunegsudebqoqxnahmlv' WindowName: 'stjnlljepokkmalsmlonviikkqdvadakduzhr'
ClassName: 'axpjkqvxblymkgrk' WindowName: 'syxnezhivkubnlspxkfkfmqazgc'
ClassName: 'dzqyavbbmmjgirwlptcxmbqtemebyiylntf' WindowName: 'vltehdojlcwnacmcryhebvvqlio'
ClassName: 'gglynfacpsvxsvqnqnurifgnoza' WindowName: 'wsejzbntwehhxcgqyeljb'
ClassName: 'cioomjwwhydhvyuqwfeidxz' WindowName: 'seaqeumyfzdhzfcc'
ClassName: 'fqfunousquokbtrlab' WindowName: 'rnbwiyxrbqiphujenwimxmedcnyfkmji'
ClassName: 'jnmyhxtrntvkmtajknpvlkwhcbhawgp' WindowName: 'culuzhzqthazfhcszukrnlffovwskcvkjfj'
ClassName: 'atgygtxdahtatbhpwnznbpt' WindowName: 'fulipebqooiopyoyzbblcpcvadvlgoittzphzfh'
ClassName: 'ummitthuhytnppbabyhgfufjspy' WindowName: 'kjciwulpcfmgdjzww'
ClassName: 'wwimrsmaiivaeaqidakml' WindowName: 'beggseaulcxqrzsgpimgrmslpqdwewm'
ClassName: 'djoivcqcidzdpxnaglju' WindowName: 'ofgurcvuxdooahthocdegarumwososhapmyo'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'wjqrbvmuhvaobiwcrgeocdmsluxccpuhtwe' WindowName: 'eaiqgbpzkpqoqsqcaxacopfnzjsnkydd'
ClassName: 'cczgymiytggogtaoe' WindowName: 'xxjklokzpbjkopcehdvxlalzzuddxktwx'
ClassName: 'ufufmpejmkudiraq' WindowName: 'agkzppwblcczdvxyvjvz'
ClassName: 'usetzshcmkwqockqp' WindowName: 'oiuoytztywfchylbczb'
ClassName: 'epouhleddjzfpfeppd' WindowName: 'iclfzqjnojcootureow'
ClassName: 'ypbiusigbccajaygipvfalyk' WindowName: 'rrioppywnzevzaaovasuechneuhwftl'
ClassName: 'oyvymltvyvekfkppbtgdfh' WindowName: 'hranqfjeynggfcxrs'
ClassName: 'zbyuujsbzlhjsvzkbgyfeedamc' WindowName: 'volkqutuhpklzoqfhh'
ClassName: 'eizecovfxchodghahwqgdvszj' WindowName: 'hjbrhsmazavguopnoruzetvdpadpeep'
ClassName: 'jbpywqkvacpocprfdmoxarexirkifzhwxf' WindowName: 'nvphieslzitcnbbgpyoxcvojgzbqwmb'