Trojan.StartPage.59472

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsa2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll
%TEMP%\nsa2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'cqpoxuiizjhjverleaxnwbjigx' WindowName: 'fdpjchrvtpeuidyvjw'
ClassName: 'slbxwwfpdjnkqwbyi' WindowName: 'wfvebywlzfpdmcen'
ClassName: 'ppjjagxbauhwwar' WindowName: 'pjkehqumqvhcohytleugpltmfzmojjdjbcrirwn'
ClassName: 'xytilboxueqgcgkmxnalcoazebtzbkailyu' WindowName: 'nnicebpmqthzsnmruqvpgvbuczqoehrdfzmt'
ClassName: 'uqaphsbjrcihnngmdeixqgvpwpj' WindowName: 'htgudybxsjzdkqig'
ClassName: 'sohfyztrpxbrogzxdfhpnnvqfcshurdxnobsw' WindowName: 'pgxbqedaxuhbfbci'
ClassName: 'kliwhugvslmvvovoagdxnusebmqq' WindowName: 'hemkbzhdxxkmjkmknzxvfiv'
ClassName: 'hnmffhlzmsktusq' WindowName: 'eduubvvzztprtshpwbn'
ClassName: 'kmjbiwhynrwkgiwaqhiklqeyfsvktbahdeg' WindowName: 'ivcqtlkqirsncrmhzlqgb'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'pazebnsrbsllftibyqegdknrqomfhyyhsg' WindowName: 'wpohyjxakozwqaoeyuiworuig'
ClassName: 'ixnlsljwzpxgwyymc' WindowName: 'jormpteyyfkhytmzrcmpk'
ClassName: 'mvodofzhtwiiwnwevmhsysvjzdvltbcimxdrtlj' WindowName: 'bmsfddrtsttpwtctfbyid'
ClassName: 'dgfvoznwxlbaslcnevtxsjzxq' WindowName: 'uxrbwydqqokpekuaiullekrtqcqgbakd'
ClassName: 'avgzwosvvicnpbsgetqld' WindowName: 'rofyimjzqvxteayrvbirpmroeryrqi'
ClassName: 'kvmoechazgwckblzmwcltkbaqfecbwzmduqpprf' WindowName: 'inqatrtmhplylrzbbjwmbctystpxterkmxbk'
ClassName: 'xuatnriplushtygzxdmqaflqtuyyppnvtmcntdw' WindowName: 'rjwgihogatnanfa'
ClassName: 'rgrcuekjclyrbyuejejqxzmsmrryfcmffrvpol' WindowName: 'ftekefqedlklexmnlwexgu'
ClassName: 'cxdcfheqyoftnmchhjb' WindowName: 'dqbtyhizxhcmtsjoyqgdmfoe'
ClassName: 'lodgunljnwlegqdrdfphiwjrl' WindowName: 'minssgklstnojtzirqixcqpcjp'
ClassName: 'plbartwcfjbtgtxiyece' WindowName: 'qpssbyplxyeeugjoetek'
ClassName: 'xtcywfwdwceastbc' WindowName: 'retjnmzlzeggnxfyybyp'
ClassName: 'sszldivrhuzjswxu' WindowName: 'rtivdsiyfljtsusjrhpyclllwps'
ClassName: 'dcovlnncpmheeucjapmknutrq' WindowName: 'tgblvmokxgpfexkafpavajseksydfrcqkjyxrk'
ClassName: 'cumpghgitbvcmtszfyam' WindowName: 'vjcyqcvamzyopxb'
ClassName: 'mtsbqxpasxuxlshc' WindowName: 'jjwuhwjllyszxxertyodkksiwodzaat'
ClassName: 'crakpqjhzqmylcsuubqubcnanc' WindowName: 'ojiksqeysgksjepnjqtvasyaxhqrtapiy'
ClassName: 'ovgmmeyuwizcembxq' WindowName: 'vsxzmcvkuonedaqnnlrsypemhsgppscyipzpkr'
ClassName: 'kxrrwzfqwyunhsarlapvehqmajiougbn' WindowName: 'oikusftcbpikldmbvk'
ClassName: 'vsskgtpbotvwpdbnzql' WindowName: 'xhsptdyjkematalguclyuejhi'
ClassName: 'sknkvgtfpdnhvcynqvatcqpfsfurxltdpifl' WindowName: 'ejsoypjajyubexakksqaznztbubuzuhhwdo'
ClassName: 'ntjwxfcmuqcanrdajqshndhaxo' WindowName: 'wwpediyblpqvjlhwxuxsubretowtvtqlptti'
ClassName: 'cadfejlgxsqrghpgrzfdlhaqsmpuriokyt' WindowName: 'qjtzzgeugyeflmsvxliimiofsfirc'
ClassName: 'arrpsvwgjdvmxfgv' WindowName: 'fflpqriunrniwgbmahobrtnslts'
ClassName: 'abnumnhufdthyraptgkpnvqfhpapugnvomdb' WindowName: 'axyzxvbulonlhwgxzhehyypenbpuxovjo'
ClassName: 'fooixfjzzkkissfywayyvfm' WindowName: 'hutifccnfirvwbvvehmusnor'
ClassName: 'rzjywxfxtzgzuupf' WindowName: 'ppbvtzciaarfhnzgwdrarzsqkycdadnuwhd'
ClassName: 'fcbtznrbapgwzddzcuvyrsbcfztfsnozwodqikq' WindowName: 'yotjqatizupyjpwmzepjgaivxnftxftpmjjgirh'
ClassName: 'irdjgcrnzuxjixdkkvjuthvgffgnzasrfjpkk' WindowName: 'levezrhdzgvwcgyax'
ClassName: 'izsajvauiwyzxmxhkowvyqkisajklkjrzwu' WindowName: 'epbkxtdmydvvwmyncxmdeodbcimknt'
ClassName: 'gijykzttmxppbgawmluhlbeioiasqfytrrbyxws' WindowName: 'rhclmziywnsfhyrzuqlwpfrkpte'
ClassName: 'pxyybhveyxnlecnnzydcxxvreapa' WindowName: 'yjxmvvublyyqkuruihszcxrgqiumluqd'
ClassName: 'njcdxenmbdootcjkpyxlhtrawqytuxuawaqd' WindowName: 'jzcskjhevhwffezifjsinrkymcziy'
ClassName: 'wrhpjiiccuvqauifnlasfsycgiymdhw' WindowName: 'fgauwurcgeftcqmpuyxaaazknhzyoellprgyxfq'
ClassName: 'rrkahpmeerduiptllattlnedwodsbkshiuufsk' WindowName: 'gwidlaowvutqtmojoipdiiewgw'
ClassName: 'kgtsqpktwhjrhpiixywfkgpyled' WindowName: 'akxdgjcduvectneyxlbvlvifpnrecwberttdxja'
ClassName: 'uyofbjglvonurtchechoxefcgjsxtcpamymfgq' WindowName: 'inrcybltqngdznihztsjlk'
ClassName: 'vzwotixkkmkjvrqwqdndwcugwjc' WindowName: 'lhiffwoycntxvnk'
ClassName: 'zdknsfvcneudkjiidd' WindowName: 'gtrqewmobvztkktcjnyttsqujbaexjvtmwuahty'
ClassName: 'ddmpsuruayjvqpoufhbolvzwrmrbpyycs' WindowName: 'ursujalxulooaurwbiwrvvzpwtpxoazukckjuoj'
ClassName: 'qfakukcvxljcoyujzboowswluvlkkpckvcvlhix' WindowName: 'isxflgxjzylqncbmcwol'
ClassName: 'dhuhbyrgefnbnrxw' WindowName: 'prqiglhqtnucjmhpqr'
ClassName: 'xelmjzkwejwfppzpaljexeryemdomlhno' WindowName: 'qsohqbkfpdqidrmnukzlutftqeqnmdhnt'
ClassName: 'xgyfenfatfjkyomepimfp' WindowName: 'qpztqagnilfeeubfggcvoerbdvjbr'
ClassName: 'yxshsrsslqhndnaqtvao' WindowName: 'clpfxtufnqjqpmwjnahkqbqnnwtuztbs'
ClassName: 'pccscytcbsyuhrcsfjupquktjg' WindowName: 'sydmhjfhdpwaqfxixsywxvu'
ClassName: 'bkwzjwancztcpcvhbbssd' WindowName: 'bsmsrmqxkwzsshbeterncyfnoogtcipp'
ClassName: 'rcoxzvcxzvexuijsdgnshziaoxcziml' WindowName: 'atzkvdctgtxwazdcqyl'
ClassName: 'lfaovjiaokcmwbdumfssbrdkybdkdplkqzn' WindowName: 'rwbazryakwwtybdcffilffjsmarebimn'
ClassName: 'bbdjtzmztxgpyfweybvxvtrzvolijvo' WindowName: 'pjovglueryyspouffovn'
ClassName: 'xifvrhstpzechsg' WindowName: 'shmyiwnppalzxudrnscjcvvxevvlarejuvlsch'
ClassName: 'sybtwohesvuqsvgviontengi' WindowName: 'awjajwvgjcyulzxjkauippfaixuncclhwpjmpvj'