Trojan.StartPage.59490

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsy2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsy2.tmp\System.dll
%TEMP%\nsy2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsy2.tmp\System.dll
%TEMP%\nsy2.tmp\Math.dll
%TEMP%\nsy2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'bvbeurhpagejsgfidgwqnuxrcht' WindowName: 'noqravpzjdbdsbwothuajogldyimofj'
ClassName: 'uvnqdjvsgxxsdyxcojwrnsajbcmdi' WindowName: 'queyyeeyodzcylagavtecusbaewerx'
ClassName: 'heqiemdmwsvppbyibiwxauqqfwxpinl' WindowName: 'uzhacapplpkgewnpmcwpujb'
ClassName: 'dovzfuowfudpdktcjqkthxrfudfmsdao' WindowName: 'wcdliefkbmpevoomgspsjadogg'
ClassName: 'eludwfxczqqttsiioxnbozimsnm' WindowName: 'kypuxxcaqdouzpusj'
ClassName: 'rwhsddbuvgeolmspqcadkehho' WindowName: 'nozoelvzcjcmsydhqtorpeajlhklxp'
ClassName: 'tmtoacmnzdnhibozqix' WindowName: 'koynwhelucpyqencbcjrxyoodajrgrclrtnxag'
ClassName: 'ocmnfcxgbciwphaqrm' WindowName: 'dvxxmfhdwiemuerbxxyrudkxzd'
ClassName: 'jlhnmcxfuoidkkhcrnvopitlt' WindowName: 'jidghqrmhzltmtrqwtmvqmxsf'
ClassName: 'llrvntvyvfztrvzumiyessm' WindowName: 'zmoyuigjjmpyphuezgruclksgcqpuhcefd'
ClassName: 'yoipqylkosgsstxs' WindowName: 'kxeprajdekcftuudkgvyrnpkddhwvxwbvh'
ClassName: 'latbaqbzlixnftphnlepwkqqukfwvauxyll' WindowName: 'nieuomunacktnqpmzbzeecx'
ClassName: 'vxmpuzhavlsklwyhudvqsysjisnp' WindowName: 'ljfkwdoratwwokpgzqdwhdr'
ClassName: 'uqjowncldreaulnusesfoqfbmuoivbdhikgoqcx' WindowName: 'ykuvclgyeanaanvfj'
ClassName: 'ferwekzlycfgaywbczcwreexbezdhtdk' WindowName: 'phffkflvbhsogwnczslqaazjl'
ClassName: 'wqmsfvmrfhcyapdtwultarvldepfgp' WindowName: 'fkafvdugiglrffwitcd'
ClassName: 'ebgrlxbtujqjdptyalcixvsrwmwnsuuwolqfi' WindowName: 'smrgddqrgbqaiidaudgplg'
ClassName: 'gzeutniuthadklnczjbnbph' WindowName: 'dfseegiifgeckfihzxpoauztgdsamiap'
ClassName: 'oeooyfaezltventbhlcmbaknvivptwksz' WindowName: 'zbbhrbmxzpasfsbnhuopkahlmxtvhdwerew'
ClassName: 'inirgcmbxainvmeoawpudcihrzdsbetyq' WindowName: 'xnlnxqjestsxnce'
ClassName: 'xygtqozzhddaylayxromejxiwezmhlyxqkf' WindowName: 'lhzjmyydskkfspewbue'
ClassName: 'bgjhkiziznindygsfhxgnuwlnrxlc' WindowName: 'vxvfotnkxpfhukqwbfabphxdxvpp'
ClassName: 'vnenuwxmegayinb' WindowName: 'jfzgirgxbzqabrdvmdltdvniavsh'
ClassName: 'pajnahfzrvybuetzxdmtsrtolnxlmybl' WindowName: 'gnmzduhaixkqvpraknjdd'
ClassName: 'bnxvxefgmrhykbhtyxpcntlmrpzttvhukzdzlpv' WindowName: 'sbdiccigvfqqlradjktlxuacc'
ClassName: 'yroxuwppzqiuhxoyeoatixhaneysybmdqfgo' WindowName: 'gxqtdcdgqtdmdon'
ClassName: 'gazmauqsjpbzmfegykqtjubofwmpydaarjb' WindowName: 'bfacwmfrtdnoeufxcuejjsatptzvcgyijaevtw'
ClassName: 'xoftyjhhxmeqdxowhpwomjap' WindowName: 'greuvcjpbrdrtyldcvdgctusrqfcsvcrptwnqp'
ClassName: 'fmjbetrjlixasxmjcicbqbmdjykaflbjtkqvm' WindowName: 'odnvbtrlsycjkfp'
ClassName: 'qurjxazpeuqbfbqbrxlekojmbi' WindowName: 'ibonmhywasdoiguynaydoyj'
ClassName: 'arimtascjyljmfyneffdrpp' WindowName: 'ydgjsyobajjkbokykukgaczyrqfdsxxsgwdoak'
ClassName: 'ipsysswjyxmfwdjqgvld' WindowName: 'adlrmekfkykwmojgsrwsgvprxmzbjhqshfu'
ClassName: 'wyjlgpnusvjokuhmtrzbc' WindowName: 'tapadozgzpursszzzvdqjhyxvbtrq'
ClassName: 'sbvieuvyfmxtqamyjdjctgx' WindowName: 'zallwwxzwattmzlrsuowunytblssqt'
ClassName: 'emxqjiyhmefoyimjintufbfmmteopnwoizbawom' WindowName: 'hcyojorprturqgdndagnt'
ClassName: 'hdzqwktkdtczjexwu' WindowName: 'glhitjgiysiejlowvtdogjegiijgbwba'
ClassName: 'nazivzlgipwpzexhauzffpoajmcphyqcgvhotpl' WindowName: 'kgtarnprbbftbxfpdkmncagcpznviixw'
ClassName: 'nhvaxtaxnjwyqbryufvv' WindowName: 'rbadwqokgipcuopathir'
ClassName: 'fvkigjumqkkkdswgkhrew' WindowName: 'jozturtootcibwa'
ClassName: 'qmjqnorlrhlqiyqzibmdzeaeathwuqs' WindowName: 'dmstxhfwcemhiwvbvaezjwrzbpcedn'
ClassName: 'ikhwmeioomcesximuowsdgwjutdgwyfv' WindowName: 'wwftlgupnweatugjcixphtezcrbj'
ClassName: 'cgaazlfvwfpjxgovpsywrfnfqx' WindowName: 'dpvurlsgrfhxmocategrl'
ClassName: 'gxiglrxvvyhvzvpoltdv' WindowName: 'tdbsnsehvmhwzbeodxokperykoujdpofkjk'
ClassName: 'qixvpmkbsqezmshjvrq' WindowName: 'nvpqpcvacenliim'
ClassName: 'exbkjbqavqgwvioibpnhbkqjsfborcpci' WindowName: 'nignsiodmihdkifvpdvisdtacfjaewomfewz'
ClassName: 'zhbzptfednyoskihsfutta' WindowName: 'apfuzasjsbwmhmszi'
ClassName: 'vmhmohwvkxgbttgdvc' WindowName: 'uyuwxbaujzjorecexce'
ClassName: 'zyrldgnweyshxijesttnpbseu' WindowName: 'dxqxobfrvkleknhrxenoxtdhvinygwgxqgvypy'
ClassName: 'ytxffhtighddxwhedpucqxclmthmumvy' WindowName: 'ahonwnkdksutkcpislfjwlyeozuzqlvket'
ClassName: 'pisokyxkcgdnmxpjcfjabdfc' WindowName: 'jwpjrcxpdabmzczc'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'zwfphgkermsvkrx' WindowName: 'llsffaclkhwqsxcwuvvkpauh'
ClassName: 'nitcginlakrdgnlkx' WindowName: 'hrsnerdixdxjsiwdfabtturep'
ClassName: 'zhcnbvljyjptnpzrlomavqndznpwlqy' WindowName: 'ajsfflggljqrsebahscweunniuvnavbseluey'
ClassName: 'lvytpohhsdburaryqauzuzorirdplutwoji' WindowName: 'onnzpojnefrcsxuctnoqvooabar'
ClassName: 'iuvlldvvafygruefsderqgaqtsb' WindowName: 'fbncuetmrbdisnwkbgojaxhx'
ClassName: 'dzmzttdqkyqfpzajy' WindowName: 'ckbovnodsusleejvfjzkeuawnykjkbvizkdplo'
ClassName: 'pppownaaasnexsmjtufohykxdgnpdht' WindowName: 'lgvfpayicnypvyjctogbnu'