Trojan.StartPage.59542

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsa2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll
%TEMP%\nsa2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ftewxuaouvvevvwmtzmvfbyacjvgu' WindowName: 'vcrhfizhkabgckpnwnz'
ClassName: 'ogplfsugwwrbmrly' WindowName: 'rnclgmglbnzfmufgqoxehm'
ClassName: 'dragdzhnsnfqvhjnyxf' WindowName: 'vwgrbbftmhqhmdqfnqnjnjeygllw'
ClassName: 'gngjpltlbdzsumclz' WindowName: 'ziclgupbnlsdfovgnqucalcupvnaflbbsm'
ClassName: 'bgbdhjaafhmjsqezuouyksuhsznhb' WindowName: 'btqhgywkkpgglbz'
ClassName: 'ezyhwsoyyvkzhhlcoszzr' WindowName: 'tiwqvnmravwcrgsvd'
ClassName: 'rjvhkznwdumriqebvfzbjonhoqpio' WindowName: 'eoymdeqeebgkmbtjydebpssbn'
ClassName: 'akrpcckycwgwwrigup' WindowName: 'wzugvecruqconeuloojupqognolayptih'
ClassName: 'zoakrdmgeljqcvuxbuhjjsqsgictsd' WindowName: 'krmrxsmbexfekgysxqnva'
ClassName: 'hpzjgyekkfehyhvitesjtsglszuzk' WindowName: 'ncoouhqnkwjwgpbouguncy'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'crnhfliqngmxcmbebtfjqjzuayclh' WindowName: 'ohtcgokvkjnqejpolxvlkpdcbktajeuhhahh'
ClassName: 'lpwkjcodbtobjucdayxwkrkphdqgsevcag' WindowName: 'dhyejpsunjdvibiqyj'
ClassName: 'spfacekwdejitasqeizzbryeqognxxzi' WindowName: 'dqbslamevglxjkvabmrwsk'
ClassName: 'zbqxgetwjednujwpjvrdchvqhjgazf' WindowName: 'qrtbxoohjotqszrkjydmfcjqfpbudxxlreeruv'
ClassName: 'sevqdyknoeuvgumylsuyspymonrzyih' WindowName: 'klaauyndypruggfwxgshbde'
ClassName: 'xjmiqlrnhwlztpdlcnkgvwhoztx' WindowName: 'hbxbcbynucrbgpe'
ClassName: 'xzowrzplpoixyefoskcrrlrphptrnwa' WindowName: 'ycexkmltpsdxabsztinabqblvcqqqkjm'
ClassName: 'puhycpajliifjena' WindowName: 'mqidcgmawbxugtdpfymlxbzdwklylawu'
ClassName: 'zxyosyxosfbwvvk' WindowName: 'yuamgoayndizmpwcl'
ClassName: 'adtqbnhuwaffinleylmtuzlwwz' WindowName: 'fsqppcectgpnjuageovfmvlazpvq'
ClassName: 'rowvyjwirurlelzplkgzlsmdmat' WindowName: 'wksxbwpvhwjepfhfvshjeutsixpokfplq'
ClassName: 'fczqbwhlgzfpgmksccfdsf' WindowName: 'fwfozewbqtpxsgjjqigzym'
ClassName: 'lcwzvkaheqrcfkigcm' WindowName: 'yorobnxjklwpllvkwymxbhbbkmecph'
ClassName: 'zfvceqfbjyamvwrqtfyauzxfvsqqokwkabiup' WindowName: 'fgsebopqmiafryj'
ClassName: 'ilqogpstousgzttjxtidobccugfrylpwawb' WindowName: 'pvcsrigeigxdkkrsiwrnit'
ClassName: 'qjkipgxeuttzzzcj' WindowName: 'dactyiakjgpsevbqxha'
ClassName: 'rcknxyahjtwarkmtvlzooqbovsvmghh' WindowName: 'eqeutxorqcbhsirabawmaygoxvkb'
ClassName: 'usyzsgcfluzxalc' WindowName: 'ucedpalenprqthsimgcysdmxfkct'
ClassName: 'yfosqwraxvaxuljvqulgvzhypry' WindowName: 'oprfdhxgnbihzdcwoyhsouppmybgyjm'
ClassName: 'rzmlepwqdjlpkuavnichcqalktdtz' WindowName: 'jnmhzlrawvygzuilcsymtskyowxrrxjilvgf'
ClassName: 'wvfccjaahwlsxcadwxtrsskvdolnycgvabg' WindowName: 'xomfdfzlknpkgryqwmqxukn'
ClassName: 'imyrbmjfdzmakwelja' WindowName: 'iazwoazbjsgoqdokmihubqawjedbcbw'
ClassName: 'etazjavtjzcbsuluff' WindowName: 'rscjwxzaqpzyuibwvnbprridmpvjened'
ClassName: 'qtdqsicopszrdwnvmzonrbsufoydu' WindowName: 'bmwlmbiitbxdrdeluiqwibur'
ClassName: 'eppwlzvdiwxtjdombnjxwybigo' WindowName: 'mzalpdtrhuprmmpfnqqszsdrvwdrdeesc'
ClassName: 'bfqodzjjwvcbffiyujimxvsdrwpcbskgqelnvli' WindowName: 'faybmagqncaoxitjdfeea'
ClassName: 'mveqmjvsbwcylmtkblltewqccuyxes' WindowName: 'pcgcvsbfroeagbe'
ClassName: 'xbloaysbgjendbbicnzwqy' WindowName: 'jninmlsmjzyzqetnabdtnkpoujncadsgm'
ClassName: 'hilfzznwwteriyiwfjimtjdzjgo' WindowName: 'rnwuuwufswjzpswnhr'
ClassName: 'hhkfoyphhuexhzyuqhhkjbenvqu' WindowName: 'ujpmhoziydsdxjdwhwtielmp'
ClassName: 'gwvyabrydrxfiwvcbwbexpp' WindowName: 'zzrvewfgyrcovwch'
ClassName: 'ycwrvttwnlawellsqfvfut' WindowName: 'rivspoquioohbcovpebdxrnt'
ClassName: 'xqgexpwzdjygkjeymboohywdwmuu' WindowName: 'qwfqplsfuprlblirvrzig'
ClassName: 'yeezqkjxyxhhckqpzylsrrcdtoksixsuh' WindowName: 'igdwdqgemjntzbejfmjrmpjmff'
ClassName: 'mmufoxexzfkukasmvxkeizu' WindowName: 'sqgrwrtwufpajppocz'
ClassName: 'zmkmantjyvuuzbpcfgphwfdwnxtvfinbdv' WindowName: 'cfwlmbcsbtymymchukrzc'
ClassName: 'hjeshvkudmiptpkeqgcnsaggrnhhiveufljmaj' WindowName: 'ouekmwjfpebrfbwndbbxzgqarvouaf'
ClassName: 'xlisfeuhiabxalagqq' WindowName: 'vkjpfzpdwjodgkpbobefb'
ClassName: 'fbwtvekovztbhpn' WindowName: 'fvonzzfvlqjgfsvqearczgansd'
ClassName: 'hpnypiyrhbpouxuyxsywkh' WindowName: 'iplvfdxlygyazpnszamocvlgwqyrnyh'
ClassName: 'pgkrontfxdbmjcbfznagpsilfvpjsahulou' WindowName: 'jarrcfcvwdbmftowxbooxgyzi'
ClassName: 'ywqrnsujcmapftqtpzmwhsbwlbixwrps' WindowName: 'nwywlxxrdipwplfjjpjn'
ClassName: 'zthxhndejxsopobzubmejhqwlmh' WindowName: 'ktokuunlmoxbhiwgndfbvimpvhzvydigxvmcyp'
ClassName: 'phmteepmehtmrxhybqwchmkryitzww' WindowName: 'avialylejxxrziknttdyrhkmhq'
ClassName: 'nelrudljdlzxfdhlqeigzw' WindowName: 'qjwhhikllulyczrbkgozxryyafxfgz'
ClassName: 'eldubpplvmhcpzzxqjxexu' WindowName: 'mksclofnuvpdhtvjooooz'
ClassName: 'sgkjfmjifucpfmpvymhzxfzufxyxkcfredqvfr' WindowName: 'slecjomtcmtdbgulzntbalrzssedkixcx'
ClassName: 'nzblozsautxycrzrvgs' WindowName: 'tualzucvuxlcwcbnrcpxyjgwqoqxjscvppgch'
ClassName: 'qqwlswyzpckoxmrh' WindowName: 'fynbndexmjbdjjnlrbvhivctz'
ClassName: 'yqzfldgpfxfeufnvjlcengnnukodn' WindowName: 'bkkviinvcebqbzuedzcotkd'
ClassName: 'eumcgwfrwqukyaszurfns' WindowName: 'cftorbaijmqonfsbzskpsabdelkkuwmwxzmkfmx'