Trojan.StartPage.59545

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsr2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\Math.dll
%TEMP%\nsr2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ilqmvrekcqkusvslojoq' WindowName: 'ludfzebckhtibehywgpq'
ClassName: 'xspkuzsqpntngetyvzovjqgljukkvws' WindowName: 'euakeaqoomrkhpq'
ClassName: 'sgdremrmeyxmehhbhfqtvclscvnyv' WindowName: 'frxjqdfjrjjzdvdrlbhoktwpemllfsfxlh'
ClassName: 'oyxmwsgucxtvnmkeahavgog' WindowName: 'pupnxfpisjymbgkmaeqpqkzulzlltmbvcoe'
ClassName: 'rmkfstsurkaeyjingrjpxetqptxfxcvqlkeezr' WindowName: 'cyxmfusuzvhhrxhvkngigs'
ClassName: 'tloroaersdrwwudqhthlyfjjyuw' WindowName: 'cbbvcjyqpcziphhv'
ClassName: 'tvkftggoadcbuwzsuxdmaojnjdihrl' WindowName: 'nhmttmggkdxbbuiihpgsxcbzzvcvvwuyi'
ClassName: 'qlranfduchbylnvnqbbnnqoo' WindowName: 'qnlafvouftmdcrsgbarpkxlczkuufsblsj'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'bwmohbrozkeqhjghqivxkjhsairdwgwimfkulj' WindowName: 'sflvwezwjxonkohylvdpcmsnmjxog'
ClassName: 'chnlysjxefznwgvxorancxicshniciioaotvzpe' WindowName: 'zdarqksqdddsvxnygxhmdb'
ClassName: 'dxefqsnzsldbimusijnpbgsaogqvbodrufnai' WindowName: 'ickwmsfbsthjplfrnaoldvfsjoqrlkyvkorpby'
ClassName: 'ykbrxvgnuuadllwqf' WindowName: 'jsniaesodtuunkmtfmyfpfgaqpsz'
ClassName: 'wxwhitotkhgeyafvbppktuklzui' WindowName: 'blcbeonqknodsfolsqi'
ClassName: 'dlkaxhdsxrkiwqh' WindowName: 'xgbqvhfaobgztcrukwudqeuyvukqitmavutzdo'
ClassName: 'edgkqvqwqpmohooedqnvgigeyeaelxhdbtbwdke' WindowName: 'xmosozhkddxlvfocege'
ClassName: 'buuirippwuxsobwsgeywqntqudkknj' WindowName: 'nubbiqbxhrmdfuwvbqvtsafgm'
ClassName: 'kcqstfipyhktiumiiz' WindowName: 'ziipdqzjjgzsgslgyugqqreaxfkxzkna'
ClassName: 'epdubsckzthpckxgylpkxjqjxlwtn' WindowName: 'vyqfzqlvnlqkdiuwddqsrraz'
ClassName: 'hgqqadcuxdhzopqbbxjbvvyfxdukustym' WindowName: 'zjayonndgyhlsbvtk'
ClassName: 'uqpsklansisdidqybh' WindowName: 'oigpcbryxizdsmktqtcum'
ClassName: 'ufjbbukhifwjnjafcpyjegaaxbyfqcrl' WindowName: 'xwhlrafimhflacurxuztfyfpzupjaag'
ClassName: 'qnegrjnpdrnkkxwvyjlkjjuocfkcajoqcjzrsb' WindowName: 'suzvrjjshigslzcqqxdsx'
ClassName: 'baecycsbsfbbwcm' WindowName: 'lribfvleonclzouuexokakwljxl'
ClassName: 'wpaxhxzxcgnrqevihnyjd' WindowName: 'hzlkkvogrquvkbmfskyrjnboamcatovv'
ClassName: 'klkqhiwfnbjcydtyhvbdumhbmasymoaahyge' WindowName: 'ezlmrotegeshcba'
ClassName: 'poevmhfelsxvybxiksi' WindowName: 'jihyidopdexrcgpmnqmgjhfclzjulzciakl'
ClassName: 'zepkqfmgzycutvwuamylrruwytreszfe' WindowName: 'dxxbxyggwzsarstfiycczxseamog'
ClassName: 'vgygoaxucqdbyjbynebcupgzn' WindowName: 'tdevyppmjmovyrymtnqjbzjemidfw'
ClassName: 'irkgkftqquqptgepozzpkbtmiuqvbvgp' WindowName: 'sdzmcenlpqhvztuxbnnpfsqpki'
ClassName: 'atrfuxeaityjooxdqszronca' WindowName: 'ozhrmzucyowxbqcuivpuprmvjov'
ClassName: 'yjgedcrbfmeetfathwhwhmgol' WindowName: 'rcecbzjdazrtgcatqpwlxzshbqwa'
ClassName: 'zkjhmunafzexeaabpgsrlps' WindowName: 'ogylnxtjkhjyyezrtgmrtrrabh'
ClassName: 'igtnooiuuwxiegrnujnpzpbqipskzgxbnwahc' WindowName: 'ehwefdoywgafhpbsbwuzaenefzkunnao'
ClassName: 'ccyqanrcekskcpjnn' WindowName: 'syzspcsbzefltcrx'
ClassName: 'zsaexaiegpltrigeustjybwajvczfaebz' WindowName: 'vsmllniqpvncwivbcpyqblfl'
ClassName: 'xtqwlalkfdeicpbluyyodksvbilkwnnj' WindowName: 'tawpcjcrrnsbfzdmqmnwuxalwk'
ClassName: 'zhagdwocncwdnfzby' WindowName: 'bensvwxdtetnzrcbfqrwbbjrsfploomblddhp'
ClassName: 'xgdoxjoaxifzrwntghmogleqrhquwarvmbpjjj' WindowName: 'gaxlwzpqqmjerkwqnmmuctsn'
ClassName: 'gswejsyeribpxsraxylwgpksz' WindowName: 'gnlwpaxnvgqiqxfsrovuefgx'
ClassName: 'oqgxbjtzpmdjadryojbwfaqgckash' WindowName: 'xlyqpkeqdoqpntfyegtrsvdim'
ClassName: 'yfhlurhbfhdivgeqbmhe' WindowName: 'legxvrzfclgiurdi'
ClassName: 'xkksqravjblrybknby' WindowName: 'rclssqfhsxsmstpzjkyro'
ClassName: 'vhzhozpzugdkhjgbsemkyteoshwtmmczu' WindowName: 'nfhtoatgqzukxpcykx'
ClassName: 'xzsbgyjfsbtrxklhqmeotiycpxowoanvce' WindowName: 'jrnjvuddhpkjyhu'
ClassName: 'seagadmqmosyank' WindowName: 'arghxrammjwbtrbbcfzuri'
ClassName: 'kqvgqouqeirimnoxkoiwupbwfvxhpn' WindowName: 'zixkwacwifsitkoiypuvou'
ClassName: 'cmylkjtzahndotqzoqkdymfdnmrdcummlaq' WindowName: 'hvcjyvmbfdcjeweyaqrwydqzmaybqlzptybraf'
ClassName: 'vlvkzlpehwnlowhcqicokc' WindowName: 'fztaezohjvrsamiqqyppxtaiwbreqsy'
ClassName: 'jmgszgwyksltzrvd' WindowName: 'betdckcbdugbgczfzoecyphnuqvhofvgwbl'
ClassName: 'agmjgaategajayioefhswczgthkjpndsavilfl' WindowName: 'rghmsemynwezipklavdrkkpz'
ClassName: 'eoigqsovzuqjcvcgxn' WindowName: 'pdukdbpfdmdxenukahldhupvpdyqxafoxmuk'
ClassName: 'gzcrdscqphdgkwgkeh' WindowName: 'egfhajetwvrgfsthofetmwmhetfmj'
ClassName: 'gxikdedhkjoxgcgbeljhyajrnpekxrrvopjfnrw' WindowName: 'yyevqfkcfogdwiwifuxlpgcymvptncac'
ClassName: 'xwnsuytdmjzniqpebeijyexekkk' WindowName: 'csfcctamvujzxkfutchowkjmlgkmwiwovnkupel'
ClassName: 'gegezmeijltafoahwqrbsu' WindowName: 'axaeiuqaycscyyxwrbjabxsniuzssrjnygemno'
ClassName: 'rkfimvwylgfjwgoxrdmtobsjllsezozoazbcy' WindowName: 'rhoksylvzslfkrbsyn'
ClassName: 'betbohyudadppyqsdtpufjejesddpc' WindowName: 'kiydmnzcvbsqpwenhttaceeqf'
ClassName: 'cpvrljljrvoawlwyexkfguibdykrtsikuaaoy' WindowName: 'mcgcuwkngqbugplsvjkuxjseeiy'
ClassName: 'ieogxkjcoatnkkkh' WindowName: 'sslpawnduvmhfciyagajxiwseueb'
ClassName: 'aolakddnusaqdewebw' WindowName: 'tjjsudapxmmoxzjufobl'