Trojan.StartPage.59574

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsi2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsi2.tmp\System.dll
%TEMP%\nsi2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsi2.tmp\System.dll
%TEMP%\nsi2.tmp\Math.dll
%TEMP%\nsi2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'cvoqpzfomkfaiqo' WindowName: 'yhbrarjnoakwhuynhrzklhifargwwbnignuc'
ClassName: 'ykwllcqpkcdgrmqftcfjddwrgbjfaqjxdzxyoo' WindowName: 'odtbsgbbilkfjehnnk'
ClassName: 'ohptfwhqtpgpvdbjzzeofsnkab' WindowName: 'mrpoaccsarzaghbelwwiehzrkzoascjvrtr'
ClassName: 'wxexamhnsmqjytpdnwyceiouypsqbphjcyyvqvg' WindowName: 'yacnomqgicsatselpelip'
ClassName: 'bmuwffwbkevhzckzudhvdxix' WindowName: 'drdujpzusofkvvhamw'
ClassName: 'jowacrkrofdwiufchairsbhmfxxytmhq' WindowName: 'pjfywltptnusntuiaxmmbdlbrdy'
ClassName: 'ruqjzxdrmmnivqbjussolyempnwaluxrrsjagzv' WindowName: 'bjurgayhiizmuvxeyyi'
ClassName: 'cvcowsxlczxskpbnnyqnevhqnmzsgk' WindowName: 'dcwofqmlathsguhczrkwicmevwrwsajhhabxkk'
ClassName: 'wmbrxnozqnzsatsw' WindowName: 'kulkfgrtlgylcobjvjzcehldaidlbxi'
ClassName: 'qbfrofwiestuximejjweieh' WindowName: 'refkcczkestoegaubfbkcklpmcctojzdodetd'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'utysdokpubdwqzhtrhfpchji' WindowName: 'htkgfsuacajlkgcnrajo'
ClassName: 'myqgxbxohnpqyvtxozasvfpznnih' WindowName: 'hypzlcpkaemaiklqe'
ClassName: 'ptnskdgmfwsfnuwgwccofvvnlnudzwydeukzrt' WindowName: 'erowfpqyzwlvkowzznpzfrfgzxy'
ClassName: 'fulfgbwppphqwyoojedue' WindowName: 'kcripfvxjtgovmeilcmpayxbvul'
ClassName: 'rbinqytoaoyawmzwtxkmuwjfycgivbkdcsvuja' WindowName: 'xsprrlhfmyjpfnkvkyitzajw'
ClassName: 'llnqaxhtupcoulcxuuzgklefbpsins' WindowName: 'ukzalcfnmghyqvvsveylpaupqymhervyjrqav'
ClassName: 'cfauxjpwelltsoshq' WindowName: 'wnsjbixpyzbdrqwkkhvvvmbz'
ClassName: 'ezqrfavbmwmtepqnaipjichyxkicwb' WindowName: 'pblysibjjkwzpcvayfrwwralibfw'
ClassName: 'ltutaoyelvksehtjgpqqafhv' WindowName: 'bunfkolfujipagezcrxxmlh'
ClassName: 'oduvicdsofkgdqljkgsmzcyutpbrwfwg' WindowName: 'lhbkuexkkdqmjeydueejmtnvkawx'
ClassName: 'lqrwatskgswfkzchvtcnlgpaeuvvcogovhryr' WindowName: 'eyjvfolzzrriaaqfqwhj'
ClassName: 'rjoxoloiiciilwuzsywbykkcmr' WindowName: 'qizspgnnpogapikdwuyjewmtaauozwb'
ClassName: 'iovsubfscpvtjuwwqwrf' WindowName: 'dilrguseixcoogbtpi'
ClassName: 'dbefoiefzslvlwab' WindowName: 'gczrnylxxyubwrtgpwghxzybr'
ClassName: 'fnrrinthvfnnkqdieavikqlpjyoune' WindowName: 'hbaisokqmpazqjtsrpmzmoruqutuijknxex'
ClassName: 'bfxhiftvrjugzfxezstzcsqchothcfzddmhzhma' WindowName: 'whadvcniiztvcyso'
ClassName: 'uxsrppjrhqtqbtlipnatcvcarkaqfcsp' WindowName: 'kzummtwiemnxbtezzm'
ClassName: 'upuazsfzunmdzhlygydcbwgdjtmogqgk' WindowName: 'rahcbtgsrlxajxqhgzdebbbkpcgvcuyam'
ClassName: 'hyyfidynkgybqiwtdjuqplvonmszieznwpmp' WindowName: 'ggghalvpjsseyptjnsxmecuuaodq'
ClassName: 'knpbaydkhigrtkbdvsbapgopgdpqfqylun' WindowName: 'pjkjkexltukafrtxgzsdgwedgiclzqwg'
ClassName: 'fbhyvnfpoxjhhndxqarazruxehobswarcomta' WindowName: 'wkhbwkrsoauveijtdgecaozfyihzzevvahm'
ClassName: 'wooheyfchocctalwrorwqncommays' WindowName: 'vmhsbskezlrjmvzxsuwn'
ClassName: 'tplyuqlijotnqgcdjdenkpuhzulcfhnizwu' WindowName: 'ibydoiwvwwvkusyntbuxeym'
ClassName: 'gctpfmvpmiizpdz' WindowName: 'gdxhmplwenkquajudpokghvirewylbisvpplcl'
ClassName: 'mvzmjqovhiutrpvipgkln' WindowName: 'hpgnykstiqiwhfa'
ClassName: 'zdjocxnqavjbyhzcnvtmshyfcsea' WindowName: 'idxyhyqptdzgxmatxiawmsvgxnymxewycsvoj'
ClassName: 'qsdjrstyeqpoqdufuft' WindowName: 'rmfxvblcioimxwrehvxtvwqjqwxzvxvl'
ClassName: 'ofhrhzotqhjydzpn' WindowName: 'hlvbdkdbkucokltqshkfusjsmmxbgkox'
ClassName: 'smmcfhbpoqyenvpdzivjurcrviroedsqnfwpbce' WindowName: 'trezigemavzqvhvokzamznxzosms'
ClassName: 'xqiooqqdmvyxfif' WindowName: 'htszvtvylscvfkrwmvskjzoyrxq'
ClassName: 'gltzxpcvbdbffchroxffhogwsdxucgbofj' WindowName: 'fazrsmvajqwmutetbvtgzoandfiaxozazs'
ClassName: 'zqyuakuiastnrmqulhklpxmzunw' WindowName: 'zeyaewgdgezqeonwxhfkbhc'
ClassName: 'ittpxshnxoyohopxspqkanzhvjdqo' WindowName: 'srljiyiuprkfkkwuannkmvmhqzyqfeczguar'
ClassName: 'ejdaxdtivuymfvbeaggyroajzxrihdse' WindowName: 'vgjxbxhkwzhcvvitqvzdapbrotpprlfk'
ClassName: 'oevslbfrvcwzoobnwzmorieatdd' WindowName: 'rmgnhawumevfqyortlorzfsourcsccrunfjma'
ClassName: 'lcamwquprrtzsox' WindowName: 'qnqdkhkqtjsipzj'
ClassName: 'pqpplafziamagdbftddpn' WindowName: 'surrsbotaqowupdixpdhamdfvwzyfrhvsniqjrs'
ClassName: 'bhoaibdmfctlffxekautigznirf' WindowName: 'awmjvvvzincuxooetbsgf'
ClassName: 'iiymlfvwzvuuwlnoezuvuvqaqvvlds' WindowName: 'dhixrmqrkvlxpvkgljgyipxuod'
ClassName: 'jsckvpparmaspenvdfq' WindowName: 'bnrwoompvidbvbteo'
ClassName: 'sjlvpngjmowqvjksobgmocooabhnbkwkuwrkmb' WindowName: 'uskhuechermlbrx'
ClassName: 'esblnrcoizayhzpbixjjxh' WindowName: 'hjwvowshrpgfmjkwjmsonfgpywhoijvfknix'
ClassName: 'rcjqtnfljniatcnmvoqpxhhequkvwksjhbiuy' WindowName: 'bkoyzqojgqlmtsqmmamfcad'
ClassName: 'ggnoahmfnkujghycpsumnqkpfpxjysdq' WindowName: 'dzxocgwhejjpkhxsevlwmrzzkaqnicc'
ClassName: 'wpdfgetehcyxvepyokxliypmulkgtgmql' WindowName: 'vgcblvorqixjvwra'
ClassName: 'qdjlbhbzknphpyiwpgcidgzpmvmexsptqrmgid' WindowName: 'soumpzzgsjdeqjcpblihzgpwogiepij'
ClassName: 'kjiqnpoyrfylitvaezyftjewitlgvhvhcyzn' WindowName: 'jbwlbydjtsasybltqkgkvfhsggaqlbori'
ClassName: 'wvcxcfsvlqisuculdvbvqzmjpwszvtvhxz' WindowName: 'ctfwpipuezrfxhyvcpraqni'
ClassName: 'uprgkhfrepcqjvwynnonutmvgdcsskbkezlh' WindowName: 'rrexdupxhajvqmipopjei'
ClassName: 'zhkqgawtmabwftronkajoukbjqncrpo' WindowName: 'eyjmqpwnobpmhpdfbhsuwbjxqblxbobrkgxkdbe'