Trojan.StartPage.59550

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsg2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsg2.tmp\System.dll
%TEMP%\nsg2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsg2.tmp\System.dll
%TEMP%\nsg2.tmp\Math.dll
%TEMP%\nsg2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'pctwzpsymfygdzmrjzftj' WindowName: 'pdpktzgpeppawmlxpoquwlecw'
ClassName: 'zqxopqhkxqxvojtrdjeyahbedlfaxvmevwiuywf' WindowName: 'zabaxdxeuxxnhamhwhbteejzsyeukl'
ClassName: 'irquxcxjmzdhaayq' WindowName: 'wyokinequbcayacggh'
ClassName: 'foghlxfmimjisyzhsqvajwli' WindowName: 'pcuzggsblzmdujsnoqrt'
ClassName: 'ponmllqhdjyvdnvbatxbqhkkaklzvyolanp' WindowName: 'nnwkmdkxdsrzxqazzfjijlycdcvfh'
ClassName: 'qyujleqjfmikwdojcgmweotvjbmslndjedeks' WindowName: 'uocksvxvluduczaoroohqbr'
ClassName: 'wxmvsglwuwjhzpjjnkqmppoejyp' WindowName: 'plikinbhdetosywrnwahczepnbhpxds'
ClassName: 'gnjevajrshnwzhil' WindowName: 'irdeesylpasyvpcgvxj'
ClassName: 'umwpapbqkfowodiribjeavibbciwalggniapiml' WindowName: 'eyvfjqwfzniauzo'
ClassName: 'dbzsydyxwzonuvfpceicpfvqad' WindowName: 'czifunvpjtciyepiwytisutuicrequw'
ClassName: 'cvpmwklfyyrybkrpirvxmlhxszksjyjjrxy' WindowName: 'tcucbnktllkpphnbmtufrdxasmdwjbvky'
ClassName: 'tmmtzfmsmzgqahoioblsubsifv' WindowName: 'ftqqftxdmjmgruroxerdbmehsdu'
ClassName: 'nbwhuvdcfjlgqjpoiecqylfxu' WindowName: 'wjkfkwdhwagmhzrwwkhsdvrwzvlaitmebcjuo'
ClassName: 'djoulbqcaoshfwysdopdgdmsfzgvhzt' WindowName: 'svmjshbluglfqnujuxal'
ClassName: 'jhyrskxjqoivotbi' WindowName: 'ulzxhybyqhotprxullcqulzenbxtnybyfnqjtyo'
ClassName: 'zxehqzynxejwrpvf' WindowName: 'mvfckejhzrhimiikyavlfscgjufhuixsv'
ClassName: 'nccjywkudbrsgskfmlzq' WindowName: 'dubfptorwrdmswfpmguhnegdlshfdgsfqbgmwz'
ClassName: 'vmzgtgodmivyxnllrk' WindowName: 'wxbadpbivcrkgepdkjntmkliapxhpm'
ClassName: 'gavobhmypfhszmwgcvruypvtlvabwcbvxfxwkjr' WindowName: 'xglpysnbadlkzijmhkaetsumqziojmzdymwyzc'
ClassName: 'ekstnhvdkihtguvlabdgkzqp' WindowName: 'tlltabqylbimboskxdqvcefkezdjd'
ClassName: 'qkmojgcsqloyelvgsnljjqqiozm' WindowName: 'zfnvcrxwnzdolknfbfjksfmfutyzescfott'
ClassName: 'pgaolrviqfvllldseqlulfggayevedqu' WindowName: 'fafmdjwscnmnymlattljzzwjjccyogy'
ClassName: 'hwehtmmxogoyomqfibnawdb' WindowName: 'ujyoydomjmdoaxchajrlmfkbeco'
ClassName: 'jkllqcixqzvoidqyvupwjpebvpfcimubip' WindowName: 'vhvlepznwjhdjgnqnrmiivbigkar'
ClassName: 'fwichyjlltssounqbzazwhchcysvifgll' WindowName: 'oruehxlaqjdmnvjleacohlxlbfa'
ClassName: 'kkyilcpmolcrahecfqwbvlloldrrgdwwjwb' WindowName: 'tliwamzmcqmsfirlftlrdfklbonr'
ClassName: 'dyhrzucqqrpcdcug' WindowName: 'lmzzfbhoipfmgkq'
ClassName: 'sahlamvndxmjvalhuxlvxojxyqbbfemlmzrrhb' WindowName: 'akrlfroyiojmgntsh'
ClassName: 'bfjjasrcgccrbincqsigrqpqnimhnrekyl' WindowName: 'jkfawfllwgrpwwnekckjikukfjiaodwdxxya'
ClassName: 'jmrklcaethovlsgad' WindowName: 'widgauaikljgahys'
ClassName: 'clmryuojfbgxtytnd' WindowName: 'iywrpvkksftgykrqmdrblzdaxyelebhsftcjq'
ClassName: 'vwhrbcefkozzuujplhkzqamhjnvvayggzoemm' WindowName: 'isxzcvzlzchekpihylmiiapvj'
ClassName: 'ngwfsvonsqaosjxdbrvsfps' WindowName: 'hntyhcwfijznpdfnctholfympmccbqbb'
ClassName: 'olehzqgydsbfzsgbhaolghnpldqmor' WindowName: 'srrslpfgxlpqxitxvon'
ClassName: 'ayjzybgeftwrihoesfwmqxmczekrdkofsdrncq' WindowName: 'dmpnzcjmgbsnmodznj'
ClassName: 'pwyxtoihmpfpodjd' WindowName: 'brkoxtfiwcsxhvudojfuewtqnfuiidrvmxj'
ClassName: 'anxfaqbafksbotl' WindowName: 'whjzuwfgfvrpeagzpbxcqbxisolo'
ClassName: 'ywyczvegmuewelrxiegiugscqanzsk' WindowName: 'efbmfqbkvlmknumxotdbrgozzpykmrsntckhsru'
ClassName: 'eobzkmtxguyiprqntwgsckaysuzxyttydpfataj' WindowName: 'uchwujtugrlhstsjjiuudqk'
ClassName: 'giebnwumrdjdaillbdgtlqeqclpw' WindowName: 'skgyjefobxdzmgigakjrw'
ClassName: 'cshmxamvhipenshsqecrffobxvmjkjnyxp' WindowName: 'cgmwyuxpokmssyyawxjgskmknehzfvh'
ClassName: 'gugxwjwsvaxyxlkxtkiz' WindowName: 'ivioueuuqlgwlsmjgelqxhtwvktaqbinupl'
ClassName: 'nsqztpnayzzltsxibolgacoymyquphohjnpoglt' WindowName: 'vmmrtdewqsghmihsfxrimmubdoscp'
ClassName: 'wprpohdykeraaphtiz' WindowName: 'qacangywsmzadflzbifnwodtvmmqgoroppep'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'qhizarrffsaogqackhaxermohia' WindowName: 'kwtixfjdegiocihyxpgwfvggmysrhqpurauao'
ClassName: 'tgbfpfmpukvebxduulhinfk' WindowName: 'qbjqvmuslxaxgrrk'
ClassName: 'txawywxjbjqggefegafkipmspbfoxdyo' WindowName: 'hugfhnbnegnjjizoxffhaotk'
ClassName: 'qoiporngtcqgctruhdzwktl' WindowName: 'wyoojomsspwqdhwpqxxlployracrh'
ClassName: 'ahcorsnxunfkctdxjkmealdplbdqhpfyyvtyl' WindowName: 'ldmqthrydiugvyrs'
ClassName: 'cnbxmermjpzepzvbqrfvhegzzdoyksmwr' WindowName: 'jhyrnrlmwjpmapimqooskbgjfkwdiivzju'
ClassName: 'zrvrdmzawmktloazhohorqllndwayga' WindowName: 'sdvnsczyphahmaikyqmks'
ClassName: 'pefruttxdyoifkrmbhglpdkknuyamgbxk' WindowName: 'stzmkxiwgmkiusnegvqfsjigju'
ClassName: 'bukbewcenhsualhefugo' WindowName: 'qtjwdtzrxlioymukkwypxsgqwlcxuolt'
ClassName: 'krbsurodnyqpydrtcnmwccwvwdqqt' WindowName: 'cagfhehtwprlqcjsnrchvfiqars'
ClassName: 'gnunuzxazhningxhx' WindowName: 'lvfnbeggostjfcfaeyre'
ClassName: 'okqovvjincwiibwkeviqafgpji' WindowName: 'lyxxmunseftppttadiawobmlyzrrd'
ClassName: 'wovpyrvxonuipwiviygfpbny' WindowName: 'yemhcuuzarqfskfdi'