Trojan.StartPage.59701

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsb2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsb2.tmp\System.dll
%TEMP%\nsb2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsb2.tmp\System.dll
%TEMP%\nsb2.tmp\Math.dll
%TEMP%\nsb2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'nwaojtvbzoejoabjvriqrvgnfriynp' WindowName: 'exrfhrcttcbahtxddfyanhrkn'
ClassName: 'pwmrzbtqnfesiuerizfdhcvknct' WindowName: 'bzndezsfovnfsquqxcutixqdbmoz'
ClassName: 'rxlslyqpjfohhaprwskxzm' WindowName: 'oyhamtivcnvrrhfwkjedafkz'
ClassName: 'dbhrxlqowqxsereylgpootnqgcfpt' WindowName: 'khzgjokcmekaqyxwczcwxkl'
ClassName: 'qkcqwolsisvxuyktnqlaspufllkzludgndjtd' WindowName: 'xckcnyhybbhezvtkhn'
ClassName: 'pvmczxcmfsdmjnnyiunllmwtn' WindowName: 'elvkjoyktedflrgeywtrhkrep'
ClassName: 'nbyckfdqjftnfsodasypghcydlinz' WindowName: 'jybciymytdtuazhizwzhhiojedcsofnywaoak'
ClassName: 'idjvajzpposupzveyptiayzyccmq' WindowName: 'tzshptizyiqodedlpkvmmfqlbdnci'
ClassName: 'neogdqsfbnxuqlntydqvvoxk' WindowName: 'jevnaioxtitcunapwurnggpque'
ClassName: 'anmebqpdrropfpmgrkhezmnugovtwldvj' WindowName: 'zsbbfbkflanmikyb'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'vdztdemtqawtkvktmpqqukmlpa' WindowName: 'ftzebuynknonrrlszpjkimipcgaibisvvikdsip'
ClassName: 'kwjofbcqkfqyzlzhuymnt' WindowName: 'bbkzdlvaingmwsghwabllat'
ClassName: 'kpusgfosachopjoepwsdyphobbjwcdziix' WindowName: 'lnjwcfriknbitrrcbqvpiquaww'
ClassName: 'yyvxdojmqmwelzwdgdyyglhhqvudacsgkxubhdo' WindowName: 'amupgurvsihgzuumagwsrdbbthhzox'
ClassName: 'osfxtovnabqunnfu' WindowName: 'pozzqbylejmcwuxo'
ClassName: 'wixevwvcrjdglcnmxohxeyuxe' WindowName: 'hmczhdeuilfwwrdfw'
ClassName: 'dohbwzcmhireubsmnrtcucyrayeoubgqb' WindowName: 'tioolilnyoonioaxhzthchixcskaatdcvg'
ClassName: 'xeqdmxdwoffgchssmzuornqqwhrwjfspvw' WindowName: 'llcpigqrsknkqxnoqpeca'
ClassName: 'yxtlehqfavfinqxpm' WindowName: 'tliasnrdczvqhzoxrhlqktxoh'
ClassName: 'ogtdhuhskdapcptdfn' WindowName: 'jmpfrsdrwiogrynselosguzawxifzxxqrmflcet'
ClassName: 'qgnjoyjvjfbbpbaemdbmocspnwlwgwikolflkq' WindowName: 'tkzqwsjmizrjjtylohrlq'
ClassName: 'ftikyynkwqteftlwz' WindowName: 'wxzsuezmitxxmeazsjqdzbcmv'
ClassName: 'yycqdlnznzhhehz' WindowName: 'zanfldhqqihufepfnlxoeoxxzvdq'
ClassName: 'didetceptixsgvyxr' WindowName: 'oshfnlchjellycjdparyrzgden'
ClassName: 'zggpbkmfeifyaflfnvjkststhrnn' WindowName: 'zjvoczvplyozjdnsti'
ClassName: 'zwacaeesggoddfpirjlzkvbdydbhwfxou' WindowName: 'cagwhvzjsucfhca'
ClassName: 'cgcguonclqctpetdhnmtzccnzouqhvbti' WindowName: 'yxlidzdgxcjpdjhuaks'
ClassName: 'nxxwcldmxtjefdynnjjitziaumkvehpertv' WindowName: 'fddfuacvumsiuqfiuivayxvjxootklcst'
ClassName: 'psoighspfhjeymchlqbq' WindowName: 'jgidhdukkemlszxlc'
ClassName: 'tdpeaisdxngbmkzxlzmsnudoizdhaul' WindowName: 'dyppyvaedqpsmnsgchpicrhibzemkgvqra'
ClassName: 'wwllvkqfkpwzwlfmzhziphagtivecxeroohyiq' WindowName: 'akostrlalatqkyzxzqqgkvzszgbnfgmllh'
ClassName: 'bwzxtcqourmhbpflwavzohpcywbfpywqjaglwbn' WindowName: 'oagfsrpfqhpfoignhkiumiykhdvpnpdqmcdwll'
ClassName: 'fogfegbuqdxlsoyaltavlngfgztuk' WindowName: 'dnjiacfdihargciekbeeiviw'
ClassName: 'kievkopfctkjshj' WindowName: 'cwiziupcrfnquenwonwedgfjbvsqqkcwutvo'
ClassName: 'npwkppqipbkcogkkyfhforesvcave' WindowName: 'ftktmeyiqdictowvhwvqanmrnd'
ClassName: 'gqiusblczizdtdcmlyaxcjom' WindowName: 'rxdrnuwafbgkseqqydmciopkbtiheusgfaevn'
ClassName: 'ydymllmeftapeuvxxpuaepifioyk' WindowName: 'cahtasycxdhfpdccrfpromlrtcubfrsgsjpo'
ClassName: 'jvwddtscfelphpmzngsyti' WindowName: 'rcknrawrudxorfwrfhcdfxgintnlig'
ClassName: 'enhrlpqtkctqpxfmssvmxfbyp' WindowName: 'tdhhuyynyvherozokkcumuahrehmvytypxzirsv'
ClassName: 'jokzrijcgtyxaaowdblw' WindowName: 'rapekpyemowkkuddpkvyymmsbhmv'
ClassName: 'auulrnzmzjlblnbyshwnqxsqjvn' WindowName: 'kxachbgoafdnfzjncderonclt'
ClassName: 'fodtquzuzyjvhmsmdiifzccsqp' WindowName: 'oxumnfmleiylwyrqkae'
ClassName: 'cjvjpptpkqsgvoisupyl' WindowName: 'ekrvkrhudrusocp'
ClassName: 'llrznyhnwngqigqugqxaniqibpxuarq' WindowName: 'vkrznlsuhdvmwginlpehbafr'
ClassName: 'juayafuvzgkqkjdax' WindowName: 'swffbytfiuqvdeixs'
ClassName: 'okyglucltkxjdiovck' WindowName: 'fjnsvdfziwlqrqroccfyzdt'
ClassName: 'clnlllekvulhtvnahsw' WindowName: 'qtbjjikcticcyvnvebxcbxdfoosroha'
ClassName: 'byctqgqqrqgrgsaxzxteayucnncomtblpevxyy' WindowName: 'fadaymalcehulrkqbri'
ClassName: 'opqdegvyazvbnvputysgm' WindowName: 'plkwugytkuzdnrrzchnxolhlfincikltjn'
ClassName: 'xqauynjuxrfnisjfgtcnuokatbbcy' WindowName: 'swafduvmkzimigzydxameitfguxvu'
ClassName: 'gbrachxcqegqedyamhjqlcuww' WindowName: 'bwlwwhestqnnlgqotudhsqdxcdregwegpxmewo'
ClassName: 'dxwqskkbhsfnsqlrojutdhosccorkleroggvtzg' WindowName: 'hvunxxdmjemgjgqvnihzxnqsohpcfqwodfzp'
ClassName: 'fmftmibbbqqtgrtah' WindowName: 'dpcyiafrdexpjssyivixwkg'
ClassName: 'wkdwfecpsewxrwejtojthhbwzevxadbgz' WindowName: 'pbnhjthekdnxkeltukvnwedfuwpncpi'
ClassName: 'qgmkqvksctvgdcmfykyyicnsb' WindowName: 'qqvmbxqkvctncykhupwxhzegyesgqzrnsqddjht'
ClassName: 'asxhglchaplthvxqmvqyusmalnemlfodys' WindowName: 'shfjmflwtuecszh'
ClassName: 'iiotnxiriqmliyltkknoslylq' WindowName: 'dfnkirymvxkqlqjziqbzqupqbodxrhkpkujjcv'
ClassName: 'xlrxsybnwuqxdlhchn' WindowName: 'gmlerqtqfqgbizpppkxbpzwdy'