Trojan.StartPage.59700

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsn2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsn2.tmp\System.dll
%TEMP%\nsn2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsn2.tmp\System.dll
%TEMP%\nsn2.tmp\Math.dll
%TEMP%\nsn2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'lokxllknxnwcyndhuwfwqxeqabwkakmhszks' WindowName: 'idrfnsykmoavnwghaumyzeboc'
ClassName: 'nagdgblbjjkrhwkvwmznhxdpsir' WindowName: 'jhphwcmpoeuwzdhuztqmqcflshzu'
ClassName: 'fjowchnusuhpmskvdmsmqnvrbycstrymrkhyb' WindowName: 'xhrzgigucnpnshlvzft'
ClassName: 'btdukglxdrgeulfvc' WindowName: 'onocxpbvldwsvmxgpmhbkvjpbmifozogcksls'
ClassName: 'lzcemxhhlbdcmizdywbyprhu' WindowName: 'czyujjbjwqktmddanochahdhdn'
ClassName: 'eemltfgxpjjmlzkepuzn' WindowName: 'ftiqpthdakcixzawnrhyvkuitfspsrxolowjg'
ClassName: 'urvizmgzuxyrixgjuwbashumpsvc' WindowName: 'evgzkpabwafrbdyafnqut'
ClassName: 'ykwbtdqrxoinuoraqnsnbiihg' WindowName: 'vqfslzfeyflkvwrzvntywab'
ClassName: 'ipshpkvpijgkjsfjwsx' WindowName: 'wivlwadhngvokyjnaz'
ClassName: 'vrtpgfrtklwtzpsecmbdrpohxekscmgqnfnj' WindowName: 'ckpwpzakchuqgaqrauezo'
ClassName: 'zsbmesixgbeopwmli' WindowName: 'bisulsfjlodjfrfquw'
ClassName: 'lgnljngkbtpwwqgrhshadgqckycmdnmfqxyghcn' WindowName: 'rqnvlsqktjcmsrbyh'
ClassName: 'ydgkxqcrlrhhwwoobckbvjwvyxbjhphedafdzq' WindowName: 'hdmtmaddydqeispfhzihzbxqsmvtnma'
ClassName: 'hszslvaxwrmymmhbhygbubnops' WindowName: 'xuijxbewculivlyrzauzcgxvvixswot'
ClassName: 'jkfdmkzxfkmnyjl' WindowName: 'fiutbgqellqxfwjdbcxzuxfecghxjeamtnsfx'
ClassName: 'ipeqrzjenzbuzcbjxsvmmcrjvybefnoe' WindowName: 'dxaqpnppveytxhtssxmsgszfdlpegkwwt'
ClassName: 'jnoyyxpnziawnearglinyk' WindowName: 'nhffuyoeupbjndxqi'
ClassName: 'fylzbrlxcszglxz' WindowName: 'umkrwbmoassdghwdfcftwmhovyflpith'
ClassName: 'slmpsdgnnpipzrcgvooz' WindowName: 'wunbpzxkjhxnyhc'
ClassName: 'rlwhqnhtfuvzrcrjjq' WindowName: 'ymspedfjqowtewdxgdmvwli'
ClassName: 'qfpzwkynfonexqbl' WindowName: 'efmhxnpkxqpjsgw'
ClassName: 'knvtklbsehqziotbhekmhuegclkzihqufsxi' WindowName: 'ptqaydjgevytlkszcxrpftwo'
ClassName: 'flflaveduweccwhjjopooffqepfikxmhswq' WindowName: 'kyjvcxiedjmuxjrpyjqtxwunnsxmrpxieugw'
ClassName: 'lpejykgbdryqhgcjwktnbkkuoibcsugpmklc' WindowName: 'mwpcvyhqjyadbnmkkempkqwtoxlduwhrb'
ClassName: 'kaelsatmvewhxbortkycndthabciacsbd' WindowName: 'msduuurkmugdzkxxbbomqydrzcnhhfpchogepi'
ClassName: 'pzjdafgjmxzcyhhudsckjiqofgwaxf' WindowName: 'hfyztefmozlxqkxvrlbonkatuujknrf'
ClassName: 'ccqpmyzuzktzlujrrahcuueigg' WindowName: 'lkfagaxsqwubymaerdpwvrhiajqdfhehiwc'
ClassName: 'ajxwwygdftugscalvxvjvijtinpq' WindowName: 'avxnlhdnvrlyryzuxcgkthxwnzsawtlxsvngnvy'
ClassName: 'wtpvlhcoiyeykgnztpgrsolexaechfjirzn' WindowName: 'rqjwhgwtqisqvzcfxhszxnwplyyxw'
ClassName: 'ewdunasnwleqdrlyhznrekycvmirohmqjixur' WindowName: 'igutivwaxrecvfztmxck'
ClassName: 'yuxgksbfibwqdjcc' WindowName: 'bdyurvpttnrmwtj'
ClassName: 'jwqnwjqbxgpzopnoopfjuzfbybfatnkkc' WindowName: 'tfmzzafpwkzcutvztsj'
ClassName: 'frrfwvlpjyubwocvoirzdrwigppny' WindowName: 'pjmzjmphvaohjbeclzbsyxnwastnotjmr'
ClassName: 'qnmuxkqxvuwvlgdcdmedrnomyllekjkzmirjd' WindowName: 'bbatojenkqtjpftdomdoxdabkutbeniv'
ClassName: 'sgsjhsaqkrbbquxfopmutxjpqvhzx' WindowName: 'bjngolkqzmzewwpzylfbmadfhiecjng'
ClassName: 'rqlxzqbplyzadtxlousqenfkpomjgzxbashahk' WindowName: 'ihbsonqurfeircqp'
ClassName: 'ihrzfdysylzxorolucnzjosfwppupdr' WindowName: 'rdpveevfryabffevh'
ClassName: 'pqylylladpljubgaktnzoktylezlatih' WindowName: 'ukilhqvpyehmlobmtsmfktkiq'
ClassName: 'gqqopvxasbdmrtv' WindowName: 'tvmdzagvukemwcssoiegqeuiuwalbefymqiez'
ClassName: 'daqxrwrdepdqsqjktzolnlmbqtq' WindowName: 'hbuidkvcxzaaqtvorgavfagk'
ClassName: 'ckclkrysxdjztodvd' WindowName: 'khteioujuufbhnsqiaefmadmcmwnugnk'
ClassName: 'acqasfkfzmajxxodoekxlpsowvnloagfvj' WindowName: 'gonralsdcmqkqoybuj'
ClassName: 'uhjfalfsidjnojqpaamepkpk' WindowName: 'twscnrudalakxrlunrnrksibqdiaczmq'
ClassName: 'heanrjbfdgvacdccxb' WindowName: 'qielbjstdjlskxogeyz'
ClassName: 'pvfydyxewzqgvuq' WindowName: 'mzvizprpcglwdip'
ClassName: 'aexzoyoqfzcdrcqqqihaptquyokplvbthm' WindowName: 'prkmqzekhpkxvrofgmjhnuqhwkccgavakiquuz'
ClassName: 'lrwdjjpkexorfyolnuko' WindowName: 'bufmergpzvxffobriukinzbfucpj'
ClassName: 'ujapmoathfeuwpcccizolihm' WindowName: 'hgdlwssrwjpzodmnbrm'
ClassName: 'zwtobltpbfznobwunrir' WindowName: 'ptsaollhezlpipeezrpkuoy'
ClassName: 'kzbppqerztiyzeajldptjbhntjvv' WindowName: 'obynumpwpkpuvmopkxprybfkfsnsscrx'
ClassName: 'cmlwdusajbnqivcyxigqkhjuejeh' WindowName: 'bolmatrgyojfyotvgpwm'
ClassName: 'uhyyyikxekxqajdzppun' WindowName: 'khizskxcnkjeivyylzppedxzonaktgbyryzqzj'
ClassName: 'iabdjlfoyisbfhqsna' WindowName: 'abdlghbokqkzguagvqduuvxdeniov'
ClassName: 'sabnghopfmoqiccppa' WindowName: 'pfodlrovpidaejafemadwgv'
ClassName: 'dwkkexafxohyozqhwfpumtkvfneljdkiutfvx' WindowName: 'fnwymjwxatnbznnmdhtroqqlaaxdjagz'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'polllgavzomuymrvfpwviq' WindowName: 'aylqaysmtvowmayypfbhjfelqxa'
ClassName: 'opsvsdvahkiyhrfwhxh' WindowName: 'mxtraafifwpembtmnjspuqtkiwaymlab'
ClassName: 'odorqbvqiosjlltqofglmpqwwhdunwjjwnmq' WindowName: 'zdevrcxqlhukiysdhsudacaivuwllegp'
ClassName: 'avdgmqbywdodeknsjehp' WindowName: 'hmhfcrjbfagdiqywzruhyupf'
ClassName: 'mhucnqwascirndudtdtlrbkmbjfrlft' WindowName: 'nneqvwytyseruiiqiieubtlm'
ClassName: 'yhezodcivtwhfgaevfpihpfhxwsrbsg' WindowName: 'kelqqygeecbjhvuvtsmexgiwgv'
ClassName: 'obpatgavjyjdpxtftlvyiycgbyeogwfntmyf' WindowName: 'tzovqtaieiddrmbitoackgak'
ClassName: 'tlqpuiueofqxfedsjbexuketzhp' WindowName: 'dorxgoqjzcwcphmxcivvospibwinndcme'
ClassName: 'ptmcxpxiikqmtprhlncrbnnubday' WindowName: 'mwpzlzfvntutseruwzwupsakbvlrlxub'
ClassName: 'qhlxxnoscpwoyzefkefwgmttqunmqvkrcalko' WindowName: 'ynnxtzjyfjronvmuntuozpukh'