Trojan.StartPage.59716

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsv2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll
%TEMP%\nsv2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'enhbfvpgmcbupnemyjqyn' WindowName: 'rxbrvspdfkmmisryinjqrapoqhpthbjfhmfi'
ClassName: 'qtryprnwocztxkvq' WindowName: 'tewnpyzwwpkrger'
ClassName: 'ccttzqzrdovxbmbziycoenqzzzjizjgqpmm' WindowName: 'mfgodvuwexbdpdpnmqbtzshyscma'
ClassName: 'cvidckirvqkwznybxmfqsjpunxwzpf' WindowName: 'bpiboklsqtqwewfebfxvtpylqynvvor'
ClassName: 'gvtfuvrsrgclugciykdukgjhxxiod' WindowName: 'wosnsroggejjpmkhftgwfivm'
ClassName: 'ndurdbboqndvgvos' WindowName: 'exsmxwohyxyjuqocdqopealxvteowqsfhicrky'
ClassName: 'nkpwqluodgkzgpwxbcrskwzquxkkstknlpb' WindowName: 'usqfnddpyqkjsmt'
ClassName: 'ubfhkqsdhauhfuqtvocywpeolvvvcfwfs' WindowName: 'fpgcldybjtktllnofzzuqipljyo'
ClassName: 'cmdbgbxhiihlquyvfagnfjvkhb' WindowName: 'sspywceoacoasarfapjyehaszkuxbzxwsbhj'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'vstkzwgaojznyfxkpxnznmbezjlxbxrmkunat' WindowName: 'kmlfizhwtbjmguhyopkx'
ClassName: 'isvspgwpgtlvlmlhgptjzgldykpfanmldnj' WindowName: 'ynlfhemycmpdtsjsqrtym'
ClassName: 'adhozgmvtnjfcdbrejmcxpeluwets' WindowName: 'gdaevebgeualchepegxbsnabtdzaiooevab'
ClassName: 'cksyyizbodnpsztzhsongsjmpzvaozb' WindowName: 'cgkbxprrsajobygpeckpkrnxwruglqrprec'
ClassName: 'oigthysrxhhbkimrpdgoibisuyd' WindowName: 'iutqiguwplektpcqy'
ClassName: 'jsexbbfdxiqgclpbydcezuncvchm' WindowName: 'oysadqmubdgljnhgmzzqhsszlwego'
ClassName: 'tudxhoftupvsjfdtc' WindowName: 'fzrtnsgsrvzmuigjwhzkquam'
ClassName: 'nhjckkdiyfzvrwarrfgkkepivx' WindowName: 'ygnbchlilnsqeypfytpnummjk'
ClassName: 'jytnjcrofrgxcmcjp' WindowName: 'bawqbbombkuhuxvksvoyyhzksahhwjxknaesed'
ClassName: 'kitmlyabsrczkauces' WindowName: 'vdmydhxjoxrdnkpwqvcndnopnbuskiiqceu'
ClassName: 'bzjgftcblrbxguyl' WindowName: 'vzrlhjfuydfvnfgzkslzbx'
ClassName: 'ducybfvxqndnjoqbkilfc' WindowName: 'gdghylcxhytakkobogrsyhwsas'
ClassName: 'ddwovmfouarfuchuqmqfwihzdwp' WindowName: 'jxymtpmpezonobp'
ClassName: 'dxqwucoyhvvjrezzegbkdxhrrulcpspjwn' WindowName: 'cahcuxbzobfqzddzmnwdwfdzavm'
ClassName: 'bgxcwhojrovvimbrnpgobetxnyikppl' WindowName: 'ywuhtlkjliphdlx'
ClassName: 'vahdjrrvzqeroertzyliqyohtdyfgnfciqnxcl' WindowName: 'joykvpeantqkfsttzd'
ClassName: 'zmjjjrqkpfojplsuts' WindowName: 'duhackooubjsyiwupollz'
ClassName: 'mvushtzhevoeubihxioktu' WindowName: 'qxaqvfrtlclgkvyzzxmppsh'
ClassName: 'hubgrwhbcrhdqvzyercch' WindowName: 'oyrlyxiddtryrzorehmyvcb'
ClassName: 'zjkmczlnngoefcckreitoaomohjdbcgfzd' WindowName: 'ybmmkhhvhxnmzhrkyth'
ClassName: 'kafregsxwpncryduamldqehi' WindowName: 'svgvuqiztqjoblkgtnsflmljedjwrnfp'
ClassName: 'kopnphqrkjyzddulxzbsviyycyq' WindowName: 'tcwbyzgafgvdizbhdj'
ClassName: 'wwxttlfkldhouelotiwkcne' WindowName: 'zfeblfscdfynsdsaqyegpopvyeecofhyedryqip'
ClassName: 'vvfafbbhvvtebfymeb' WindowName: 'toddboacaylpaynjsmpmlt'
ClassName: 'bfwlhowzlrpwvixgaxoqrmrtnhbxjqqqh' WindowName: 'vcxebmagzutynenledfaadlqqjou'
ClassName: 'gywjmrttlvdjdndgmkdpijjkzsohcihpimnx' WindowName: 'ykkqrbyavpempcwjltkjfylgmrbmqjkrgrnbedk'
ClassName: 'skrfewpoqydlxkzrytwk' WindowName: 'nwbfglwanrqyxlipfygbobu'
ClassName: 'wckgyzwmpxopvdjet' WindowName: 'sebieqbrqevdntnthqjsnmcgjkmrwyzh'
ClassName: 'iekmpjifozuezppyqpsnuxoqupkipugbewbqlvk' WindowName: 'mlwgqvowtxrullizjj'
ClassName: 'usrsawcxtjlzzavcwzethuezqik' WindowName: 'omuvrpftayuybjnxmigssrapqhxyznt'
ClassName: 'ehybxyfggrksaxivnmscrssbmkh' WindowName: 'mnudypllmelfqhsfgavxijah'
ClassName: 'mhbhkinuxnhirmdaqqwznmevmlvtypnycspbfqo' WindowName: 'uuxqtcsenjpyoevfy'
ClassName: 'xhhasikwoslnakeuddyckwfmsbtojorfb' WindowName: 'rpxcmtdzbckzhfihxvvwjnrvnea'
ClassName: 'ptsrexchpxedwaazbeznrkvzr' WindowName: 'obrdhoxvhzxurkvpjzwwrskvdtuvtpofwecf'
ClassName: 'fywhhnjmxmcvbdroifzikutetonxbstw' WindowName: 'lxncvrvltfrtakhfwgqgofjfpktazcbnkt'
ClassName: 'rlsbwqnzyiuzgcrijamvozgo' WindowName: 'pjpmcqhdgrrhyqucqmbdkpnazgcrxaqupuzstf'
ClassName: 'qzvtzodobfxeaivw' WindowName: 'hvzjfpgsezsmxqsxqvapkgryjvvlbf'
ClassName: 'rcmkxakrswohbhqmmcukjwwpad' WindowName: 'hlymqqzgqfesvrvaafqhsbwbbdadpdhwmga'
ClassName: 'tahnsopbzhqtdslrodbmretmowvrgizlqjjanbh' WindowName: 'wisyzqpqsaspbnyzjwzewihcqg'
ClassName: 'mkrweechwxjkkkecpwmdkyhoamksmhk' WindowName: 'mcyeabykbxwieyttgjiaqwpxtwiuywvclj'
ClassName: 'lnvgtditiadknvigtgopa' WindowName: 'tvzlrzcdohbrzanunrs'
ClassName: 'tyjsvplcqbxzqcihjzgrelt' WindowName: 'ayjzoizpljaeqpfnazl'
ClassName: 'amrfhvvmjjvdcitjpouoifzpxurwn' WindowName: 'bftteheraokjxqhnekupxtxe'
ClassName: 'hdaqvnkxevifkcnapbirfuduzivsiacfmcud' WindowName: 'pkgyjbqkvukslpleojx'
ClassName: 'qqtguejalivqjtccwqeacaufkjrzi' WindowName: 'mbizaghwtcfgzyqhfoigtf'
ClassName: 'gisdjfylriusqipibmjre' WindowName: 'ymrsqwreofvejouxo'