Trojan.StartPage.59711

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsp2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsp2.tmp\System.dll
%TEMP%\nsp2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsp2.tmp\System.dll
%TEMP%\nsp2.tmp\Math.dll
%TEMP%\nsp2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'rlwdfjyweyqrevhdavzrivtc' WindowName: 'hoiocvgudseczyjjvxt'
ClassName: 'dqadbpsibsubptucmrmuwbvsxpgfzkunzlf' WindowName: 'popspdeiniivmusqqnyhvocknvpvrggvliik'
ClassName: 'eghwabbgwbiswidnawpoywkmufx' WindowName: 'yxjyxuuzihlfredlvgqyzof'
ClassName: 'ohwptqdqcfxhzpazrss' WindowName: 'upjampnftrttkjagiqiiwtod'
ClassName: 'pvztprnwjzpwchl' WindowName: 'dtlburmacumqfhwcutmwmtpkkzknrzsbqxh'
ClassName: 'bmmobfjenizjdtinbizry' WindowName: 'ieeopmwkontzjiazzazjymbpwvthcadaqofdyg'
ClassName: 'iqngvwydhtumuuknhfsigqhxodfjyplukonxa' WindowName: 'rydokfltkkbxoybuohadqkgcxu'
ClassName: 'yaoljeurbmegrwyvmbsdmrjsoealvuuiidtbd' WindowName: 'kxrgrwnvaxnxkzkabdvjbxwuyf'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'bawnibppjldjzrvesdjsevhtkfmpfnx' WindowName: 'wbwafhlqkxivkohpgpajwbk'
ClassName: 'cszkaqwxfdwsjwcjffbrujfqztltctmhmmgstyz' WindowName: 'nidngjxepegddtqqggymxoufoaklyy'
ClassName: 'whqxazpfndabgwgak' WindowName: 'hxajsouunxqhtexzchvjozkbcnoeeumopxo'
ClassName: 'xkfmcoovqepbfkdkkql' WindowName: 'cdlfapudrillkreewbdbjbevv'
ClassName: 'vwaswfkbdwcatvltnfvx' WindowName: 'shjhpcjbfsoerlvammlpfhiffibknqclcygd'
ClassName: 'ozcaiezwlmbgsukbamppgxssc' WindowName: 'amtgewrlkgqscerwhgyzp'
ClassName: 'qqauyowradqkfdqyzrnhhghjybil' WindowName: 'altpyclbsnqjoktpuyqobpy'
ClassName: 'ifomxmbybffmhoaanzlxhkgjdicszuzuqvm' WindowName: 'ayrentmfjjppqyndpbxpnltetb'
ClassName: 'kqcoerfqtwrhgbvs' WindowName: 'rxcepbqvmcbahqhwpitz'
ClassName: 'ehddrdpbmodqkvgd' WindowName: 'arnixkuuwuatuzfklvdbl'
ClassName: 'ythftoxcotdvwidd' WindowName: 'iusvrtyoaaumumegqdbomidioepafmbpqmutx'
ClassName: 'cyvmhfxibjzgtqnqlapaowfkfydmgkrfklmvlc' WindowName: 'nsrraaystqbtoeetiugzwcytwvnrdrmpjcuw'
ClassName: 'dvyejfvdrgdrpbosegznfl' WindowName: 'sqofsbmtxdeipgvkwnugmolqlzhpnpphbjwl'
ClassName: 'remkgqsotmroeucpolnioc' WindowName: 'elqmbbjhnajnlpblmsluvognixh'
ClassName: 'ugpufmjswiqzrvotuufy' WindowName: 'kuxylmvfcihdltbouuznstlahmxuqf'
ClassName: 'lvgrfmlqilfafdodlkhouhbofpm' WindowName: 'wkadqlgtgipftgizoiixzhxapeeimsqxicqrtgc'
ClassName: 'xweojwejrcrgwlknqqnztjvhshdixtsbnnsc' WindowName: 'ahaenzxakqbdccwtxgjjxzj'
ClassName: 'edyjsopekdxyewqvalyhahadgwoxevndntbdabk' WindowName: 'qetbygxhpnztmzikbqxoh'
ClassName: 'ktpoesesugiuanppvkzyrqkiyeajnigxjemncl' WindowName: 'fvkzqltcpewmdsicqgoqbtvhlvxjdtqchm'
ClassName: 'egdtrxzmuycptdncgz' WindowName: 'ajfjdrqxeuhyzwxhxqfsttkk'
ClassName: 'kxtgjbambobkapytsmbehlfmiahdwxzgakkh' WindowName: 'wrheovmmaaivblotfdsphwge'
ClassName: 'lqftzvqhncalwilt' WindowName: 'hhkoordcdaobldhcwpowjhfmqvtpixz'
ClassName: 'vevgxafbutonnxrxqjpgazegmgvcwerwuwina' WindowName: 'qtawhdaqrfjdtute'
ClassName: 'bxwfwgctjmmrrqwmxigfpqiutvzc' WindowName: 'juilvkgzfkdhyeddaagrbuqaqqghistln'
ClassName: 'qvbizmhsvjzpmkwrvcfpljtzun' WindowName: 'obcqfcyuwxwghiygsykvitn'
ClassName: 'cgejfectbukmbfjuin' WindowName: 'gxocdeshlnbnjkxmsyjxhjkdanfyyy'
ClassName: 'njhjtucpxmfdscjyqsbpeyuwgkfpjjfdrgtut' WindowName: 'nxrtfkqryfpiuvlv'
ClassName: 'ekqqhlcawrtqkartxgrnrqljfidrwdo' WindowName: 'ayqvvcqykwudkapilrof'
ClassName: 'txtgneddxrjvisxqt' WindowName: 'aaglauuqrugeegmklmncazvuiweu'
ClassName: 'tlruzydokjzcklxafeldozrshocpvejiy' WindowName: 'uwnqshtoiwnratszddilsnycrjiswxpiuxdhe'
ClassName: 'ymhobaafaabvflzr' WindowName: 'aoudwpozfndziehvprwgfdabjaoexbn'
ClassName: 'uiulgueyxsojwnivadlzy' WindowName: 'rkrmydfmzjwbcqldoihwmcueyoxrnebbvtvkhkz'
ClassName: 'tvjzdsyjatzzkpq' WindowName: 'qsjddattyrldvmmzgnngvff'
ClassName: 'ulkhvwidwckjwqkwlqdyxiqcpfrnodwhxezqyj' WindowName: 'zuxaimqoptrjnhlybdnt'
ClassName: 'ihjandqnahtjinrxrlqmlzzgzcy' WindowName: 'rerjvlubtoypijhdjeysegnpzlratcmsaexu'
ClassName: 'rwwlzddlglmleqzvuywba' WindowName: 'rozpbhfapaziyzozygkrhqthintq'
ClassName: 'ctsmvlusetjeohgsxcuhwzfxkskosspo' WindowName: 'mngivqpykdurqqwnuheikewouqkkqowvpfczbqa'
ClassName: 'ldlvsswgxbdrvhbuffr' WindowName: 'ymucyyproqzkkgt'
ClassName: 'kptqwksmehjgamxisxxojgxdijfus' WindowName: 'kunpxsymgutuziolttvrrdpgo'
ClassName: 'xdngrycagtqasrkdjwygyg' WindowName: 'cfnvpydldazhsefxcylodbijawoj'
ClassName: 'lgmuxbtnafrsiaajgbgtguuvjnkubwsb' WindowName: 'zpvqmsttharpkcmawjhjrkmjmmw'
ClassName: 'gszsesyzmxunrhtbfrxhqlch' WindowName: 'vuaaoocdeqrkqwa'
ClassName: 'wotogzcwxinppybxklly' WindowName: 'syapdgfpboxksiutpwpxuhdocgmgfo'
ClassName: 'itbkrotmbeoxypfltatlnxacmkbtdgrnmzupd' WindowName: 'dbefiuplmqyobblag'
ClassName: 'askxuowxkmjghlsmozdxlhfsrak' WindowName: 'whpyxdcsniwihvhmzopqdzibwflytstxf'
ClassName: 'icambwlfzraelgcffrfwpoawvjpeahzbhyspz' WindowName: 'darbfvgpfpgbbjlbiyogqgx'
ClassName: 'dlxonactgwjeyytljxgppgxlxxvxoqvtu' WindowName: 'jnfliydiunsgwnymnqsjdn'
ClassName: 'gibznjbdhaoljxrahm' WindowName: 'mqfeulpfxhmvilwsngrlcpwomwokocowigf'
ClassName: 'mmqisotahgvloabpxlfuyzitylxncqwcv' WindowName: 'pqrvhrhjfdwpodbhbbsipxvqh'
ClassName: 'smldqvntesihgmogpdsqcmzterrjzuez' WindowName: 'ixjbmrrcbarkdfsqqpcvsxikpzscd'
ClassName: 'unittstgltvcaqpml' WindowName: 'fmjzpemfgiclvfqzeaiaelki'
ClassName: 'agsaisxbwufozovejmp' WindowName: 'sdmnykgnptordazqmkdpgj'
ClassName: 'lofgvwnhexqrjbgeudybz' WindowName: 'epoaeiaxbzlovnjewjyxrie'
ClassName: 'gaemjapelzgahiyeagyfwvnqjszedifiatuq' WindowName: 'jjtcecsyizoditarvkvnqfawmvzom'
ClassName: 'jbtjjnlsakifbhjfsrqadwngigo' WindowName: 'evlxsvziwzdscmiyiyemxmhnxjzx'
ClassName: 'xgfgjpqlspcjferfwtlwiojdcbosbgygdx' WindowName: 'lzkvoovclmjeyslauicrpseacuaa'
ClassName: 'qkxwbnvglsjkhmzysqlcnhjc' WindowName: 'ameoycprycdrrqpcqywjzynb'
ClassName: 'bzeepeqmyhkofhqn' WindowName: 'xpaegddggqqmdtvvxarvn'