Trojan.StartPage.59715

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Desktop\Internet Hao123nknk

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'hiwzjdxfljzbkzhiyoqsbseu' WindowName: 'dudzslwhllfktyfpdavzspjdhxm'
ClassName: 'futxbnufnouykuciqaofwmoxybikvl' WindowName: 'pdhfdyauhirwtzlmakhuphwksrztvd'
ClassName: 'kekcpiuqokaytjjc' WindowName: 'zrochrosijgnemgsekeorydgi'
ClassName: 'zncsmelghrjxkxzvykotz' WindowName: 'jbkijhehelkuyygywfldauvycyqhtxzkow'
ClassName: 'vtsylcxdwdwniojkdjrp' WindowName: 'hekrjetdngugkhsfsrx'
ClassName: 'lfqtfthldrzhecmrk' WindowName: 'rrhdtdbqaqxebxhufxainvuijwhvyibfwkbfuux'
ClassName: 'zrdcybigefhlpzesicerhybkg' WindowName: 'bzytbbnhhohqizfwoetlnmajf'
ClassName: 'hlbwhwmlbpuzuptmfiokrqg' WindowName: 'kuzkmabbyvdfvbuaz'
ClassName: 'eobgfhdhjvxasiphvwrmbyfmgepdzjpnnqdf' WindowName: 'jhihmmirxrmegcyxnijlnnsdidzkmakpcq'
ClassName: 'ompapwcybfulqfzbrmrgikbdigbnkl' WindowName: 'qhmaosihdlywimmuhibwplicaolxyfmrkag'
ClassName: 'uveudsbvisgchfzyvsgqe' WindowName: 'gjehjccfypqjdqybtpcpezorquyfzsq'
ClassName: 'fzrcsadgzrluadenianrwb' WindowName: 'zsbfzqxjfcdoxzp'
ClassName: 'ufheiixhwbckbaxjacwuvuwuz' WindowName: 'xzvjgfdieqapegdbw'
ClassName: 'qjjyibshofwqsmrwx' WindowName: 'ikeqhkkvstrvhiwtnbzcupmtxkno'
ClassName: 'lknozzsylbspohrhemepxhx' WindowName: 'lmbhtxmndttvfpbazzcycsxjdjwsoinu'
ClassName: 'axoxmncepblsmsqmogjdknrsbhfqdc' WindowName: 'kvccxlbdunuwmtm'
ClassName: 'fxvxetjifixqwunzmrielyyl' WindowName: 'usqvuukhxxpgyvclnhcfxuqtkrvrnv'
ClassName: 'rqsbzpvjchhldlhlglstaikua' WindowName: 'svogdyuwarmqhqnqejatnjkcgdxrbfszegsuevb'
ClassName: 'zvxwqxtmocnviuwnbucpxpynhvlwdsv' WindowName: 'gaeaprfxyiiaiwxijtruycawhvekejqrxnuo'
ClassName: 'pfeyqhjlzlakgjhey' WindowName: 'kuzydssoqznahajykjalelhliriwgrf'
ClassName: 'umhcjkktcurjlntwuyffcaqpfhumcnuwgwvs' WindowName: 'jwbzrkgxkkkqpvrzddrjgotgbovkjckfniu'
ClassName: 'mjefdjgvpkgdvfiehwxeqkud' WindowName: 'bzmnialfuzpxdfblejc'
ClassName: 'cgkcdutzkojxlae' WindowName: 'kfhswbxeoidyhagjbbiwe'
ClassName: 'pqhdfsefnugrbfrotcfctoftpyaxiavlbm' WindowName: 'wifwimiymdqvsybklb'
ClassName: 'aujfcowstfevfupm' WindowName: 'yiytfbtdsausija'
ClassName: 'vblftwzonhcxqubcmqauissvk' WindowName: 'fzenvwpswdlurdjgbdxilseczferg'
ClassName: 'wovhihbmzymkyjxlkzc' WindowName: 'zzjxwgjrgdnbriljqmryssjagyiqgdietkfcms'
ClassName: 'gkbeojqacakrtnkcztslmaiodtaohmttjeh' WindowName: 'mpsxysrwdzeinwrqyptgdgpsjzcsfktyo'
ClassName: 'zhfbmzuluexumfqjjjpyqwmbposm' WindowName: 'nnqvmqpsjcwavlmopjpxrpmnkcsokrtgvkepkhs'
ClassName: 'bbzvtuncgvdilfnhm' WindowName: 'gzzzuqchtwxgzwprmie'
ClassName: 'bxbcgmbzxdjzwpqqzpwnopnvwshpbbu' WindowName: 'cfjmytueyopafobiaqvgxbjuyqfizvpgcpv'
ClassName: 'yntfkbvxejqseanqxptgyemn' WindowName: 'dlmgonqpumbppwcj'
ClassName: 'suvvpoxzgfkxobj' WindowName: 'wrfsewbpmtseehbpzrjgkrzensfwjli'
ClassName: 'ianbsofufnzvnqqtrqnknjhux' WindowName: 'wbhcwwqnpvjrskllotadsqmutyqt'
ClassName: 'zgklwotrsbttsvmikekfqpqbvttxmsxg' WindowName: 'nktekzkauqgpwdehdggojeaygbdcost'
ClassName: 'txklizlpfaeaygrkgl' WindowName: 'pbtfqswaprqgxgwtistmygohczosa'
ClassName: 'rgorpsztfshzbjxjqfbyc' WindowName: 'wlqecmpwpboewfosjxu'
ClassName: 'aatosnqadxctqln' WindowName: 'tjudqrbdmidzauveihpnclvsvszwbplsoz'
ClassName: 'veuwnaskrnudccsjaollniittxnzweq' WindowName: 'fflxcbdigfgxwolexbpyy'
ClassName: 'ooyypvznflrmifpql' WindowName: 'kddcazyqtocuchglzksq'
ClassName: 'gtzgcfegaznciezaqdzsiwpfjrudntngqtdmkla' WindowName: 'kjzivzxzkkmbyjnlrghrprizvnyykebr'
ClassName: 'aaisscispxkztrzhygfo' WindowName: 'quakfselvuerverkihht'
ClassName: 'oplpxdktstmgsjihi' WindowName: 'divafasxziuspujqstxelxthcrxrn'
ClassName: 'frwhkvjqrvxkhnwyhuzjikqjmkpnjucrbazohqk' WindowName: 'syikqwzizclpccumvczqxngir'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'akennoamelgdwlanlmxtg' WindowName: 'uogctygqkskcipgfleqkkujrn'
ClassName: 'ohonxzjierykxovdqwyktolbi' WindowName: 'wvyhpjruxbjgxziebarg'
ClassName: 'lwqlsushmiwyupv' WindowName: 'xkkkzaazwckmdcibjveyhkugzmelegwuzlyhfkb'
ClassName: 'dxowszgjstaatxtyfvengimcoltqntwddxvj' WindowName: 'dcwuqrdoudlqswopgfqfof'
ClassName: 'mcalnzdcjfsigtzglemkkikworxaxfetfcrl' WindowName: 'khhevnurxpfslwxhajh'
ClassName: 'twqzzdomdifjkxptdvkfmidsgjdhnldyguernr' WindowName: 'dtnfecjccyghpfgd'
ClassName: 'cccvlhqvmkdbxppybkapospnwyezcybsqic' WindowName: 'jwplevjmknejkfisandpcvghawr'
ClassName: 'dxyznunpswscwpqndsffhcn' WindowName: 'qesvbzylrcpmzztkrnrheyrzcdxypeqcduyquw'
ClassName: 'yekfrupmlhhfakbxpkjhqxlmxcyammiyflhphzf' WindowName: 'utgayemlnsuhadrfh'