Trojan.StartPage.59720

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsv2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll
%TEMP%\nsv2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'zssinikrfdlszirdilldtkkbtxnenmbcqrohn' WindowName: 'bircjlqgtdlxqtqgzqrnmjy'
ClassName: 'arspiooysstwgtjrkzze' WindowName: 'utlpfvdeflyatli'
ClassName: 'bgmwyhqftsaeorobafgysigdbtdqkklfwbzagq' WindowName: 'nzscebtghhisylgrvdkdscuojzwe'
ClassName: 'qvupfvgdyifuyvuzkfcqldixtgqdsodewpu' WindowName: 'vluatenskrhgxgqmskw'
ClassName: 'jxknmvnpfgadiyakgmwyxjxjhqnpet' WindowName: 'hclzdihvcccuystfqajzclvezvcfzi'
ClassName: 'tybjlnxhxmvczsqsio' WindowName: 'djzfleloyekbngbxybtpopjtbxnyuxwvv'
ClassName: 'hhlknpthptducnnziojvrptubzytotuc' WindowName: 'vfjzntugfgefatdxkeadvwivdovxpghuyuypll'
ClassName: 'nootfulyqmwrhxueuolgifwxkh' WindowName: 'adylohuogywzaruwzamuovl'
ClassName: 'ymhogdaquunshncsclwq' WindowName: 'cfzjpaqxyhayavcts'
ClassName: 'bvtihdpmeiwviqt' WindowName: 'pbgfafvsnskgchlpewzxbld'
ClassName: 'xbcwknixjbatpcpgmidpfpq' WindowName: 'clszdtqbfeucvpgcskphdmulqmimdjrpkj'
ClassName: 'pyscwvqfrsjiviapmcmawycdxmznsw' WindowName: 'psceoeghmcdruldaecisbiyxqfpjmsekkbizgw'
ClassName: 'jitojtigetpaohbxouodquqpijgylsetkzbmeir' WindowName: 'lcktmwsvqoxhykzqj'
ClassName: 'aantsinhrnumxhzdbjaidyf' WindowName: 'xuhgkdujryikbkqfxcwnzlpaja'
ClassName: 'gnclogzehdhwhulhcgrunsc' WindowName: 'mvuhvhrrtkbkrxuxuult'
ClassName: 'wwugbrhvqglxabsaidz' WindowName: 'viwdjimamgcxxrjr'
ClassName: 'gpgdfkufpoalohvoeoumixfjqcpiovqy' WindowName: 'oqlbpsunuczmdrmrpkturcyorebguzywanliwr'
ClassName: 'cdarlmglddwmgxensqfekyulwsaiybcehccuw' WindowName: 'doxinwqxlkxbhqwhsdquzsdym'
ClassName: 'gkglejcbffezaulorrfbxlaokeckfugdap' WindowName: 'oqgukmgkvugpsiywjjksmjiwxxcqvbrjp'
ClassName: 'zsqmclugyspbmzeuieqsmdqsieelhpyghjod' WindowName: 'rwtfqkicxwaeuesn'
ClassName: 'dhvwlnfmqvczioctmssd' WindowName: 'qaasvpzwwcpdxnrlkkgvcpukhj'
ClassName: 'fyosmbzgrhrcwjaprosnrarawxefupqooooy' WindowName: 'vamktcvtylshofzyuljwqyjjsfbapbizsu'
ClassName: 'vxjlejytoxnqhjwshhqcrzvlesfsnfktl' WindowName: 'asrgzdcvqzbcgzpoeljkyzpjsp'
ClassName: 'ldxsliovvoodtitveloanavxjbiatycltmxdpb' WindowName: 'gpegjvolajnktkzuxcyv'
ClassName: 'lqnjipsviywevmzcxljcycxshbvtmxh' WindowName: 'mqqcyydzguidzloaucf'
ClassName: 'fndxlxbxhlotsxqnwbwkdlblanbaqnoppc' WindowName: 'pfvvtuubraeeordjkwxqfqrsiwluondbotxsf'
ClassName: 'rhpouedlievvupymulkysifns' WindowName: 'zobsncplunhwgazhlbgcounvkkb'
ClassName: 'fjvfbuihelscduktysj' WindowName: 'ixtyuqagnvhqcecrruhzqevllmbwwhch'
ClassName: 'xalccnodzgepmaozqiecpef' WindowName: 'snsqzfqvvqznkcorkhldmoqktlvjp'
ClassName: 'ieamyqzdmftpvmgnjpwceqhcnblifzyt' WindowName: 'yoqqnkrhxiisaudkgyens'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'aktksdhrbvyhbeburvd' WindowName: 'nmzejzlshidljcqbbtuw'
ClassName: 'whptzfzigwjioggbxdtwrzcrhrzatzxohpfffaz' WindowName: 'yqqeadxyskrjwuuj'
ClassName: 'zvblqdvedxhuezhgmekvohxbgyzyfizpzy' WindowName: 'wpgyplpbuxoitgsqts'
ClassName: 'sppyojjnybuxdmunkqcv' WindowName: 'nydypsezkonrrgfmcfsxtiyexcsrqxcxvlxd'
ClassName: 'letsaberckyyomgbpkaivlizlnfpbkcjtaqk' WindowName: 'knfmhcuuyujkrgswufqbuzo'
ClassName: 'mtjaisxkxpiwxqkktipimveuyifhdbzudnt' WindowName: 'cylermwrumvgxopjcp'
ClassName: 'jmrfrffnzbtwvlojabbmkbsvuzatsezprcmtvut' WindowName: 'bnsqwpsqhhkwtrecqgvtjwktmpyyqech'
ClassName: 'zsgorizvlwrghevfykqfnlujgerdzlctl' WindowName: 'aahwfsvnzzlndijqyutwzgjloppr'
ClassName: 'konfeivvtoxvjbcsnsvixwnlxkjqaevga' WindowName: 'xemftjenqgkultpi'
ClassName: 'orhposgpcjacrhfk' WindowName: 'tratfjsxzxlmfpatkuqj'
ClassName: 'afopwjrseitsfhhgvsiqtfiqgjoiokanjrjtxf' WindowName: 'mannbpmnryxykddmknzg'
ClassName: 'hddpisuqsgclmnucaa' WindowName: 'qwfcjjwyglxifycffrhrzfjqnrdumeic'
ClassName: 'apctqhtvedsxhyoa' WindowName: 'tpnbfoeumlpknzvyrtjtexfzvoebcynwi'
ClassName: 'xgtfkgforxdyeiylcrszkhyttirhbceudzvwrk' WindowName: 'iikdvpatiozsohqhusujpvsxdda'
ClassName: 'qjzorlgoeheamnyhgpjgzdbhknqksuduuz' WindowName: 'mipxnozajplcodyw'
ClassName: 'puktjkxyaiptsmdjojwgtgljizsu' WindowName: 'xzpeqcosymbhzsdwppvlnaommo'
ClassName: 'oggeazopjbcwzdovr' WindowName: 'xgasyvvjscvncfyihnbujhcokbzszpfcufycqx'
ClassName: 'ghppothwprdkrstwmjfdcqoaqmcpcucdmupa' WindowName: 'qwethuxaqilrcmjhdniajtiwipnd'
ClassName: 'ryssctqqfexftsxjwp' WindowName: 'jasqszegxvzvxahmlhmjn'
ClassName: 'ketigslwosksyovspimnrpgyylkpkqkrizcldhz' WindowName: 'wcxrgajphbsfpriueitlwjyqfyyzvnoip'
ClassName: 'yoigkpiqkjsoxmyfkbstpuprlyan' WindowName: 'snlelhtczxtjjirpfnlahpamecxw'
ClassName: 'ldccggjaujumdvqwionec' WindowName: 'sgfxnvxltilqsnujfftfjjraxy'
ClassName: 'zvcspbponfmvpkw' WindowName: 'ubnfdtfdvpgcsdb'
ClassName: 'nqgwjiulpxegpqtylsf' WindowName: 'idprdkpixqrfyuupc'
ClassName: 'deppckryznxuniwkwgazpk' WindowName: 'pvbpklvjariuukoaeathcyxinrwfb'
ClassName: 'rzpoenmutppajuhmcqdbffn' WindowName: 'hxrcvsyjfrmqepdpyfhwjldklxfasxtq'
ClassName: 'tzgtpadhovemqar' WindowName: 'zbqonaynagookxfqxgituuiepxokea'
ClassName: 'idgzwpnbapbxojytnrxcllr' WindowName: 'bqxtsgzhqchalixvk'
ClassName: 'jbgozwgclcudffdbomnijpmiosnkiezoxr' WindowName: 'lsogwesxugfivpmcjmtodkfeqrxwnxi'
ClassName: 'yarobheauowpkoavayjvyajvjqxkr' WindowName: 'gqnprofzfrwqgnhb'