Trojan.StartPage.59740

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsj2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll
%TEMP%\nsj2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'unbcndcjclptwbmvqfilnaltmpkpld' WindowName: 'afvsparyzfbhhkesgtijdfxebueetpacfpwtfpf'
ClassName: 'kvlnljlzqqfsjhgblf' WindowName: 'oquvjfwhsppdispyxssykybbowtmu'
ClassName: 'qkfxjlmdierraioqtjdeons' WindowName: 'oyoisctzjqhaqsklgyjspoq'
ClassName: 'ukztnbiiyvflvqpw' WindowName: 'hpeocjrfmzacviebqzmxlokfudwarzcjdah'
ClassName: 'mikufxjzowkulikyyxdrvpwduedancisjrzxbq' WindowName: 'wcoluyaxuegynhhmtlviqwe'
ClassName: 'ajhhezklyskecfqrixfelxaohttknbyeeg' WindowName: 'exsabzdzprihwnycmpoglyxbmgicdirt'
ClassName: 'nwpdwygepdzxxnvhkyunapjwhxuxldwurhl' WindowName: 'cqeqpzknrjchpqrcrxxlthz'
ClassName: 'mmkzkohaumzmzyjseenxtybgaqxxpgwkcqb' WindowName: 'ihkdgersthkquqlioglqcadlqwzdhzxw'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'hlbjjmpkfhflnjwdqjrlgmofnbklwkjop' WindowName: 'pejikhucewwdllayatas'
ClassName: 'vfmhennqfmmzqpnnvyujiffvqonovhn' WindowName: 'fgjejzmxwscutoofolsalkfcrvkdtc'
ClassName: 'ijofzmkifnswttzdqpfnekfxurfodxunrjea' WindowName: 'xtnjqujgjboegcoxgohtimgsarsmnrm'
ClassName: 'txvbarapgmrzrqtmjxphgekgrwtzs' WindowName: 'yddibzenexjojejleez'
ClassName: 'oxjsafsijvnnmffwykqwe' WindowName: 'mqnuictjgumrbbusedpkqedwgoahjyddsj'
ClassName: 'rvlrabulkgmywzu' WindowName: 'miqqmmfimiegpnkuiqshlevhffmjwnnhxb'
ClassName: 'tnavlfugwbfduatnguctptszolnp' WindowName: 'fymfafzhxycqnltwgb'
ClassName: 'rnnhwurvedlqwukcluauam' WindowName: 'xlabgamicatrdjpejomeipkskkwvvyqsw'
ClassName: 'eirhukhfkmscujifedyhdjwmnt' WindowName: 'sjdiqvqnqgyhnakgme'
ClassName: 'rldfcyfetqoyiryvorvz' WindowName: 'oirokjkfgzseyesxnnnjgeiqcbaeoyyzk'
ClassName: 'pvdkgsafbvkehjoqungmnwxocaeaeeigzhl' WindowName: 'cpulrcvbiqevahscispixkecqryhyld'
ClassName: 'ivipjikjjzjkjhsxug' WindowName: 'kubyzmneksfmukk'
ClassName: 'iefflkxmnmitnrysdgcitybkoaur' WindowName: 'dpblznesfkyrvlsdzeuobi'
ClassName: 'loqoclvnsjyxdjeodphbazbbumfnldilei' WindowName: 'euixihburydnuugeomavdihmlnodmvwkpw'
ClassName: 'vkrrzpalktjgrtqdbrkrnceuyizrfppyfj' WindowName: 'qvwatmyvkoeknixbyjh'
ClassName: 'xggdkvvfcfpzlwveqdgylrtuqxetietxdadapip' WindowName: 'seijdjycuczypmyetikythjxycleqosk'
ClassName: 'vzpgzspuaivjmlegwgxwcrnebyalan' WindowName: 'hujalddsgnsrzkrnxoqbhynbgxktnmqrlargrll'
ClassName: 'poyjidkezpaocrjcptsraoxhnfqsgr' WindowName: 'fbqlokeanxmdnudxvhtzpbx'
ClassName: 'evtxsukjtnrszzr' WindowName: 'jxjzwgnemljsivaemnhmtd'
ClassName: 'taiqftkapuiwpisioiifdkc' WindowName: 'lqkaujnhiwafmjdkwcs'
ClassName: 'udijebbnwbahmcketiqkfwgfvmkuxetvbgsg' WindowName: 'ddskpwdacehmhxvvvwtrhrjlunilco'
ClassName: 'mhxfpenqgvvxrgcytqjfkjgfvgpmuitjj' WindowName: 'jraipsmjcihzicpadvtdxzpehizulpjnvh'
ClassName: 'tpsbuqhmlthksxjguait' WindowName: 'irtwmcnksuznlxrojejhnshgikgxdrwhftxqb'
ClassName: 'gbbkklixovskwmgdltpdlycexubw' WindowName: 'lkjuuosoexlgzrnezvvyxfbaxhewbekjood'
ClassName: 'tqqnbuqenbddwwyducktttfbuneh' WindowName: 'nbdhfewvcyixkebbcoooekfbjxnbfmlbqtlvzd'
ClassName: 'mspnrbtltdypcgyoywjlzhgbc' WindowName: 'hefjavqibpykmixtffjffowbmafnowsihcpbg'
ClassName: 'gjjaqeadvyigbnzvjtsepbqmzuqmu' WindowName: 'twpkixofvqlfykahmfdnzljdzgnuivuc'
ClassName: 'ivpzwquenwoxdgljfrzcpksbcassw' WindowName: 'xgjuocfvaudrnywdlcxakudmpevxkgbqonoe'
ClassName: 'oymrcljbyolxdjczwdgvdj' WindowName: 'knxybmwuxrvtgaxqjrtzdtomameqxzq'
ClassName: 'qtvpwivprimnbwurcr' WindowName: 'ilfyysinoqvglnsjzsdjyhftljxafhkgrnarvvp'
ClassName: 'sxaeubuwpcajeriyhcbjqmqurzjtdkdnd' WindowName: 'eiodmaiujnlqcvvpm'
ClassName: 'nsdblittrftltgucbfnvyfkynfzdscos' WindowName: 'pntfcerhvezkhgpwzdplycradbjygjio'
ClassName: 'dhlomdfrsnjezjfinxnqwcuxbkbxdtcmzro' WindowName: 'golculvfoxovoathllacevxzlnvcwaqrh'
ClassName: 'aqxkmbbnkomvdrnlupg' WindowName: 'izosqfenzkohdhlx'
ClassName: 'zlhjhoqdunoqfazfwiyywmbniwtvzieothu' WindowName: 'jfukrtidsgzdfdijliyzpkirswsb'
ClassName: 'zgwwfqqhjxjqogdbbsrehctvjjwvrloetre' WindowName: 'aamvqylgfpgezmpnqzgukf'
ClassName: 'huirwtcbwsscofhzxtlowscxadrgrhszqg' WindowName: 'gqvucgfzcpaoczylazxx'
ClassName: 'wzmtchdeikfzuhmsekkpqretxypzybb' WindowName: 'nelgjvtmwfdsgvceqtjeatwrtdlxvmjq'
ClassName: 'bhdjlculrdtribudybhypbeketiboihie' WindowName: 'awkvmlfygrszvbdxjbivbfzyzlpwwfq'
ClassName: 'meplvcigjixgzpgxtd' WindowName: 'amncxsdrbwqwqgyjssqpaqkoabfjcmnnnne'
ClassName: 'vkzjnhlpkqxfbnrxskerq' WindowName: 'ywgdgwobhpvuajuqhufjceyy'
ClassName: 'blolftenczkrtfhomfni' WindowName: 'fxuufzuyaprxjbjureerg'
ClassName: 'argqitvivhmvygaeavohfbvvgdgyhhrmxseec' WindowName: 'ytsnmcwydoxcvjhkt'
ClassName: 'dwvsllwrsighlcmuwwyxrotiylhnlvxgjjja' WindowName: 'iaiqrvwpowuyglqicqsysjzmnllb'
ClassName: 'pogxgrojcedqsnmxlehlsueimtuhalklnjhk' WindowName: 'qttldpxalzeswlbxcvlvuvgjopilhdbncduqimz'
ClassName: 'zspmcmajkiokuammbiaxlrxhvblmjkacw' WindowName: 'njawpjebsgqrvspdhqvppjubdimmcxihv'
ClassName: 'wmzihvjhotyswwfnickhgyvcutjdjtzxwxz' WindowName: 'faenbkkmirztjftaqicpybfeeebhwlds'
ClassName: 'wpeihxqglfsemxakjblysgzwybkgpd' WindowName: 'htjrxdfevuhiaguzqspkqivsuijizhgmy'
ClassName: 'hfwztpfzbaeijugqa' WindowName: 'koyzgstqwnwieerpngceqzqulomhdwoikvy'
ClassName: 'wklihtpaofitywaohjwrsylcnxqvp' WindowName: 'zmvhfmyprowakdzobeeas'
ClassName: 'lpkyfhscrxqbszgoehmpmruwosp' WindowName: 'paeflffolbefvaloebcmwv'