Trojan.StartPage.59825

Техническая информация

Вредоносные функции:

Ищет следующие окна с целью

обхода различных антивирусов:

ClassName: 'ggavpyanzydkrffpdmqosmap' WindowName: 'qlaabysmzcviludnbiqmyzc'

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsg2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsg2.tmp\System.dll
%TEMP%\nsg2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsg2.tmp\System.dll
%TEMP%\nsg2.tmp\Math.dll
%TEMP%\nsg2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'hodmjgjfdffxrvllrnxeciiiddgrlbkg' WindowName: 'ldzqzzwqyrzvmocjhsmrmis'
ClassName: 'fdtnuporkxubqenswtgqdsciaonwhwsqcsqcmhh' WindowName: 'ksyhczztawtwndywrtsalxaxu'
ClassName: 'ubuotoxjcvkuphcsonyfkbqdthtjwxzejg' WindowName: 'supugjnkudrcawhgajxtzctbw'
ClassName: 'uhkkyusffqbtwkphelgiq' WindowName: 'prgswwjztcyowlafaozawakznd'
ClassName: 'lfdqeajjbiqvljwqrtijkaavuzq' WindowName: 'mroytarnzpyejjfpysxgjhdbzqjvgkoqejcgqpo'
ClassName: 'ucymabojdphtuebyuuujvejkxlpgfvu' WindowName: 'djpjhxhaldstqlpobbygpzlvtowcgqthrrrhhmf'
ClassName: 'npjwddpzahejyhogm' WindowName: 'rlzyqqygoxyhpenisiswtnsobnlevqpkmen'
ClassName: 'yaqbpnbfaiczmxkrfvxxzacdlpjwisoqcp' WindowName: 'unwtmsocwxhzepdnyykzesrnpxkxj'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'bdaoickihazacfrqfcyswnzrjdswpn' WindowName: 'wvpnjrdadfecasb'
ClassName: 'sdwfedvbrigasdryodtlrmtcadjejl' WindowName: 'xpqpttwsdwbsubdtoulbesdmvpfl'
ClassName: 'zzgjaaslidbfksr' WindowName: 'zavqzzruxjlvywzusujjeygzttzbdropqxpmso'
ClassName: 'bpralhjtfhlgsrdnttwb' WindowName: 'jgfjocittrotggbewwhhdammehxdxmlv'
ClassName: 'sdfuofakmyirawjdypxdpsbqijstwz' WindowName: 'mulsaxeifogatcvnvvaejlabv'
ClassName: 'jvmceswyrisiupjimprrdyg' WindowName: 'vjmfqekvkwdyoxkslqgllmysjlgcv'
ClassName: 'yrgcjpoyxwnayezefvrkbizwewvdpsikoy' WindowName: 'euaybhweylbplicqchwyhdquteqc'
ClassName: 'fzxljzfhjeawqjvron' WindowName: 'ujeaeqkcjfgllkiuicemlbyulcksewhqx'
ClassName: 'pxyevcbqtjtooroukflkrzz' WindowName: 'huesyqxehonxlybcjeizkuqanqavabgqnnvje'
ClassName: 'szatiadkzfdfcxzaqhf' WindowName: 'uavpzmrcezysiynjotvtxspmlewpwmuifayyj'
ClassName: 'bnqtzlneykncfgnhsri' WindowName: 'emwhbdnjiypdegd'
ClassName: 'fvtklimirapjdqnhitwnnjcrhwykrbcoqfbgztf' WindowName: 'kshaprypsbajkuxcktpybrhgsdhlr'
ClassName: 'wwgeijxdpzxyekvnjofmu' WindowName: 'xlownvwwbxommlhcrebshurkd'
ClassName: 'hvhdltniwugbeorqlxpfwudupd' WindowName: 'rmbhkqqhssbeaimmrmyoqmmmqn'
ClassName: 'dvanepuofekemsfctsm' WindowName: 'cmnqpaggnpxzmyalpgpdnnrxqikutslszrek'
ClassName: 'qwxpsjaxdpzpqftstgb' WindowName: 'kwjypwnffogrhoylwwv'
ClassName: 'fznwtcnvuvikvlw' WindowName: 'mqmnxhktoksxffglhngjvyldkzdgcwunjmbo'
ClassName: 'fmajgghmrxfrqtucfjqaxezaxnsojtihjfsev' WindowName: 'ugmesattsyobwiqlnkldcawrfmknzqr'
ClassName: 'hrtdtfpaibatmikuhop' WindowName: 'gzpbvuxgvrupkeglc'
ClassName: 'ijdgzbwkldpmzebi' WindowName: 'hemckxyxvovhnygwdejudsnicijmvzqcsh'
ClassName: 'kcjjspbbifcwbygj' WindowName: 'msjlilakjjahbdrokuwym'
ClassName: 'bmrdqhhpxvtnxjqmixxxkjfzwel' WindowName: 'intghuowkqgfcanbfdqzlafpxuywuwphnueq'
ClassName: 'gulnzpxgpobqqofetbwhspgsdppua' WindowName: 'axusvoxqkbcimavdxfgeptdyewnipom'
ClassName: 'gtmqdsxdzpjojckprsurjjokdi' WindowName: 'feqvelgzvhmgirwplelptihsvydiqlim'
ClassName: 'epxkzqzvhwidljza' WindowName: 'sppxrczmxhlhqvdy'
ClassName: 'krygbjcojlbpjszxusglzwtwgerga' WindowName: 'voelqedjyqpmfnqzcqjcdioqa'
ClassName: 'sohmozdhwjfsbhxycesijdefncbascp' WindowName: 'gnnyibkoilxrkawksg'
ClassName: 'kxrvmpgkncfgylbj' WindowName: 'gbofzxmfxfrvmxbjkmfphzycaprxc'
ClassName: 'spwckuvzdwldfeqjkfft' WindowName: 'qxuymdhsncmgzkuhx'
ClassName: 'yuomwbgjffmmbcgzajwnc' WindowName: 'zjhonextkjacexavpykxkdjgp'
ClassName: 'osfneukrnysfbfpfu' WindowName: 'ouptqsqgvmvzmzgcqshdvkznqxsovqbtxmyxr'
ClassName: 'bmbvaqiynwxsgnshwnqvofzjimotvvafl' WindowName: 'gjcktynrizppibybilgnprwkqcnzn'
ClassName: 'mhdisyviltvqrqszwuthfrupdqourebc' WindowName: 'zulkfpcwilsqsqdosfxqfxkyikpjzghedumgvq'
ClassName: 'okcgggrbuzjocpuhwxjkcntapkhdeqaccre' WindowName: 'mcifwcdtfxntareeg'
ClassName: 'xgdmtsximtpugihlpakmbchz' WindowName: 'assarjxyccbuukwqkqlhfizsbzpulcaksfaa'
ClassName: 'qearilywxonwbscewgm' WindowName: 'mdtbgyxeruupddefh'
ClassName: 'brbiyjifottxalmjppugzbeqtxauinawjswwh' WindowName: 'kfgwjctenxbyqttjsiwsmffib'
ClassName: 'yetjjckbpzxfxyecqncvh' WindowName: 'pltlgxyoytlrgvamzidecvosqz'
ClassName: 'orjghimrilanmftuyuahlibka' WindowName: 'nkfcgdacxqmruzlldqejugcwyuex'
ClassName: 'mbwuaxnvnvdoiijdgxlzwgqhxuny' WindowName: 'iibbimnwksnazaystztehhvpejkc'
ClassName: 'kxlrgeqgulrwvsngpalkpceya' WindowName: 'fpemmuvzeujqemuxxfqgafpyvkbvhkm'
ClassName: 'eqqkxhwezrhvcwtogzta' WindowName: 'qqzteytiqlrscgwpggtmqv'
ClassName: 'afocktptkmywvejglikykwkdnlntdbbpgzkjh' WindowName: 'cyaljjmvhklxajnqanyrcs'
ClassName: 'mmnstatnwkzbtoohwxmeryykcmautgbhecqdipc' WindowName: 'vgdlnupdaeaopseilgnesmsatdtdkp'
ClassName: 'xixdkianedlmzqr' WindowName: 'eqvbxztuushgsxjbbjgrmcxvvydmaax'