Trojan.StartPage.59880

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsp2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsp2.tmp\System.dll
%TEMP%\nsp2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsp2.tmp\System.dll
%TEMP%\nsp2.tmp\Math.dll
%TEMP%\nsp2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ulmvkdcconhjizknquqgwmzoui' WindowName: 'gnbjliajyecodiszubrnrdbkgnwuogtp'
ClassName: 'zoneaqngnfdylebojkqo' WindowName: 'onfhvoipkggftsktriotcuepnq'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'xekekgzxmykeycwiofzryzbtewalkqfmnck' WindowName: 'pbftompzdqyfdviyuhmgzexjbawo'
ClassName: 'rjtpjfegvzheagmiwdoikvvswjpupaxvksvex' WindowName: 'eaeilteutjcxstqv'
ClassName: 'gyxtmeatsztpvlna' WindowName: 'mcsibvhybhmjvqqslkrxikqwb'
ClassName: 'dgnihgzxvdujvsoy' WindowName: 'dgcodicavxnlukkhlf'
ClassName: 'wmbwmwoagpsibprnxsbiuk' WindowName: 'fekglvtdcwwponglaof'
ClassName: 'esfyvyqnizurgekpcawhnsmq' WindowName: 'vdbrktnukzqslnycdvewq'
ClassName: 'mejdbqffmiwpveqhmqdtpzaocj' WindowName: 'pgginqriqmizredipinb'
ClassName: 'camuwofcwqoocdpfokseopxmod' WindowName: 'sazrwmxjsphfqbjntdqvxx'
ClassName: 'zoskzvjsyvsbwvwepgl' WindowName: 'gntrfhkovradlcyppblebmfgivpq'
ClassName: 'jffprppxhwaldauiliwwxzhzcklvgpiup' WindowName: 'vwqvwcmbqnpydaalivxnkwphxqtbyrjpuh'
ClassName: 'yfhosnagodimstzyozqoulsihsxsxmnanvicib' WindowName: 'hneriyijsauvcleoraufxevcejkzszokkfcequ'
ClassName: 'bbdbyjqnwbiqvinirowsmxyscarljxuu' WindowName: 'mbijlnkewxoehtjlv'
ClassName: 'ugtayvhmheydakpnhludgcemrqairmej' WindowName: 'iysmmfbdggibasctyeuvkxnkbgvhxa'
ClassName: 'mszeqmfajoilowukwvlawoeoindnxwgcc' WindowName: 'ybqxbhvtixezqvddguqgcjwrpxyvm'
ClassName: 'zoegylgiuvxzbsynsdfcizhlmag' WindowName: 'jfpypzvzuofpygltek'
ClassName: 'fkeomsszitkifpvdqypcbhmugmymttxvqg' WindowName: 'izaoylrlogiifuwbpr'
ClassName: 'ezweeyiougvudiwojnlv' WindowName: 'zmjregpvhkivvgec'
ClassName: 'thikqonpevxmahhmne' WindowName: 'kpkhnnsoexmmnyv'
ClassName: 'yxbopltzzxisbvthvzpawf' WindowName: 'kjqznxcmpzobpuncbuwjhgzhrpimrkmscyjfeqm'
ClassName: 'oqgytsidakbmprksnimdrocsyilyvkqcemfq' WindowName: 'zeztpeahpqxyfgwodfmymkmasguudrrhzf'
ClassName: 'mkmhtotsskoaxeevivlzslmhdmmqqgnjqm' WindowName: 'zqfppjmwmsitnojlsm'
ClassName: 'eggjxbotfxyqzpnhfbkftxlxjrgsiaezlfum' WindowName: 'sjdnmrnplnoqcgfnigrlwsxqcicyuimugdaoh'
ClassName: 'xluzqcbqvvtcwvuzyrfv' WindowName: 'bmcvgumcljjiehapvzclkmbuvquqlxtmdirmo'
ClassName: 'lxptctzgfwzvcxxawalehqbqwajfsq' WindowName: 'fkhwwtaxaqxmkhihqzkhftjlppxhlvlxaoa'
ClassName: 'fxvelctmnarsqbzllotfiyytr' WindowName: 'rwfigvbjxbjcmzlkirsfxbzcewjtql'
ClassName: 'vnsnsikmqgjxdgaivspgdwzeocsiqaa' WindowName: 'umaleamufdvjgwwfsxwylcfgkepmvqyifuocecl'
ClassName: 'nwbbpkiaxdskwdbvgvsouljtwlrrxr' WindowName: 'lfxrstuijahrwqmpadmxoexlaodz'
ClassName: 'lpooylfqtirowsgtfmkoivge' WindowName: 'hthcktgvyiujsowe'
ClassName: 'iucveonemjnizxr' WindowName: 'ddmdurwjjycpexmls'
ClassName: 'olwvknjmafumffufzbdkdulki' WindowName: 'hyuvldnrpwcbhqolhirlovpimijzxnqdqeftlb'
ClassName: 'kyxxpbqojxgvdlhryzr' WindowName: 'yktabwmkiyujnmq'
ClassName: 'sefnpwjaaqftceofklalniazkinybereiko' WindowName: 'xyxxpxcdfuvlomnpgscbbrtvqoe'
ClassName: 'joxeuikcxreagakwpuavnrmplfqwq' WindowName: 'zniiofwacrkkciw'
ClassName: 'anupeyjnjkvhrjbsbp' WindowName: 'cvpbtdlnegdgniglcbryfiuwbrjwtvdxhmgn'
ClassName: 'agavgtlhsenyijpbzvqfmzfn' WindowName: 'emjrapefiustquhsqivlwnjbpe'
ClassName: 'lvtprnnwyecvbxhowgygavxxaovfapouafamk' WindowName: 'vxtrykibowueizczghimjxpxw'
ClassName: 'bhktaplvlafohnzodhqrz' WindowName: 'bfnhzxoanbazexcdytvna'
ClassName: 'xqzlgawwyhdvejmxytkhgjdkckgxm' WindowName: 'oxoxasjbcbbtianitcjvmlhulkb'
ClassName: 'owvcdtfhackcbvkhafqufudkeumiopfopozuomd' WindowName: 'ftvsgeaepphsaigyljbjp'
ClassName: 'mmyanrbizautzve' WindowName: 'nypomsumguoeasxrgoyotdabbvcnmzuaq'
ClassName: 'riexzurtcysvahtevecrdkvuyvapaleapw' WindowName: 'qtrngdpfbmjkkniwgzqvmvnmqvpoyhrekpggr'
ClassName: 'dxtfcfmknohybledgtdycwucbyoayhhppzxogej' WindowName: 'vpjfmkatnlwacizyucsrkdnxt'
ClassName: 'qdqoiwyqrwmtrubgzxoxpjpivyatpao' WindowName: 'buhwzdiearepyjkhdvtxnx'
ClassName: 'frinictxdvnwneneplponirtdsnvbvrctatjxrg' WindowName: 'ddewwevqybqqbkzwm'
ClassName: 'ygoxgkjlfxdcimhxaojqzkxvrx' WindowName: 'emhgjfmksjnbjtzohyijjjpfiyekfasz'
ClassName: 'lfpvizuvmnyxhlspqixjswce' WindowName: 'bleluouwuiomptakjxyj'
ClassName: 'uwnnldemwepfivyrel' WindowName: 'cgszatelzhjivaeafulbqohfrolyplqzrlvmfd'
ClassName: 'pjdxqqtwkhaopokfjturk' WindowName: 'mgcsbsnwijoapudv'
ClassName: 'vvtgndmrkcjqckj' WindowName: 'kpztbhsugruaftgdrkouvkoznfzqkdhv'
ClassName: 'bftbiyufyxglbss' WindowName: 'izfkhbytpzjekevgyktintuzppfzgjcypg'
ClassName: 'dnqtwipirwpchrqxpdsprtgenazvy' WindowName: 'lgfbmcfutvhssjpaponjlririshtmh'
ClassName: 'xvokwyvmqvhpygu' WindowName: 'mkirvytorzrbreahoogjzlqsxfiynwcgwuxdl'
ClassName: 'mixeaurlnsnltliqhakckoieewoudrjzmaq' WindowName: 'eawvhstvrbymzxsgctuczwrbkmax'
ClassName: 'dewjzsudnniwsdqskxzkmivtpzpuvbgcdzm' WindowName: 'xpntqbcdnabaycvemoascza'
ClassName: 'dhowvubtpuyqcmsswuvirhghbwk' WindowName: 'zxkfswuhptwerqiks'
ClassName: 'oqyesebwyfdzqvdkwva' WindowName: 'djpyzgrdpampqjhm'