Trojan.StartPage.59877

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nst2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nst2.tmp\System.dll
%TEMP%\nst2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nst2.tmp\System.dll
%TEMP%\nst2.tmp\Math.dll
%TEMP%\nst2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'npxbvmncyuhwkcuhqfqckynwpqhclewbqjuvc' WindowName: 'eefjblrgmhmmvprxi'
ClassName: 'zrbwbfyziyaqeikztoethgyidorhotutquw' WindowName: 'uzonnnzldumksxeoyaiqzqhxnpv'
ClassName: 'jcwwpnjqhybejpcjinhghcmugkaemvpoitqdq' WindowName: 'aztxszuxgkioyrevmyqfmgkkscd'
ClassName: 'cktlyezvbxxpttnpz' WindowName: 'tchnhbicsexlsxapdeirxmwjlucoremjeigji'
ClassName: 'vowiyicaasdvhpgwmytsm' WindowName: 'brjjvzrfmcfkoymvrmgyowszswny'
ClassName: 'pjcfgdjpkyhvgtzyzhgyearbwitpkcg' WindowName: 'coyughxrptkewqsyqnsjtpxthutyvbo'
ClassName: 'manuputhyjrpydyzjmybfinrkeexxetgy' WindowName: 'almkoxvrdiinfciytubxviyeyxnnjbzcoyfm'
ClassName: 'zkapieedqdepyfkgz' WindowName: 'lspfvfvvxbrqybfyiwwqndcmwgu'
ClassName: 'glopuwgdwugjmnftuvyhadb' WindowName: 'xxymiefwkylyurejolyrbcwylzwm'
ClassName: 'qrxcsnpmibfbmipitybgsj' WindowName: 'kgwubebpkdekpcrccjycpebkwqmppwexphhl'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'xdqgtypomqjqptkakrsuwdxyxuctvxphmhejmne' WindowName: 'vicoghgpsgjnlmulthfodybdqnmzu'
ClassName: 'btpruqfehnimymfvufouqwby' WindowName: 'xflhttmdmbikycm'
ClassName: 'efbkevkoirlwtyichpsljqizlncqnu' WindowName: 'isuicqrevbbxpxwcgzxllp'
ClassName: 'awatvmkeaptfnfcafstyohqitvj' WindowName: 'gpsodbaoqfghphlgakkrlwvajujvslh'
ClassName: 'utvrbilsjbpnyulfakkkfl' WindowName: 'qmheetdjhumdkfprabltmuecnohpktikl'
ClassName: 'pialskawqoyfqnvi' WindowName: 'gvxkapnseitdhkfcwchpankywjkqndiu'
ClassName: 'noopadtwqqvfailxpmiaaveklxttuppiakcwllw' WindowName: 'husvwdqvokrdgbkeokrjqupraptuomaczjez'
ClassName: 'mtkhordamiyjperwintfchopsb' WindowName: 'gflxrsqpikpowrvrukonn'
ClassName: 'bccwrfsznmprhebzkhaeyluwnmg' WindowName: 'bgrhjlehwikjukp'
ClassName: 'wwyaimgqojkwhitfvdgfezkbdil' WindowName: 'lodejhoawdblmvcglwxegevndmviezdcrbxaj'
ClassName: 'rdgyhfszgrgbxzmlhxecswxeaqzcyjflrxnc' WindowName: 'hxyihqkgwlqaosuesjbgyccrzqjsamiqiimiez'
ClassName: 'iseppbsgccosduvedpnyjbhchqcmdtjtiwjde' WindowName: 'jstamleqjlhhaejzvfrvtdw'
ClassName: 'wquzkpzmnxjaamivoxeir' WindowName: 'ibewmdufgrdkgfyiovc'
ClassName: 'rmcyusjyudnaohkfaiacjwnlxzsrkwmz' WindowName: 'jrzwpkailedklyxkfvkdi'
ClassName: 'lfjtrudaudzdlnbhnhrajqbijb' WindowName: 'nuzouiibmnrdgdbsxicduxthh'
ClassName: 'ygqhbpsjiqsykljd' WindowName: 'tdmaiqevpgnclwimhxxs'
ClassName: 'tbidsswazmdhqliauvvmuacerp' WindowName: 'dpwisjnsvpabshsppeg'
ClassName: 'mnefteroonwflkm' WindowName: 'hjsrdzjfrquqazkwvjrjsldeb'
ClassName: 'roiyylzuaqkzimsewyejwhxt' WindowName: 'ftumzwwaijwtrvum'
ClassName: 'bklgdjyvulcdmgnxavzsjeymg' WindowName: 'njxrcjpdrrqdfrcveffriljnv'
ClassName: 'mcijtqjmwxizdhomrixdonlsvwyd' WindowName: 'odnqgaklyftnjxlvoqr'
ClassName: 'ilnovzrutinpimyfftndpqerdeslbypsfc' WindowName: 'qcgpbjkytypzczjsynnwk'
ClassName: 'gcdabqcnvmkbuteoumiosfcjwbjugeoriccpud' WindowName: 'xwochppnkrmgdkvmpwankqy'
ClassName: 'pgnutjiubabucqvhwgwlicahziqlgcib' WindowName: 'uraufwwijyrozgcpvufzidtzufbxab'
ClassName: 'fadzzkltsplmledfmtgejckpfgtgtprjeyvoqz' WindowName: 'gqfxregvduexhvgiaxovkvjuirvftfx'
ClassName: 'bvskxesajqsorxblydydyujvt' WindowName: 'yicvlyozqohfaarlnipnmvgqqxwrw'
ClassName: 'kiyzibthwglrtajkyantspflrxrl' WindowName: 'bdihnchghhaqrrh'
ClassName: 'srassflchiyfgjqvnihminwajbgvkkg' WindowName: 'julnfdyazjkzbfmjvxkchabpiyezsnicxw'
ClassName: 'zhwkeqidysuoykeeifdqtqthfxfsgydobiuoep' WindowName: 'fxdixwcvttzwfzchmeatfueuvncc'
ClassName: 'jnmgylniqhilfyan' WindowName: 'eggwuxanmeyrckczmlteciun'
ClassName: 'awwlhztttjevykhaoo' WindowName: 'yrfuitkiiiltxmfsg'
ClassName: 'ozbmmktleprilhsol' WindowName: 'pfdhltwpeuqeymerbpppmonakszhbyfhf'
ClassName: 'pkqlpmqstkwidvnkqbqeglclacuql' WindowName: 'jzndlxlyzxgtczhsowcaycsdwhlgwsmbectgckr'
ClassName: 'vmxykoizeniyoczmbvnapbgdioelz' WindowName: 'troedrhygacfmlqvpvfzxuricbqthhrx'
ClassName: 'kuxtaxbfjqhnmypjdkfjyytdjopxzjikpyru' WindowName: 'fxfbetnvadutkjsyjyiijjlejdqizz'
ClassName: 'vgvobkpleurcufmewjvvjclcuvkqnyxfbbpag' WindowName: 'wnfdhneaenhgmqrpxujhyslw'
ClassName: 'nvyjnsxzrbhonxicsfh' WindowName: 'qnyamngtifyfvedqxqvtldximihxexe'
ClassName: 'olbiynefxgdsyumdixvwkkzbrqqyxffkyk' WindowName: 'xiljtdmlwtkfeilbwclwyx'
ClassName: 'thumcxhmcbgkqohk' WindowName: 'cqjhsejfgtmqusdf'
ClassName: 'znvyykvzigyhjrbcfmszgi' WindowName: 'wjpcztuulbmomeqqdd'
ClassName: 'bowrysabqkhqgawvycxzve' WindowName: 'fjpayaflnsrhuloyixhfggphm'
ClassName: 'pylskghphpgwblgcltuvyfwm' WindowName: 'sglyodxlrmdwvrq'
ClassName: 'tdppfjjsspvzhqysovxljaxwyljwkkstg' WindowName: 'qpwfsnwmanzohxyhpkaymdrskqp'
ClassName: 'mtinxahhvjlnpjrntcjpxsv' WindowName: 'krgohxnqkmcpccobyhiuy'
ClassName: 'azbtjkfiufdilokwnyltyihui' WindowName: 'xhrxginmcqzrxvgfuepyzluafflalglp'
ClassName: 'iojhemietzkjerfsnydelisljuxufoqqztdoedt' WindowName: 'dkiwhrqlakzxzeo'
ClassName: 'smcplgecgrqwadfrtsin' WindowName: 'jzdcwghbblcvywpatcjjssfdgywzlgkvmcty'
ClassName: 'maklsoudidvebjdktzcw' WindowName: 'wqdnirstdicoatdlhyvagchtbacfajeveicvb'
ClassName: 'rljycvmznszjrqzkbvahjhgqr' WindowName: 'lkevplkcqyrykmbixcmgeujsd'
ClassName: 'inkegshudhgzlolqpopwhmcgpf' WindowName: 'wczdeebnaydfdrvww'
ClassName: 'uwxieabjwzplproujwd' WindowName: 'egmgclpaxxekbxxwrwmj'