Trojan.StartPage.60076

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsl2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsl2.tmp\System.dll
%TEMP%\nsl2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsl2.tmp\System.dll
%TEMP%\nsl2.tmp\Math.dll
%TEMP%\nsl2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'qltppngcccdhrhslyqmgmelgftcmlrnxxu' WindowName: 'sbcvhnvhncuditbrvefwmjqtjiwesvrnh'
ClassName: 'raolvdcvsopebhlkyafcapzwyonzaen' WindowName: 'qvjxxmopqucktpiy'
ClassName: 'ccgewbsdvmrxcogjrs' WindowName: 'btxvabfxkylkzbynrbomazagtnfysfqlau'
ClassName: 'tkbudkhnuqdphosqcywaijsydmbxoshctvku' WindowName: 'jhzabmopcdbiburvnbavwozckofawkx'
ClassName: 'bzzegpktdxfecotae' WindowName: 'zjvngizzzhrnbpdnfmewg'
ClassName: 'zfewflztojryjwvzkdpxmwb' WindowName: 'tcnsmzveivkxniwseqweejqotfftzqs'
ClassName: 'tksbfeqowzexoqqbcpev' WindowName: 'gbmfavxshwnadtvoqqrthpprccq'
ClassName: 'inrjsbtchxiiglainqcavwepjxo' WindowName: 'uasvhuspnyaonqtcovlpegrubbvhlnn'
ClassName: 'dryujgnsiiuxsacbjafwgrukinkubspcryim' WindowName: 'bnjlymvlimuvzwfcrbyuybsvquvlebyhubryrsc'
ClassName: 'igvzodsbomuqedpxwckeulfkwmjtfunwqnwrmhk' WindowName: 'snurfayscwyrysjicbxg'
ClassName: 'mvqqguxrozvlbiluuyiqmeut' WindowName: 'qucphiorabtfmdamaojxhdvd'
ClassName: 'ueahmhccbjynizghpvxmidmypdpovhjryakyahy' WindowName: 'kvybuxsracalaflpoeofdo'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'ayhmhlayqgelvnqzu' WindowName: 'mahgegpzosjximygueoozllnwm'
ClassName: 'fusvkldtlsycgyqgtlyet' WindowName: 'mwjpovbhtagevqlilocjq'
ClassName: 'ambfteomnozsbxvirchqsutmfvxnhfzbc' WindowName: 'llonzspuzwcszhwqtjspmbgwfb'
ClassName: 'lteowkhzatdhncejuelpw' WindowName: 'mqfkqfxjfdolsikkeypownepknzumtt'
ClassName: 'gmjnrhvzlgugbljwivcrvvb' WindowName: 'bxbpcpeycwpwyrxnuucwjlrkdps'
ClassName: 'eevfmahxynplstaklck' WindowName: 'kviiglfwztgvzgzbnddw'
ClassName: 'tgfyoxqclacbwdefirqlmcasoqnzvfvdvzhtkz' WindowName: 'zrbydmyisueodagyaosbhqjjqimfnq'
ClassName: 'ijpssbwbfgzsqjwpjkcgs' WindowName: 'aoosnmcomuczjeiecxgdbxeok'
ClassName: 'ybbslfcmgmhyulfzrituumfhaqduckcqne' WindowName: 'nsenfxdpfnrppkwhicpwuknqkapmlccytblbhw'
ClassName: 'atznkyvmhhgcctohbwbl' WindowName: 'swzqkkedeltlzxqwypnjwtygilspkmwgvjsgqvn'
ClassName: 'qaszdwtzyeuqoskqepsusmkmmaioymhevdins' WindowName: 'wpmykzvvdnzwyvzeyyjevqqarxqpqvgthyvnb'
ClassName: 'xrttrhnukqqeezftxqjwcu' WindowName: 'yufiqdtlvzpisxvbaymswhr'
ClassName: 'kjdyxddxhcaspnsjlldfnpcywdfcz' WindowName: 'cetliccobigeddqpgydikevudlgfakgmhsyywjw'
ClassName: 'vzjzjxjsbmgfhmkgvtgiipwctcyrolt' WindowName: 'lrhtlhbfdvfxjkkcfli'
ClassName: 'ayupiozgrvxpdcpqkuinjuuqnihtpzeuhbn' WindowName: 'njvfcdhncfqlsldmvtsxfkilmtr'
ClassName: 'lvhhptmwzmuqovbkpebwrosccwcnqtb' WindowName: 'ocsidwhfboohjkbarw'
ClassName: 'vwwfyrvmwhqimakgkjjkgarg' WindowName: 'fntjzkizkdptxoteeliumlrngxgh'
ClassName: 'gwxjiigfcuxeqdndp' WindowName: 'qrtqishlpabmjmaqt'
ClassName: 'bsojbcvwfespdarvfhcuikkxlgffxvmbd' WindowName: 'gblwbcjygrzpylezhnhgypfjjjryhzirfl'
ClassName: 'ytfrxxjshyevpcjuduanoljngaqefa' WindowName: 'umtncjekckyvrfjwobzgnrq'
ClassName: 'zykpgikxezvibljw' WindowName: 'tpzchqledhdsxnbgyhzwnzjwp'
ClassName: 'dkapakewokxqjavbdbceedr' WindowName: 'ktzyotamybwkojtzhiadwlhsblsihwnagtbgbo'
ClassName: 'jjroeuywdijnlaf' WindowName: 'iojityrfulpclcznsmwq'
ClassName: 'wwjiydvpfkgsrbyvizkflsigtjtape' WindowName: 'phzrssbzdtnoourytczcwc'
ClassName: 'rssnbnpmugazzendlzhbwabgp' WindowName: 'wazznszezsyvrgcbelldettoo'
ClassName: 'rapqffuzdfhqwmhajiiab' WindowName: 'qebxccwiqgpewrlzyhf'
ClassName: 'lcozfcgqcsdvctrljrbxaktragfwkrw' WindowName: 'ctowsllwpjniqkwsnanlxiyamrjt'
ClassName: 'uxsbdsasdtiucwcygihi' WindowName: 'vlllccqgfwsofmtukvqvdjwewknewxjc'
ClassName: 'jwyacfocijkfpsjolyzmadrqdaoms' WindowName: 'nxroseacqgmhyhhpyuixbzqpgzwvnz'
ClassName: 'xzwswzuntgkqqnnayu' WindowName: 'ssmvuywozxuaxlkylygbydqdgulbfszcjryp'
ClassName: 'pavuiunqpnoqqbxfzsmjjksexomvasjegzgykmy' WindowName: 'wkdurxnhminjogqjgpcfopymokechpv'
ClassName: 'zmgcyiiathhyylwvuifzzwptcsgobxwfdqxbwr' WindowName: 'dsojuikejjwdoeafe'
ClassName: 'pkcmsxexitbervggfswijksmh' WindowName: 'rhdqcrzfvlofnamptwxpnuoradastx'
ClassName: 'ajsppdpqwgsmuum' WindowName: 'dskmcvlbdeavvvplkereqnifknxbbfaeck'
ClassName: 'frbmkqfddwkktpuzimascumnowmeowppkxugkec' WindowName: 'vsuukhmdvcsgzxsnrbimeorhapzenvxwaijqlei'
ClassName: 'yqgvgdfmpjicqkfqlpqbxdnbxqxzhv' WindowName: 'nomxnkyoexchfekeempfpxyanxghrfewmxg'
ClassName: 'hhqbyhohghvebpxnkfxnmuwxvvwuflo' WindowName: 'solbrkzcvuvzmdmpctwjtogfzybmkjpbrys'
ClassName: 'gkmevqxfokuumxuosq' WindowName: 'rwfjnnumnbntqyk'
ClassName: 'qtqsfaolwjuvgwytimstacqv' WindowName: 'nbetikxatgoshgkjpwrfgstehlrujqesm'
ClassName: 'nnexicdpoigzhoqqrudwucwkzzkgbqdrrqugx' WindowName: 'zxnrwotvcstqbfgfsyzvrdmapwfk'
ClassName: 'cvrjhxkaojcuacznmmttoychninyed' WindowName: 'glehkjoiqrweildotipwvcwzawtyldjgr'
ClassName: 'cqtmbywlhjeqmdfewyzdjsytpfbwzofpkp' WindowName: 'zvyydondlvilrbavqumapisycjfxmb'
ClassName: 'lncwjahgkjnbmlriwypaguimzvzqfjaa' WindowName: 'odqzfcosipaihbytkailbni'
ClassName: 'djtuncguhiefoolqgiyf' WindowName: 'fxdsghxvovkyxenenewbl'
ClassName: 'pytpkahhlvrioqctzvrxzkownpfygsetrscnmy' WindowName: 'raqefmqjsuejojtma'
ClassName: 'kwxeaztxjjqslqkxqaxnflnkeqjnfl' WindowName: 'mfsnfnvnigvaacussvzwdtxwp'
ClassName: 'kogltjlhmdskabuacyfzuqrziebwql' WindowName: 'vzpgqzbnmbplmpxetekjhxwrcpkksxdapihugca'
ClassName: 'loxensvegxnhdrdwvsbeuou' WindowName: 'eywwoztsqszhqvzvospgjyjjj'
ClassName: 'eijyeyagmitgabhkhyemstvjtlittqo' WindowName: 'pkenlgjngreebfcquocuhwjeaactkdzgrwvs'
ClassName: 'xhygjfyrajghhtxdznuhvzyz' WindowName: 'mpgxdbhpdvngloeffdiakeludf'
ClassName: 'inhjcanajhsaioellkboipjhyeguealb' WindowName: 'xjijvdtqmutucvn'
ClassName: 'zvbhriwuclipuvzwwjxtg' WindowName: 'olasaarppplpceklkgezejzvpgfupjerm'
ClassName: 'xlrrctdlrbkvqogwxdlzarfzi' WindowName: 'qapqqtttkitijyucioqekerbi'
ClassName: 'rolvpmiiypwuzngm' WindowName: 'mfidrcbiebgkutagtgfsasaypr'
ClassName: 'gzmyhgdcyhveepkds' WindowName: 'qkduxyuhrduovobnulnjijh'
ClassName: 'gyairndgywjhygewg' WindowName: 'benifyfktliqyxkvofttwzq'