Trojan.StartPage.60488

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nss2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nss2.tmp\System.dll
%TEMP%\nss2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nss2.tmp\System.dll
%TEMP%\nss2.tmp\Math.dll
%TEMP%\nss2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'mfewzlfhdmkvuumaxzfuuvzdbyvxnmozop' WindowName: 'ezpwexkeeymqqmcapyhzawfjbf'
ClassName: 'crrhfptdmpxhcuahjk' WindowName: 'jiighqyficzqxlojuit'
ClassName: 'ffrsswdcmdwzfwphh' WindowName: 'cakeiwwasbsknqnhwli'
ClassName: 'drgtrdvvmxbbtintf' WindowName: 'veumsswviizdjejfjmrtxazlgyyqlmisbbpctvn'
ClassName: 'hbftemfzhwtlaexxl' WindowName: 'vtsrztztitaycvztssiieo'
ClassName: 'yqlaowguqewvvoktdxlkmnw' WindowName: 'qwsxautmirspaqrhoqx'
ClassName: 'seleioraijhceqvgfeiulstlckdns' WindowName: 'mwystgzmzwtxzwaqeeik'
ClassName: 'jefhmwvipolyinlsnrjlimrpqqgwiqimsdatxi' WindowName: 'joplfxwqqgpwklrjlkabbnypryypyhvisiqfmih'
ClassName: 'gzhlnkdltbumsbub' WindowName: 'xvysyippumblhzuhoqe'
ClassName: 'fltphchwwuzhdsoqikr' WindowName: 'ikbhybzzgftwzdgmoatyoq'
ClassName: 'fxeziksmuthtlgnnwfiobp' WindowName: 'myyekksjaqryufrsxvfaasiyuuesxakxierpsa'
ClassName: 'titmhezdzzbjbpcuvfjkoqgwpnsofeowhwk' WindowName: 'wzjzziurrlrwwmvfdr'
ClassName: 'osvfzcvcuqcmcqjelqc' WindowName: 'isvfrfhtzqlppmlzjvwhgoac'
ClassName: 'utiiobfmkycwxkpgdypoxfbqoyn' WindowName: 'dnqfhdtjchfppuiqawnmtfvumcgbj'
ClassName: 'udjginxgulxzuwgf' WindowName: 'ttdobesvwzuotzwoonjigkjmk'
ClassName: 'tcpffggaapkmhtyidtimbjeeeqaxrdynivfvxnq' WindowName: 'ojvjbmmdajfxmxogqtjawfkfqmipooyxlvmhcaj'
ClassName: 'vstmbirxqytihbeflfpbeq' WindowName: 'qqnwdeskcspwhnipaoeclxv'
ClassName: 'dbmwbaelskthdskn' WindowName: 'qzfbufcsvicfvhfaamyclnqbdm'
ClassName: 'ouxyhnathexqmhifwnbsgbzmjsh' WindowName: 'klhbzzgnizbusngrykmezcvtjhoyvx'
ClassName: 'rfpggtlvuugohqoqmaadtegrfovsbsbirt' WindowName: 'yygmizegndhdvfpxhszvpdrvqjihlnz'
ClassName: 'oqkxiswwrpscuefobkjwgjihapzj' WindowName: 'qyvvagsbfriwrudybhwltllv'
ClassName: 'dgevqnslxuhtowdyhqetkqpwdwdsxhqtwnexcjn' WindowName: 'kbqwvrqbbdotcll'
ClassName: 'onbbzhauwoubbenbhbofh' WindowName: 'skkjjxwcxnrfozvmwnowdngilrcfynvmsbfot'
ClassName: 'rowgkhmzrsnycywzxgtdkxemfjatzxzudm' WindowName: 'vvfqdnrnonlflhppx'
ClassName: 'arituuhcilhuqykohrekboxcglrmjpx' WindowName: 'qseamsrvngzatsftulyuszhjtsvukr'
ClassName: 'zyhurtkawmhrtciivokvksbedy' WindowName: 'nxblhzkxfsogaiwyzkz'
ClassName: 'bszrdsdnzgmtjvchmareylzclmhyjlixclf' WindowName: 'mstlmpfmybbpxnebrtlmyjkmpwesqalcxxh'
ClassName: 'lwabkqiiwfrljcxrnqsjvg' WindowName: 'prwqzxlweuuwjxsutfjnsaejzr'
ClassName: 'hqiqprilcednxtectcsxhkcenvhjygzbidgezi' WindowName: 'gpfnzquodbyttvvzrsoiwltwp'
ClassName: 'vmlmbllptgcocckmjbnmamdyk' WindowName: 'hxtrkcfnzkamjlmsssunyngzw'
ClassName: 'zgzzqqoidzbwobkatcxkoqqkjrsa' WindowName: 'vxyutshlddtliewolryipnjxu'
ClassName: 'trbqbnsfrnvsgrjgodclxdtb' WindowName: 'ltsxshsmoqdytnuezsb'
ClassName: 'qlupeubuebagvzs' WindowName: 'vsrajyvsrgadfmu'
ClassName: 'jkhpncrraagbjooxfdnakpxydekenrujycynw' WindowName: 'vwkuqdrjrjjibpqssybkirqddgdajzuanpruvu'
ClassName: 'dujztwgzdhgirmlgnvqwtyygrhfbqusjtpmbkye' WindowName: 'cmynhpqjfhzytndsamdegasduxa'
ClassName: 'ywlghagcafzpzdujfinkrlkemlnsnxefhmn' WindowName: 'uhrsjwrmkvaopmbdrdvetgpxtojnqmikjtsnuf'
ClassName: 'zmamuouvpaqfrfwihljmmelqsgoosozxkgrxhww' WindowName: 'ichlycatdtdlwxaphsrawznewzubnlz'
ClassName: 'zvfnkturlkoaxlzau' WindowName: 'pdadivrnhsfxcqxvlniefpxs'
ClassName: 'qfvqqmtkqdhsfbhnvgtwuajzjsrwynoojlvxhwb' WindowName: 'uisxblkzwntwxpf'
ClassName: 'kalsjnpmdiqzqvblzsnoumibuwymjphwg' WindowName: 'mjhlizyhyqvmejftmey'
ClassName: 'wzujpxhkhaahlkzrmjqa' WindowName: 'rpnknsmbadooybpdodigmvp'
ClassName: 'mcitvqgwkjlssrncxe' WindowName: 'phwmsztyxoatvhvqnxbwtkndnvlya'
ClassName: 'nzvxkibxnsbgvvjnmoz' WindowName: 'qwuzinlucmodgjvl'
ClassName: 'emcqseqqhkjhveh' WindowName: 'iubcudpfyjxtttpuxnqtcyqxtcj'
ClassName: 'geybwtwvqqefxdbfqgfsbu' WindowName: 'cwxqhupuqnrdjzpsvaqushjeuuzrddaboxonujb'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'ivfruennvfxytievzuqa' WindowName: 'raqxjibkdlhtqncncjmnxippeqdfltyu'
ClassName: 'zawerzuyvspsvufppxfrrwqjtszqdxzpal' WindowName: 'ezncvgwcdvyuhfshpktpaqmgqshxxfqwgnf'
ClassName: 'adexeoizyuoygikgxwhimbdzfrrsztu' WindowName: 'mryzrcaycxkyhmcihtghxzdsgdpl'
ClassName: 'paiwgmubjukhwnhh' WindowName: 'xfwbyzsxqdenjhdhvdnmxjkdzkrfihmi'
ClassName: 'lhdbrbtnsyftyweslkfygemowrl' WindowName: 'rcrxtncysjlsgqsbiacupkgofbiylmajgzyxcok'
ClassName: 'xdjozaisyfsjakkcwwiwxrhjvpipqaidiskx' WindowName: 'aleenhfmquxvijpojiaojiojrksqfahs'
ClassName: 'xbgxkrhymrqsrowdqkhkaeaitbvyjemediudfqh' WindowName: 'oeotsxsssoelqkwhfxsaiqammcskafxetygbpt'
ClassName: 'isxtklpldyvrpdrxfhtjhcdpndwesxxvfkwmx' WindowName: 'kbwrnglyqlkypintwpoj'
ClassName: 'ebziquhdjnxklpmlocffmekjhtwedsmt' WindowName: 'ujjnpuojckywrmgwn'
ClassName: 'kaxpmttcxnhhijubjnit' WindowName: 'cvqisvdwsbkiakxseniqpw'