Trojan.StartPage.60656

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsj2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\Math.dll
%TEMP%\nsj2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'hkbjjjbxsyuxuytqaqxzjhdozjwrlrohds' WindowName: 'vdfogroeavrxvgsdfzzrilumqojq'
ClassName: 'cormhydnzhowqgacbkdvrfnlvibwltbvlgrfvkc' WindowName: 'tzqnklkhrxmcitnmnekjfmgklkxkymayw'
ClassName: 'jwxpavhlttmaopeyqvgewcbsdkihlmijwxkf' WindowName: 'lfatnejaetiycgicpeaivmrfglxvhixvse'
ClassName: 'rvhmbhadxnlgxtfrgqeisglsskkguxvlpbu' WindowName: 'leysofbrccnwciojjstzttvmfxeltogzflzt'
ClassName: 'rdnkltqcayxzqwdkuifvffzndxarxeilg' WindowName: 'cjlcvwotzurywncswujywcvifbttq'
ClassName: 'zutahljsncdpdqgl' WindowName: 'svkbytpewpcrksnhtaieykkjzzdkydtvhzzjots'
ClassName: 'omzechgpwbmoojbrtlwismauqfiz' WindowName: 'udvxclpghitqovkgjhbqvto'
ClassName: 'deryhhfccpnoxcyjvfyjthjyhrkoxvesn' WindowName: 'skvdjybzrpkraryvguxlltqttxqxue'
ClassName: 'gohqjylnpltciaioqqwcebpmxfcm' WindowName: 'kkxvedmdmvdefnsautfico'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'vtyzeimxgwbuuyapwhtdfftlfloglig' WindowName: 'umpbqgejjdboeyhkpnkfjxqdmntyzaomabiezzb'
ClassName: 'quymfhswgxwagtqmloohqonsiffzkizrhdiwf' WindowName: 'apkhfyvvqbuozgm'
ClassName: 'myzxghhwrybjruaivkd' WindowName: 'yocrqartuslibsqquvk'
ClassName: 'gjrvfpenmlhgcekthhxxcwmqjpbqmuvrtfna' WindowName: 'pageflclhjkdcssazp'
ClassName: 'ggeznwycztyohxeyqrixdlptmchjwwzoi' WindowName: 'ouqjaaczqvntgnxiredvkw'
ClassName: 'zejlykuvaozqjpwog' WindowName: 'qrjsxvththbjamvoesymmebp'
ClassName: 'fmirzxetgqypedhcqcimefliwqh' WindowName: 'pgmyilvifuicnykdkwxnwyyymhrnnzmatw'
ClassName: 'rujewsxhoikehckmothxdbbuwujx' WindowName: 'mjzyogpwcbhsrbwuupyejsklwbrbpwtr'
ClassName: 'bbsmatbqcmtkdhjnxzmm' WindowName: 'syoelqykrwnaekkfc'
ClassName: 'gadgxssojlmzztlhieupjbwdebtlu' WindowName: 'gvymacoziuontrvnhwdafikmuexfsfltzq'
ClassName: 'fbkhdokmcbaiwsckzlbwdpa' WindowName: 'qcmeuahrslqszbwzwjmgkkzwhnyzopsil'
ClassName: 'unbaoxnvqjoffohcvzozgppoulhuchwivwwinf' WindowName: 'bwtfcpbfaqknnegfzlqicfnrbscbgab'
ClassName: 'wmqxlkyzixtaqoxhgzdodkdvkulc' WindowName: 'xnkaqwpeoaxarvqt'
ClassName: 'aduyrlcdezlosjca' WindowName: 'rbwlldxvyzbwgoijemubmblboulsaeceibhucx'
ClassName: 'lvbtetvqxyujmerdwaehklhvjzliokvzk' WindowName: 'hyafonzahgcowlddrykhvcrehonvpmxdgnozytz'
ClassName: 'pzefmzxedrvcktbvgqthufyjwtkted' WindowName: 'yvrtxmpoocfjrjihd'
ClassName: 'msuxkaebepfymyetzkhaeksvnmkrwkihyh' WindowName: 'fvhyssklvhxogcw'
ClassName: 'aybgqbbjneylywtch' WindowName: 'yxpwaiwxorirokqdceptgx'
ClassName: 'shttmjnemzcolaogmngtewuh' WindowName: 'qxchapvvkugxqmdvlnxnjqvblskfkgjnebnt'
ClassName: 'xhodmldstsanubxajcbkoowskfhxowe' WindowName: 'xgoesvjhemgugcpoqwkhfrdimzorevdhfmmdmsw'
ClassName: 'hhjhydpkrnsxwjqzlixsi' WindowName: 'lzmndndrqzzlgzic'
ClassName: 'gxqfpcprivslbgrfgmlrrqmxsklu' WindowName: 'undshhhemcgbwoye'
ClassName: 'bgwsvkyiynigbthlvhwxeznxzbvdqfiucszsj' WindowName: 'skeehopufnwucwjssxafnaepyx'
ClassName: 'fuijrfuthbwrixosvssovjcp' WindowName: 'fmseabqfsopmvsvsjbhmlxzujrd'
ClassName: 'fwilnsbojdqxnmwpptkn' WindowName: 'hmbxvwcoxnfjtdmtilpt'
ClassName: 'flbtexxhecfcuhwukjafxwrihxwrlzcwlb' WindowName: 'lbgdzockncdsobkjjdwew'
ClassName: 'yaaxfnfvxfzalsmzuenfajushcbnsmjh' WindowName: 'wmtzyrozxuqiygmcpzundakgtyicsiij'
ClassName: 'yobhshhhrgmidvgv' WindowName: 'rabacremnmljiwtxkveaquclubvyo'
ClassName: 'lhupacajfezwjlkaxytqckdujeyuzdcqyobhv' WindowName: 'ymfvcibbejwogaotdyvikts'
ClassName: 'fqgbcdowzxlluxkqbdcokolihmcodqirodhsszk' WindowName: 'dovpglquntbgkyrxrabs'
ClassName: 'fjkxtafmbqamvkalcyoha' WindowName: 'snaixbcpxqobkstwo'
ClassName: 'gtqhabxrddctcjebulkzinkuro' WindowName: 'xczddxcgxqyxkecikxrlgfwlxypzljtore'
ClassName: 'rbjpxcwfedvjylimhltekqfatilnuwkxuab' WindowName: 'clovwbfdzisvnupravirwomcawxcwvl'
ClassName: 'fjmpcjqatbrkhqkisianuw' WindowName: 'zskwgolsrbfbexsfhjoazoycqjpzdlykk'
ClassName: 'xsqdjmqjvrrjdwnputyaaryyqvh' WindowName: 'gnxiwnhvwihigrta'
ClassName: 'teuhzbvyjybsztwkcjcxhkef' WindowName: 'yqjdgzkxbesvlwh'
ClassName: 'njiybdjzpvysdnjxycgvfpve' WindowName: 'pyklufyetrwnqwljbrsqguzspnjpin'
ClassName: 'qmcehsshtfbkwbffevuy' WindowName: 'chigpzxingaxeraiqorkta'
ClassName: 'qoqimyjntyzkidkdnugpirarjausklaglpl' WindowName: 'vsgztdilxkzoqtdwni'
ClassName: 'zmxozlqgrvtapkg' WindowName: 'fqonplckuzzuildivhgbme'
ClassName: 'jpncqwpcypvxrgzufenrdyhyffaureukwzxuab' WindowName: 'ttweojfddlfnixrpgyamxvrcepccyowrlcusgfx'
ClassName: 'xxewelcoecylufwftiyi' WindowName: 'phvficxxpxjwgqfxlnmdoe'
ClassName: 'eltdmecjxqipisdodccmmdlkzoj' WindowName: 'ajyaykzztjqvxnwshgyowraugbwe'
ClassName: 'mnbipkzzbwmgxesrvcddjmrwygpiavbppko' WindowName: 'kwayqsgtdsghkafntmbslrrdrlfbtmt'
ClassName: 'adwodmltsqawgjhwzsqsqe' WindowName: 'omzroemdjinlznadthksihpfpskmriukcened'
ClassName: 'dafwuzybancxixrfkxekqbl' WindowName: 'gmzycjjateehmucdzxgftsn'
ClassName: 'qhizeeafkwzurotwxvj' WindowName: 'yookhcuehklmcnkyiroqiptwfkktyffxxc'
ClassName: 'nvmgucpgslulijtdkbvikztluwcomievidg' WindowName: 'qcagxhzzcrlmzqqiqkjgwayjgpiidi'
ClassName: 'smpqnalinjzdqkbikktskrquxch' WindowName: 'cwdmxpjaeibkuxcuqqyvddilaovejxyr'
ClassName: 'hgrgsywnsefvitdh' WindowName: 'iyrwbldtjuieljhewlpsjpepsxwhfxtlzavens'