Trojan.StartPage.59231

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nso2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nso2.tmp\System.dll
%TEMP%\nso2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nso2.tmp\System.dll
%TEMP%\nso2.tmp\Math.dll
%TEMP%\nso2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'hacmztraoblhtuulhgfqxxs' WindowName: 'uxwbhlqpfnpfltsudydcxaevegjpixays'
ClassName: 'fchlwkqooojqpfegsdqcgaawqscfnrcskblhgz' WindowName: 'xzsymlreklwfplvkxff'
ClassName: 'mcmrgerkreqftxcuiekyuxuxwhsyuuw' WindowName: 'lxybaxgooqfcoghwydbcrljiqafpfsynjey'
ClassName: 'jtocumibatyrdnjtwsfxsymdshllefev' WindowName: 'kmrpmmffzkttljcnwhpqgy'
ClassName: 'uhcvxxlbgncplfkmxzrmwgofwgqqsbs' WindowName: 'xmhetnjxnihisydwu'
ClassName: 'rvujpidfqupdbubqecugzbvqbluetjrcsfudtbz' WindowName: 'wmuxbebsyuxnhmuktlqaloscyiasrhklwpkin'
ClassName: 'qkbiqwplinrjeusxgzogvwwncvbb' WindowName: 'bqjgznlhfxgqqsirlqtfxfeibdmglkiybmlp'
ClassName: 'lzlfaywqjnrieytvlzfuhdfmprh' WindowName: 'taibyvsntkuiwcmcfcyhw'
ClassName: 'blanpwkdzxhrzxufycflslnc' WindowName: 'buxjlhqymizidmtwstylqweeafn'
ClassName: 'ftzpbzpwjbueitkaex' WindowName: 'gbrqfeumkgrhmbsjijvftylvvrlzcdjhbyjh'
ClassName: 'fmvysmmsynzcsojkivy' WindowName: 'qdblwxdldamfabmqlzvucch'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'jqiywfhxpbgyuprhnmthtgcbbzfei' WindowName: 'sunpabscwtrbgmqjrkipdeeafqhltjsb'
ClassName: 'utxhllkbhqieliesdjdfzwvldsyhyzmhbvuo' WindowName: 'vrlwgovlcmjjrvromwovxxomxt'
ClassName: 'gotwkoraqqszzyunadygmnruiryjevrfafzu' WindowName: 'vobcjwbwusoqgduoizh'
ClassName: 'qdjezjmkbnseewaapnvfv' WindowName: 'ukueuxttjlniwbdtuhmilzowwlagxrekcu'
ClassName: 'tucfydmqhkfrznrikuxvy' WindowName: 'hxlsdbdqzkbyvpsfgkemldhznrxeftmdqfeyeuj'
ClassName: 'rpytqtvnjcolbuszvkyvcxlrlnmkzbdzvi' WindowName: 'ktzofvqrabeilcflnlzodbtsyfajsmfd'
ClassName: 'dawcpqtbwpfracmt' WindowName: 'dkmcmtrcdmtxvdqr'
ClassName: 'tzslcqwhtslbmzver' WindowName: 'jolynrbrrycxuflpljcfmbnwrwospqsvmh'
ClassName: 'zkadydaztwzzrhlkjyjssclggvvtde' WindowName: 'mzmpilcozpycjyarrrnqo'
ClassName: 'mhfcumczlacjryfxajfa' WindowName: 'laqqxgclfxypmlwiirt'
ClassName: 'kjxompxaihrmnemauzbppjcksuhbwi' WindowName: 'yeaprgropzdctelskwzo'
ClassName: 'kitcumqanzmodkjyvqqdah' WindowName: 'uixzjhipyltqttfzwiwapifxljubcdacrdi'
ClassName: 'oarebogocqndnanbpdklclgbemlu' WindowName: 'aodjiikpfygbemj'
ClassName: 'sydiwfviwdgeyksylqvopogorvzdxjbickcbzy' WindowName: 'bqgtsrpjldnxyyutzlurhqfhtccvs'
ClassName: 'kjcbmgqtkakqdetkboboitzayfelirowxarcjwa' WindowName: 'bjjashokwvzskfwnnbprnp'
ClassName: 'olidghnkmtfuhjtoucghvnmshaxjuyiwaswwqrd' WindowName: 'judlgjqwbykjnqlrhhjr'
ClassName: 'qsgintxsikpsaydofpy' WindowName: 'ytljtypkomogmgmqwu'
ClassName: 'zgijiktjckispitwrqvvh' WindowName: 'dauodochdmnwwghticvwjfwfpstvlziyw'
ClassName: 'ygqftklmpdgxhrsnotdmpicybohkdayzjktcno' WindowName: 'fbrakwclefhqkzgcuqeuqszyojdaiihzwayzj'
ClassName: 'pqonrgkfwltkkzooqboqlwixb' WindowName: 'lwjseibnaibdjdjpovt'
ClassName: 'ttqlpgqzikpgsbjocaqwauwu' WindowName: 'qjxzzmouvrlxdzprsclawfp'
ClassName: 'sdqleeykdqomzcakk' WindowName: 'rmmxstibtuaybicodwwalbofubncxbnpwlwzdwa'
ClassName: 'agogfowapwtyucc' WindowName: 'hldpzudcfrmgbxxonbaggspuprpm'
ClassName: 'wrcwlfdyzlzrxbxvjcvzkonqoyrmn' WindowName: 'hhdexomqyyhmudmze'
ClassName: 'ppvhbwzrnjzoqrmfuggojljtbotzgavujwn' WindowName: 'hdjatcuwhgrjfauhlvwtqrbebzmtrpp'
ClassName: 'jrgdiizzdupudrxatdklgn' WindowName: 'nkuhsnpolkgrqsjfwmovvpulbs'
ClassName: 'fejiscbrphhfokdbi' WindowName: 'awmbvroimoqwcklkzxpj'
ClassName: 'tbwsqlcybxyebskvuylro' WindowName: 'smzxbdrwvvdcvayqhmcyaangwyqcff'
ClassName: 'ajqltcumyyxfmnwdyynnkbezgbqluskhal' WindowName: 'voggzjtgxgmyeasaprymggubscqfeqklz'
ClassName: 'xobjesdztsbsbrmnxndojpfnveuljnakojbw' WindowName: 'jdkmtpwhmfcfhevaofpqdxjlykkwvybmegkj'
ClassName: 'yytvduqxecqgkxkkigvjgnfnvffljtdsyf' WindowName: 'mbscvlvdswntsgkvf'
ClassName: 'knfzbukwijobfrvdcnssvactldsbbrz' WindowName: 'wreddfuefsmxhynjtxansxvscontjsdghelak'
ClassName: 'yosbyjtvaguypxutyfcitooda' WindowName: 'ynpqhecynhoevmtegpblkuejzlqktpyvcrdihpk'
ClassName: 'onjjyglmmtovrnstmtbnefevmckwcqmzma' WindowName: 'peeyrzcmghlgdiqsttzxdicd'
ClassName: 'rfivmyscantsqlvag' WindowName: 'guxlczgzjttuulzthxaop'
ClassName: 'iwjgjswungcbdwomsjwybjwekfilpycquzervdg' WindowName: 'ylivqigizwzjpjnlvonmvnmfxfemogzqql'
ClassName: 'vurmfevysqugivxtd' WindowName: 'ebocfathbthzhewubnmgcuicoyebzkuyoxh'
ClassName: 'exmkgwykclvrvcopdfkplenslz' WindowName: 'qzvcxueoxnhzejrpbmsmdxxrwwqjzrk'
ClassName: 'avsjzjorplphnokwnknczhgmpgxeblorex' WindowName: 'ccssmqxylhmyldsvngeerkoqxnzhioks'
ClassName: 'hrmidjddcybsiekaqvonxtkdrferziiy' WindowName: 'azceoczhlzxxxvykqujudkipehhicwqw'
ClassName: 'fccpbggtihgfnosjbygymauvoijlylrkrsn' WindowName: 'ejemgukqabxwtxtqcvoppzmagzfrcsh'
ClassName: 'qcewfkkrpmgnjjcaoqmkrufbnjcsejp' WindowName: 'mkgmyltenwwzdvwlo'
ClassName: 'hdhcvaykkgtxiwtjwf' WindowName: 'zsjpqkynmweoeasvxdxxo'
ClassName: 'gsaqhpmsqwmnyjsfsvsmjab' WindowName: 'bswenxsxhltbtbhqys'
ClassName: 'sfatycdxckfonuhqczskqhvjuxsjilz' WindowName: 'pcvkfkyhekqrrxdxeurqyypjfyzhesilsy'
ClassName: 'qgszgfjpxfoyqqicnxshiqpsgcidtywlyoy' WindowName: 'aqiipztybbrblvxqschkrierwfyfc'
ClassName: 'ytrenseuncjickgjrluldfwalc' WindowName: 'rzmiwxexhygkbbsjccqipblryfkkujrot'
ClassName: 'prsfqsyfeqfddjsewbwzliaelsgkdgtwh' WindowName: 'aizdelzqgrhlmuoqrkadgmhjpcdhyrztvmbbk'
ClassName: 'qajtruldkmxjbew' WindowName: 'ztsdvfapufqwmbiaauppegoiepeschiuki'
ClassName: 'uksmdgiedoevgqxuslgnbxcaxecxi' WindowName: 'dgxfustxfphzkmtjgevvutjobvbdoyow'
ClassName: 'lngwqgyychqccjfcezjaaxwcubjikhriwhqmbal' WindowName: 'asckapoznyjerbj'
ClassName: 'cjsejyfwfmyigunmfjykk' WindowName: 'mbgibocahnjibhkgfsmwmnwyvmlbjzmlsqbb'
ClassName: 'jsbzyfvtfkouuxlopkitbksjncl' WindowName: 'evtdeaorvjogtruuxibgdejfokqlwrjtimeh'
ClassName: 'rqzdhvzbxzzycimhvy' WindowName: 'dmfjguiuhxujwejszey'
ClassName: 'smtbpmagqohiseocqcjgldecolqopcrijcur' WindowName: 'yynizppoijgcvwjvdhlpnkhp'
ClassName: 'ouzkprmbkzzvnnzhwtflejffgezaohfy' WindowName: 'rlfddjtkjljryptgmnkvvtx'