Trojan.StartPage.58182

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nso2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nso2.tmp\System.dll
%TEMP%\nso2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nso2.tmp\System.dll
%TEMP%\nso2.tmp\Math.dll
%TEMP%\nso2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'oxemttgryocopczm' WindowName: 'drkrwfhpfgizdjwkzbgdvfgduh'
ClassName: 'mtkvmpnmisqgbcedqkobjalqx' WindowName: 'etrosuqorvzczclfwazkenlmsawulq'
ClassName: 'yriccgncdwhhkfsjvtmkkdctcmb' WindowName: 'smlsijfdcslhxmorftvumuarly'
ClassName: 'gjwqxeyvjcyymrbwlmtpdyipod' WindowName: 'qkejeyplxeoswpsgapufeecyyfg'
ClassName: 'xtfbbtczjrbobdrvgrjdjpkbtrsgw' WindowName: 'mmlbaqsdkelbuumltav'
ClassName: 'ynnygshhjajsrnofouhu' WindowName: 'vdluldmbjeeashhvqmeq'
ClassName: 'ewrrbzfbdrjxwssxiwzeebspmh' WindowName: 'qzyqcubyxbnmibpjzhegkchzkqh'
ClassName: 'tkbmaszxltkfcoowzdyaqzpjoi' WindowName: 'klxtkhfwskftddoacnrc'
ClassName: 'pdcyoqjxgwuruhflvuwmuxskjjqnvqmofrgqvpl' WindowName: 'iyckvxxymlwnscbuwjihg'
ClassName: 'zuvsghidnmbzbxo' WindowName: 'vogkzfxqpabtwqcbceytlg'
ClassName: 'hihfvohvutmgapwttxfugqseutjmlauzasrbs' WindowName: 'vwdqslvlidlevtgpfgjaosamor'
ClassName: 'uxmoqazaqmgdcgolayhvuxbqfnepoesanwd' WindowName: 'fdybmsckljfvuviczggl'
ClassName: 'udknkgdpadlbgcbcgghajjsnkpvz' WindowName: 'kjuzkfxxvvlpsnjqbirbwi'
ClassName: 'cxkvbeiblqvsehfcozstvgbrt' WindowName: 'sntpsgglfqqozzy'
ClassName: 'ybnyzgcrxjurfetftofkbygfjfvhpugljaimxb' WindowName: 'zwakzduygccwddry'
ClassName: 'nozbfcqjbokhmtmfjofexjfgq' WindowName: 'fcnlwfeqhjimijveyczgwmn'
ClassName: 'huzwmavgkmzwhavcyyhvtjmqscnssikvq' WindowName: 'dadevlyivfmgmicrt'
ClassName: 'rrwcmaxpefgtzgxxsno' WindowName: 'sjafrglodmnfmijxdytijkisxqfavhg'
ClassName: 'damjashaiibnvzrhlmefdhpbej' WindowName: 'lrrbbhjrzdphjyfhheqafrfshnalqals'
ClassName: 'zyncudqrivpkivpgkrbcueuxpxtoiabwashbfqs' WindowName: 'sdkokgiofzkurtgcmnojibpv'
ClassName: 'wgpghllzqzwypzinlwfyhzunqfoozkozdusijw' WindowName: 'cjrgflerzgbczdsmbutcnbzudsudgun'
ClassName: 'vghsagbruxvvdopdckvmwpjurfddhwxsa' WindowName: 'xfjfvewqeomivvxungrevugqeatkkwqjlehwsul'
ClassName: 'iahbpnsgdusruxozpgkahicploblajo' WindowName: 'lmqxgumtjcwsyamdduk'
ClassName: 'eofusbldlfthrwtrqgskfbhtfhe' WindowName: 'nvscdecmobfvngyx'
ClassName: 'rqnxeuxjahzxjsnnmqgqoqmottpdyjk' WindowName: 'tmqmzcbmfdgowgybzxzphfwki'
ClassName: 'bruyieqjimmxjodwfibikbkwbazcwtcuoaedt' WindowName: 'atrvvyrfqeghgwzwpqqigwqmpotzlybmqf'
ClassName: 'knbkotesvgipryjmdijblnr' WindowName: 'pyxxaqlrtuwufowwkewoucswwtmbia'
ClassName: 'gdecdioovgimanozdtuofopokqmbc' WindowName: 'rrxdmiuwdlfwvmuxbjizjyxh'
ClassName: 'zsrjyuytmhzifzipdwajhutjsbbjrs' WindowName: 'ffnrgpsezremcyl'
ClassName: 'frfzxiozshhjktk' WindowName: 'twjbofkfgxiadcc'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'zxgyjamrkwersifbohsdxysrtuzguynypgtmq' WindowName: 'hkoofufeelcxdjjtr'
ClassName: 'mzxiidixnhllusxdereqzgl' WindowName: 'zqnsgimeuvrxgrikvkzjzgty'
ClassName: 'tkuwvlqljklldkdcpzc' WindowName: 'zoosljdjoktwqzohoasqvqoefvmopvaxywjgmht'
ClassName: 'daojgfvtjwesnvwawluydaykaqsjaazxtimjq' WindowName: 'ckdsnrsrpdswodlpwnjfxjyktwp'
ClassName: 'gbuerqsxkdkvwkvrgwfz' WindowName: 'mqtqqbaeljgywedwkpwi'
ClassName: 'yaoibmautlghavdssumnuxwzzqqtodycfzdg' WindowName: 'qagomircgiwsncqcops'
ClassName: 'zbbuvayrwtaospifegcyspmdmqtm' WindowName: 'tpauvnmxakwxulnsunpuxjlyrgaodp'
ClassName: 'qzpafbmzacqxsvxknlqscantoql' WindowName: 'vxrqlbgtauwgmlzpniglrdwvumxblxpcwczy'
ClassName: 'ckcpazezvqrajrgxpzfyjxuzicktjulwlgkxf' WindowName: 'qddbiarurxinyzvtavfolztljikrfdajg'
ClassName: 'kogdxegqasljqwopmputltnuwdtbdoyxnjj' WindowName: 'bsfnlftjysnslwkezrq'
ClassName: 'foqucmhehbrmvuyvnslphgddddmlvajyerr' WindowName: 'hzihmvatjjodpemnerbyfbasupxaxfllgzgnrg'
ClassName: 'pxwooxltvfbyvnzvopseqoroduuesdi' WindowName: 'swqbkruvjztyhfbvxqxgfbhfipgnkdrulckdeb'
ClassName: 'tbffeuqsnipkkzszobdwmgvwzxlux' WindowName: 'azmblvckekjijycpligomjsmqjixxwydvkxjtql'
ClassName: 'nfbzdtcesmyoqhawxlcaoaxjie' WindowName: 'kmbkifdsiqbyalolxtpzjvifomwoxjtfgtcl'
ClassName: 'gegnmqoufdztasnzk' WindowName: 'bzgkfibwavcbkjsjgstakbprlsoiovnm'
ClassName: 'afwoeobhlddttuaddxz' WindowName: 'tqkhkdoepbkpvrciytnpeidigqdskyidejjmolm'
ClassName: 'qjxsimxpvcthaufyez' WindowName: 'oqjjsciitcqhcmkbb'
ClassName: 'yftwiucwmrvvjbzaudiqbps' WindowName: 'cukgzsnxrafkbteurvbxa'
ClassName: 'zghhcavjxjbtyeiwowjcm' WindowName: 'fzrkysfzthihuamqwurhxntlvbpe'
ClassName: 'tifqwpuhxuvykcrhomczyslvftp' WindowName: 'dtaadoezpsockoaurfwarfecvtizv'
ClassName: 'xholiybpagkxpfewwcoryjxvlmgneueisbet' WindowName: 'frqbmjbyfrivnzwrcoryughybldp'
ClassName: 'sfdsuauonzdhzzrnurcwhdmurc' WindowName: 'amfkiwejghzywvtglomlwkypkvajeogsmbpgay'
ClassName: 'vttohtfmfpfcnodrewwfmwfkzk' WindowName: 'vpmgqbxggdbdljkgtfdnpifpgiqnapt'
ClassName: 'akskxlypmxkkkrircvlx' WindowName: 'cmivlwcyqjmikdliytkgrprvqdgtvxhv'
ClassName: 'xqrukzybpevhnlpnqmacnmgnhvkhy' WindowName: 'iowmvqmrvucrpjuoozgggtbocvmklsyz'
ClassName: 'yqvqxympjxvnjkroz' WindowName: 'eibirkhuyfhcjrz'
ClassName: 'xomcemiqasnckqihmfvcjrupnzyleyrqvk' WindowName: 'vbpaccazxcgtkvkgezitaavtcugabckbtsryd'
ClassName: 'xvglgrssuxhcmcwvtbbkov' WindowName: 'otjwbksglyumqkag'
ClassName: 'ohhxkklqiiseodkwbwecshqegfgaswdth' WindowName: 'uzadmgiyrrabnixjbaqpprqwnhchq'
ClassName: 'nipcxnpemhnfyvyedwfjdpvcslam' WindowName: 'pfbrbixneitohku'