Trojan.StartPage.59403

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nso2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nso2.tmp\System.dll
%TEMP%\nso2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nso2.tmp\System.dll
%TEMP%\nso2.tmp\Math.dll
%TEMP%\nso2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'cmeqdhcibwnkpinifuzqadntfsw' WindowName: 'etonyzydquhomoysouslqquwiecswkqabzqsf'
ClassName: 'istpuhdlfdqidksjljdiwekqevuphlsyvqe' WindowName: 'ywjpucdkhvhfokgjgx'
ClassName: 'gwuzkepzmyparqzd' WindowName: 'readlahxfgtuzvrrniztmrasjcrsn'
ClassName: 'mvrtxhvqgrznrggixxlevcwctbvwnblfuwpb' WindowName: 'kqmafwddxpurygx'
ClassName: 'owtwirwjqidfbnizzbjasfuxdssagbzftwhhhs' WindowName: 'fottigymkuctyuqagkpsvbou'
ClassName: 'qlxhtanyuzrcstawneyhllpikt' WindowName: 'amwwrwypzmuspklzvawftxrryopqswhxmswk'
ClassName: 'vrbfdtkusormyioavgkdkock' WindowName: 'tyexjgnokbvtewtbvtdhpgpkwbmapstlhu'
ClassName: 'ifqiyahvxdjuwcpbkxfgprpfpvmzuew' WindowName: 'nebrzpvqqhesaqwcs'
ClassName: 'kotvdiojywuglmrauhsktdldbi' WindowName: 'xtpctdtejjzenmgmjkqb'
ClassName: 'wiuobralvngcxlimswjs' WindowName: 'nuqsrjpuvmnrhihrziahzt'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'bgfnboytzpfefqgsjrmllsqcjcvmyldwkucfp' WindowName: 'zymjthzmiifpixxhjmunrogzutpefyyl'
ClassName: 'rquvazjyaemhidvqpjwlbjpjl' WindowName: 'ddudyfptsqnydsjkdbqjmhrqpvxmi'
ClassName: 'yvdxnpwdwjlkbghjneknhigmrvbooedrow' WindowName: 'gnqhrwnjrhtbtfzrtshowbqcp'
ClassName: 'leiuaqjmtqifjwpg' WindowName: 'voevnllckdwmtwilciehzrfusjzozarzvkbst'
ClassName: 'xzloqwpmcgbjwxqrrgmqwc' WindowName: 'hrfiousvnzkuzsrovtelwoaxq'
ClassName: 'imrefbhnmoftugnyfykjoxbsqtfxupsymjac' WindowName: 'ikuducjsglpxvndmhvylbufzkq'
ClassName: 'rqznpuyhwmnchefsxjhp' WindowName: 'curoqbemxbmuvoxrf'
ClassName: 'sjlctstmawmqfusciqc' WindowName: 'dzdreqtsqlirqszaigtanlcxcxxenad'
ClassName: 'slmgnntrwhotkhjqyqevajnzodffncupnse' WindowName: 'orpxdtvlpviwpbgd'
ClassName: 'qxfhwlbnkdlqacdtg' WindowName: 'dtakiksrzpdualycivfeb'
ClassName: 'xejpnrkstqizrvqf' WindowName: 'zitqhbtnkqcbcvfbdukrerzzremtmivfpmixtjl'
ClassName: 'alymuiuoadpvhbotvglvogbpojvziunzpljkqq' WindowName: 'ngeddfdvsocosumimgtxclzubno'
ClassName: 'ottgbwcasmoasxcgvxuozk' WindowName: 'zqxwolhfbdevksvjp'
ClassName: 'ijetatpsekaetkclauvlgyguwumydkxrgs' WindowName: 'xdwhnzcfkvdwjttxcreuuumtuygorrzl'
ClassName: 'wkcqwctpnuoahgjfyxqapudladbj' WindowName: 'rplejunifsqnijqblgbcqbq'
ClassName: 'lewvcqwpmasgpmthwnsdfbpffymdjqwwzembo' WindowName: 'nukynxgtptqgqbruvthqg'
ClassName: 'mihxzpwlimrkwwbmb' WindowName: 'ypggmensfmorqbqphirbhkklafduetlejaqybv'
ClassName: 'nwqftmomtjvvklmlicucgaztjabtfqzzrikrf' WindowName: 'iucdortguymrcpdvtq'
ClassName: 'mwoyideejltjxtjpqgjyrpulfwliiante' WindowName: 'potrzxnafuudltzowhjrszyqxwxhyzkjt'
ClassName: 'avjltwenprkeruvjrlcybvt' WindowName: 'elejwtdasqdkuoihvhmraszvsalczkviy'
ClassName: 'xgduscdmigtfiwhhklztwawmhyuqkepkwdjjtbm' WindowName: 'vuliitxffaowjodrnzmhernp'
ClassName: 'pgetcyrzeqjoxsy' WindowName: 'ftrekwjfqckiziylzbimjsfnxemefgpwyy'
ClassName: 'ykrurskolirypbfhkxbtapeoja' WindowName: 'rohuhblzfparmbvn'
ClassName: 'dlqbpfyosyrtqqarjeifqoc' WindowName: 'umrvigtiqcjccxunljonhdjhfwytbwhuxwlomb'
ClassName: 'vfvqxupgjjihkmisheuojkucyubvupmmesbe' WindowName: 'cdogskmrxwhczifqm'
ClassName: 'svwcwgguaadjnjtoytnggly' WindowName: 'qaiynpplbkwwtid'
ClassName: 'bwvkidivtbtlmryvekvthbccpbgbkwfxi' WindowName: 'ghtldgvvbuzlcfzzgdnfrjoyrukbsrmhxpfch'
ClassName: 'zkaisdobcooabxbqhlztwwohnxaurquialwena' WindowName: 'ptnuvliamwgbarbbdashpvkfp'
ClassName: 'ztpvewtrocoxkxzljvnkhrmiqqsbebkaisfilx' WindowName: 'kdefmfslsvdogxuzzfnkne'
ClassName: 'lmlvjvqzlhsadoqbj' WindowName: 'hvwliluelukpwvmm'
ClassName: 'bfizqwrzdjwmaovoanifwkywliik' WindowName: 'nqdurjbyhmkpjllzmiumjoy'
ClassName: 'zkqfowdtpirunottk' WindowName: 'rcdjrqwryymmvwpajiirc'
ClassName: 'sfdaqzzxzhjarhkwuatgfpitjmrrrsyfs' WindowName: 'etpbydpchucpdvz'
ClassName: 'imxslrntnhfsxgg' WindowName: 'pnptpqpglwdxwxbrygvhufdxvgsmgs'
ClassName: 'dfqxxnejwwbyncpstysh' WindowName: 'jdxkzjoiipjdxmdkaqjbgpgdn'
ClassName: 'vpvrpxawebacjfil' WindowName: 'dxqcztsgkwvphorpmapxkgkctevhpshc'
ClassName: 'xrjkqwcagdxvmvmfywkceeezvsntucohyakgj' WindowName: 'jaxzdflcoqipqicouasqj'
ClassName: 'ilhocrwdzedlaprqwrfaanra' WindowName: 'xlnvslazmtpdqeffilunnrqcxuqtstdlwrzhjp'
ClassName: 'ltyhacogjdmqzycijfnx' WindowName: 'dmepxrkfkfxbtiprmiksbinpwhwss'
ClassName: 'gttzuzzrpjhtrbekdpssammcnbrz' WindowName: 'hvflkfgaxivjqjkfl'
ClassName: 'atxmwyzqcsxozvbhrkepabjvocufjigkapvnoyb' WindowName: 'zqfapbqiusrbubajqvqleggskfekltbnerbyia'
ClassName: 'thfhvzkqbprhmpdmjucmdhyffxteekvmupnnr' WindowName: 'guokzdrwptjlodkohylwbabssnermopyya'
ClassName: 'wsaymrwwcfjkpcultgoukpujbdvmmh' WindowName: 'nwnmrewgphhizswyeeavftksetikjpjy'
ClassName: 'hoteyjgtoruxwtupbgmwabxuobkq' WindowName: 'vjqvtaiqjjxxiicxndvigzowyzdfbpopdkfv'
ClassName: 'lshhufmmyvsdufemvojzpgtmlppgzdxtyh' WindowName: 'tfafqerholgmjbyy'
ClassName: 'pnmusfajcvuiorijcgtfaovbjp' WindowName: 'xdedbjnwexqhvzuerpj'
ClassName: 'xmiaxnfjxmkgsrjytkufqyeflivfpacwlotln' WindowName: 'jxqdzgvtfuvrxyfguakfqfwtfghapywgdcmiuzt'
ClassName: 'hdugjdaxzcssfahamshkspunrissfcqmidnagt' WindowName: 'ostztglrozgycmthxvomrnxouyxusromg'
ClassName: 'kpkccmtdossrkqzsbcyvrbjqzjdeunoxc' WindowName: 'mvsnuqobdgjwocnwphvecvucrmyykgszvrswnh'
ClassName: 'imzfmsnkwmkhkkmcnpenwimqjooqldg' WindowName: 'sdwjgipistqnkrtwnfqtruavrnru'
ClassName: 'zdlaeasaxunneylwisojgjxgkzttjjrnbwrfxw' WindowName: 'bxzqszcpnvmsmelvxddiwendixzfshotxsvg'