Trojan.StartPage.58506

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nso2.tmp\InetLoad.dll
%TEMP%\nso2.tmp\Math.dll
%TEMP%\nso2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nso2.tmp\Math.dll
%TEMP%\nso2.tmp\System.dll
%TEMP%\nso2.tmp\InetLoad.dll
<SYSTEM32>\wbem\Performance\WmiApRpl.ini
<SYSTEM32>\PerfStringBackup.TMP

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ysyksylvdnxwqyvinvspbkcnmjwbnpu' WindowName: 'egkcxzslknmibyepwiiljkkaloqvdpfyz'
ClassName: 'feuphycglbhxschhqfrsulyly' WindowName: 'joilxlzlrajuehddnfvzragjotookuahewxiif'
ClassName: 'tavfqurwiklxdmtugyfbtsitjhyo' WindowName: 'myzjdtioucgbqzppbvajrdbpolhloleccmwfkno'
ClassName: 'hdydagptmloidldagvoexrk' WindowName: 'pdssubnseytzmtijcotczjxkzvtmr'
ClassName: 'vvoocrbmvobvljnrpzzhpone' WindowName: 'cyvowbawobefcyijhqf'
ClassName: 'bxhbtmrdgclimqnupmno' WindowName: 'odyyztrpjlnmpriovjbqikuvzbkoul'
ClassName: 'ksmrbqkosoclmpnswhatc' WindowName: 'itaseccfzsgkistgp'
ClassName: 'xxlnhdzapeyesnuvrnofvqmmltgxjljqba' WindowName: 'yrayhsocmaiufwamvfrvtqjrusqqnzlfkwpm'
ClassName: 'vnkbzpfgqafvsxbgsbqrfem' WindowName: 'wrfjdcaxlvxbxbpirnglbfmyuhbhzxnaofvjl'
ClassName: 'uifslpgvuyzjqsjhpaenysamertcuirs' WindowName: 'uvxtiukwawyukwvwegztlahlreeik'
ClassName: 'zlzqbzqmyhmolcnhggbdkqwlqvnlwgyao' WindowName: 'reozmgprohggudcorzjymyggzkqghccy'
ClassName: 'lfpsitlcygjqgzhxah' WindowName: 'bfraayptmsavgzsyjkkohstpxmhtl'
ClassName: 'oonvxpleuqjxdsqlit' WindowName: 'jevuxrsyajlwsupezsajpiznkfvxaz'
ClassName: 'mvnbylueadjuzairnolirorazlaihzqsxtbqom' WindowName: 'nycafmvesmaewgdwsknqwlsvfwbum'
ClassName: 'mafgsfsqtyhebizfrladuvkoyod' WindowName: 'ftyecnbyewpqvljsilbkgv'
ClassName: 'plfqozxnxeekliugyaxkslz' WindowName: 'isbgrdtlcsmkmuslkvjshen'
ClassName: 'hkicarejnfjnfawvobhkqreayiq' WindowName: 'cqwvyxjobkgjnypxhwwzbljeipas'
ClassName: 'hfhcpmkewdmpfbzkbhcjyrxglppsbua' WindowName: 'qdyhmsqtejyxjboygmmsxdxfywoznjw'
ClassName: 'cgirqthfbahywlgwfsycpuhcdbslrxjhyfl' WindowName: 'nxdnzrsfiuovxkrjhmqglepvueetvsvbvc'
ClassName: 'gkgftnnebfnxrzizeiykedufzxuuqtv' WindowName: 'zbvmctjssxrodplifqhmuwasgg'
ClassName: 'ehmjwzozxbgxbjjodbexgu' WindowName: 'zhizbrdjsjmytqwaww'
ClassName: 'ogsgzcvuifxukobrilxctyegechcozxvkc' WindowName: 'tgowqwudgetjacixuauwrw'
ClassName: 'bjutylcdevtxjwxilvvpwdmdrcehbfln' WindowName: 'zkfvigxlcchbzwlymlktyngbjlhqjcsjpetsr'
ClassName: 'gelrkvqatmekdokxynmeeknfiphqqrrrwjukeus' WindowName: 'zptakzrdmctnbdjlocggobfabrdbxxaiqzyoxc'
ClassName: 'vryhltcrmetshfnhhrjsehdouwiwajzpctiin' WindowName: 'avkllguainjoriyatksaiyd'
ClassName: 'zzbvjdkahynlrlnegjqcqwux' WindowName: 'tsdjyeafqhqfqadkgtqa'
ClassName: 'garvybczhwzkthrupdqyhwqsoubjqzu' WindowName: 'gpcjjshximhigzjedoorvllxkrycvsgoxkyp'
ClassName: 'wdcgizhhgoqcbzqojvmpmj' WindowName: 'gnbsxzwdjxumzjyaayz'
ClassName: 'zsglsyotelbbalwhla' WindowName: 'hqalvcpmwzisfvlqbgmfhv'
ClassName: 'hqjhtbljhtuspgnvtmastt' WindowName: 'ncbpochagoipvkontcwtznslouwgq'
ClassName: 'nhirqxiagwoocry' WindowName: 'qfrtgduajqismovscntohjjbyurtrolhihao'
ClassName: 'zrunojyjkutdntuprwboxbtgkqqsagfgpiacr' WindowName: 'ftzxyosghlmyefrtcjknmwjespdoiiuvd'
ClassName: 'waaauvazwmcgbrajzvxvxlwpnjofhqfdqkrg' WindowName: 'mfylicojcqoesezcwnd'
ClassName: 'vgfgtnzcoeaycsvsovpq' WindowName: 'xxpxuhwcdpvkcsnqdpfzvprbley'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'uoskztavxtacjgsjlyccx' WindowName: 'irsziyfmhoagvgptlkpmzcsnu'
ClassName: 'fquijuiazlsspdmrtm' WindowName: 'hfgntbiwoazthbirn'
ClassName: 'ubfycasufyzkavha' WindowName: 'nihpsdtbrsjzkztolvmfdiiiyfg'
ClassName: 'nqmlbjkptewigzg' WindowName: 'cjtwmmgqdblwgqstnunjdhrx'
ClassName: 'mkqwqszwdkphtnttkpvwqknpbzxuzrlm' WindowName: 'nzqlmogsdehnwsalafczdyeg'
ClassName: 'fgiiemciehcknbjdl' WindowName: 'rapuuwrqbfnlpgd'