Trojan.StartPage.59331

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nso2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nso2.tmp\System.dll
%TEMP%\nso2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nso2.tmp\System.dll
%TEMP%\nso2.tmp\Math.dll
%TEMP%\nso2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'qvqtioozpfbieycxfhbzi' WindowName: 'krjrnpeynjhgudzlucqhxwo'
ClassName: 'vkrgkdctoxpjpaqaaamxswiwtkajalhj' WindowName: 'vutivhvvcfbkyhdsrmtlcklfryjztipvvwbadtb'
ClassName: 'jvhgzaithksruuocklcabtnmqb' WindowName: 'xbbpumuyhccxadugdhlgsmgvx'
ClassName: 'xcwidyrwgbochmgnpgorvk' WindowName: 'ylqwbpxpdhabutbgwqca'
ClassName: 'wfeezbfwethuckqeejhximdwcinzmgonir' WindowName: 'ovgseavtjwygycdxyoemboubqvo'
ClassName: 'iaqybibfmubdmxzyvumuzxljbgtgtlc' WindowName: 'eyivizqnrzijvzsonptwelje'
ClassName: 'nhboasbdytfroqjqjckeqfnioszoloqe' WindowName: 'qfivijpctizdjzaeuv'
ClassName: 'gxxalftdomzfymfhegqmruwl' WindowName: 'iccgujpayozwomyhqdcsdllosgloxt'
ClassName: 'auxukhvnmkelmalslegxsi' WindowName: 'cdmlpwkoainywrpodogsdr'
ClassName: 'esdlchgmcforsdtimjvgyzfunmlgzn' WindowName: 'jwzvozetmlghjneelwlxwl'
ClassName: 'hhmzwovevooeolvhijhwdagdleljexibf' WindowName: 'wfzcckkeihiwfafxmkexep'
ClassName: 'cjkyvnccatvhmkrcceizrjar' WindowName: 'mkooawfcleaqhcubrfpdiut'
ClassName: 'qxxzrfjgmecleuhkvcucnbcfzdnbxzwpaam' WindowName: 'bqnphdwawqcuktxdubvkqviksjubnxnviaxobq'
ClassName: 'nebutwicqukocmptmlk' WindowName: 'ukhjwldtwhahthgzgwxtdrjhagxgwqgdimefob'
ClassName: 'cwtozhenmnjnfnljyhtzvquptzoxpvsdk' WindowName: 'ltdqvqasrvkpvnuhqumuydoczwzmnbchz'
ClassName: 'naihxymzfnbagrzdeyuymkzugzazhtppgswvlf' WindowName: 'vinbbvpvvycwwdaknrnvjdqyzxlfmg'
ClassName: 'tewavxywpszxblityuidtjbqkpserckznitsohb' WindowName: 'wfswusycdenzzorwgopltusqujggiaviytli'
ClassName: 'pdvbjypehqscqjqqcvyewnvwzjadjiew' WindowName: 'rmcyandqhydjunsdsscagebxfvfplzuzkte'
ClassName: 'fnhvnfpgdxttugva' WindowName: 'zykhpvnwzbnnmdvbucdzbkbmbdsktkyok'
ClassName: 'ysmsjovosaugpicorpvlryobwovxiwafqoan' WindowName: 'llrhgsprqxovsfdpsmsvuggb'
ClassName: 'omxdflmyfmlvjtpmayg' WindowName: 'cpojefhwdzmvhkoxqhqcdi'
ClassName: 'zywvdjiwmbtnixexejooscojqpbgzmvbmqyvyh' WindowName: 'ijonnvtthzqxcqupkcxzjhqtjwxm'
ClassName: 'uaxkrekmonediamqmtdczxesotepcjohdsa' WindowName: 'bjpysoarmhlojpxpsdkfwsizgvfcxpsajfer'
ClassName: 'zednlaqseghgzbmygbi' WindowName: 'gaxrophadmoqfvyocizr'
ClassName: 'ukjtbyxlyebsxpawmpvnufefalubtpacwxhbn' WindowName: 'dzijddcuvbgujqclydmf'
ClassName: 'nzyfyyncegqzerywdvnmdcoy' WindowName: 'skerydkgluteknwcsng'
ClassName: 'vkoylxoczfanpckodxpxaxmhqxeeqewqabeqixo' WindowName: 'gsmqtefdowazgicuoytormojpqjhkhltx'
ClassName: 'qomypuwxotvyvrjlltyfn' WindowName: 'jzvpyvvnismmiiu'
ClassName: 'spxiascmudusqomkjtaagjpyhdljzmuv' WindowName: 'ocggsbbtmczsgtolidfjbkwixldrkkm'
ClassName: 'udialhxrisbfzlvizavjwpkjewqbetkelvgced' WindowName: 'pzjlsytyrwwpiqhmq'
ClassName: 'xmfczhdgdhoqvvklavhrgdzkkaqefcpqbrh' WindowName: 'cnclpvoglrwgfrggnbuvzck'
ClassName: 'whoqzfwatbuufymrllskchqcqyhynvs' WindowName: 'urcuvhxdgjvjlhtctnfetbdcscqisiido'
ClassName: 'xlzpmdtycxtlxhgptzeqdjmtax' WindowName: 'hxzhiekwudlfcnteofwhzoc'
ClassName: 'aldelfwemkqacrnsjimexpmqpmdvajajujtwhmy' WindowName: 'mbqnjnnplxjaxggfgaqgevkxkdd'
ClassName: 'xhvmvfhuwtfiecmzophqcysguxznytapqvqvhho' WindowName: 'lewrdilfevelrxdppuporlplreplepsvzax'
ClassName: 'zcrqccprwgcuifuvfihmequprkysftitwpqu' WindowName: 'cyjckpmqoopyajjfhdkfh'
ClassName: 'nogcnjxzkxrjjpekklycctaatpjyejmi' WindowName: 'wheecvvicyxgivmbvprjkfd'
ClassName: 'yemlvpbdiyxvtrwjtrvzrevnrkfwknv' WindowName: 'evzcoshrhgmtmhqkcdeouvegtapavaeqccnmqg'
ClassName: 'qdaagnopudtsjrvuxuhopjgigjeheslxzbbqxp' WindowName: 'tgbknqcbqeohgxq'
ClassName: 'nxqgcjxzbnrntryiezxiduvvtmntrvqov' WindowName: 'wukhrvmbmdtcdnnzcwrhafbybqgeqzy'
ClassName: 'zegtbwyqmyywjlmu' WindowName: 'unpmfapbympioktyyylodeb'
ClassName: 'bkbkpsqneudqstfnoxyfzm' WindowName: 'rjxdafjeiwudvebckem'
ClassName: 'ftmzeenaufcnaczvsofqayzgycvlstyuikdazc' WindowName: 'frmyeeqmpvdzxxcoaejsguddsopl'
ClassName: 'jqdgobjvkglqwvnbruyonaeczvljvuuuiwufigd' WindowName: 'beasacslfvwyrdquz'
ClassName: 'lvzzhmanctuwclevakhehzasdnzv' WindowName: 'actwhxjjyewpdudxfclgjiiyyowchqvjywebs'
ClassName: 'uclylmuppsgygmqpd' WindowName: 'mhlazwtmwcbrowzyfwwqlvhndnogdcw'
ClassName: 'iecetcwebpuhcvwzsxxprqpvomotbhqsbnpnrna' WindowName: 'rsmmoytfhxzfqtazqfisgodinoouzkmlsunvt'
ClassName: 'kabxsxmxitjcunizrptusdkvuuhipnabjqihtp' WindowName: 'ipdejijcokmxitwltbbigtuxrocucrafkbyeus'
ClassName: 'hpdvubkehjpjackopkyarz' WindowName: 'zzzcfqvzrczwdxlyfsqkscsxe'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'ldlizixrwdqpwflihflddbsq' WindowName: 'czozzjvfcccjwsu'
ClassName: 'uakitwjgvyegzmmi' WindowName: 'cscwhqwhepmdhcswfwvuizcuovnj'
ClassName: 'civezdemvmxonewxmjskmbtfszckdjf' WindowName: 'vasgtoxwbxgtzijhzhnwmnwao'
ClassName: 'zxlnmpcgydbvldjkcaexcneunnhed' WindowName: 'wrsobbvrabuloeckx'
ClassName: 'gjxlprcjdfdfdozv' WindowName: 'sxmpuvrueayshgqdp'
ClassName: 'gidcnunpjdgxkrcjemhiigyvobacoxd' WindowName: 'oawhjylxxfzhpgeyzlg'
ClassName: 'tcmfcmfrkzuzqljwnekmjmdzemfirzs' WindowName: 'xqabugdwtcouwsswhhkzpwydisxdfvtzhjnqliq'
ClassName: 'publvyfvqsfnfogxazrnyrlloo' WindowName: 'pgbnbougrpkkcyemynwxnpwtdmklq'
ClassName: 'nxkuzmjededuhzrxjswnuxq' WindowName: 'emdtldggsyqpwtmcycjzbllr'