Trojan.StartPage.59364

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nso2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nso2.tmp\System.dll
%TEMP%\nso2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nso2.tmp\System.dll
%TEMP%\nso2.tmp\Math.dll
%TEMP%\nso2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ldojbqvuvqinfcqsdbbhlrddsb' WindowName: 'usrnxwyjkfacapfdkgqexzspclwnoqp'
ClassName: 'faubhliuifcsrkxhhhasqyyqjxosbjfbqzhnq' WindowName: 'uerqcdrqxzbkmncxlwgyodgqsmdwqkfacaf'
ClassName: 'plhvuwfexyvilddwjofapcpagswz' WindowName: 'hdeuiqigxqckerwzznbvkhpnszxbfmwb'
ClassName: 'szomzcmgrynuoxplremeiacukihnp' WindowName: 'dvoyxmfrbrixdssjpiuajugkekvqzhocmrjkacg'
ClassName: 'darcvagkzbrjekvjtfrnmfsvugqoyuj' WindowName: 'cdndesykpawixzxaraxio'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'nsxifoldfaobmvvctbuhcuvlvrqyvhxy' WindowName: 'kaqzflkuplkwgjkca'
ClassName: 'lvixcpbpqzmivosxjmlg' WindowName: 'zcdogygdhjwanphogmsfmqaojwjmsluw'
ClassName: 'bpuuojvovgcwbawdsqjvdxwevdshvs' WindowName: 'wcgnmkcrjrqoadlkwhxsusimcoom'
ClassName: 'zfanazhhyavogbsvdhdkdbpmrfzudkeczje' WindowName: 'utgyomhlsmdkfjaffxehbhiuebqfnqvyyrnnrp'
ClassName: 'wtwxgqndvcabyxfznaierusbabbxcjxf' WindowName: 'nfcvgxokhsapcuv'
ClassName: 'vartlpktpeymcxciopwrvr' WindowName: 'oguvfhaygroaawpqh'
ClassName: 'ydlshzjlrsyepzkxvmvw' WindowName: 'affayxtziplwujnndidytm'
ClassName: 'cwoingtcvdsqnjkhjqdpgvoenkhqlim' WindowName: 'gmirwnemzyxwfrlbxzvrhzjlisdcdunsio'
ClassName: 'vwoqdgraxrpawiuemecqxyxdsrxbpdka' WindowName: 'wpsnihiaexanmqbamnsxmfhdqfgh'
ClassName: 'izcltcrmclamibdqkyrskwvyl' WindowName: 'vmobpjeavgewzeqgvwokiqgif'
ClassName: 'gmbrprdcfpjdrffjalhyizrhiyqvaywdpcj' WindowName: 'xmunizayzsrodgdc'
ClassName: 'yrhohezgrescwnmionyycfrkvgojfrx' WindowName: 'rrkmbasqvbdyhystgyiux'
ClassName: 'reibvswvfqaqytiyobaauezjya' WindowName: 'fxbztnjzjofgvyhefsovgzdghaxjcuau'
ClassName: 'qsbggggervkujokxtdcteahedntasffhql' WindowName: 'vheuybkzgznvxluvcswohfkpvguz'
ClassName: 'yphimhujlqymbvzmon' WindowName: 'rvebtnzyvtxxmkovwedaqirm'
ClassName: 'bkfrwppiyxztgqiidgrdlmfwtpbikn' WindowName: 'hawfdcqlilouhboj'
ClassName: 'digtyxzuirgpkiktakrgafhsuxlckixfrzibehl' WindowName: 'isxhzsipgwurfwympuipuwrcceh'
ClassName: 'qiwkpdywerromtls' WindowName: 'kkekyxfefypyjdsdmjvfhbiekhctdzcgosqmork'
ClassName: 'hxgzivipynpdeebfrab' WindowName: 'zzhjsxmnknaebkyzuf'
ClassName: 'fpupcgrgijzdgqnkgrikxcajnezc' WindowName: 'hveiwxezcbqfmgqlqvovl'
ClassName: 'jjlacdeirglstkumuwceunzrijlfnkq' WindowName: 'xqlkcnjzddrbrhoprjpnoovltz'
ClassName: 'odnygbduwmcigdudbdrshlcczouaexgx' WindowName: 'jqtljhofsntynxvaxglslngkzingtrdnfdnch'
ClassName: 'tcleqikwtrphtacksnehrgvabmmkiyo' WindowName: 'gtxslgmeiqdpomd'
ClassName: 'mtyizgaqfassntgbezrxfrrzirsoxu' WindowName: 'tcijdruwerphbitxyaxdrtygqnag'
ClassName: 'ouhxmhvljwcpfyinszbdrdoqucgkzxdr' WindowName: 'myenmrmxfbsyyxgxyezpcitwuubjksjprxskvt'
ClassName: 'jqlrdippnfeanpcaculsxsneqrrewyjnilih' WindowName: 'gfojxvmnkopkzzwpbuvzietylnwcxyrfdlmwcdj'
ClassName: 'fmrlylfpbdvibwczhqsuothqkjhlrbcqas' WindowName: 'ynmldiruhovbelqanitkcftmqltpamyeqhtmsyg'
ClassName: 'nfrgzoajktyohrhwjiw' WindowName: 'qobmhzokstcbtoxfwirm'
ClassName: 'ueqsxmwbnapfdmywksggtlpvqv' WindowName: 'rpgfnaafwzyjeqfbnau'
ClassName: 'rnvnsrxxccyltnmdbcuysne' WindowName: 'gmnehiezybfkigosgbxiqjre'
ClassName: 'jdugnsgvswkchtfqttgzkwezwmm' WindowName: 'wbwmxaxexcenapeitkualdomemnklvmvghh'
ClassName: 'dutsedkkwmpbrngocdxf' WindowName: 'wedecdoademjbzeecadvlwqefyztvmsh'
ClassName: 'zjpaaprbptcupkztzjqpuxa' WindowName: 'tvvexawasapoeczvowvzoerdzeh'
ClassName: 'oyfufutbhnwpodxahmqbbshh' WindowName: 'lcqhsnwbaxfaasybbvreloizxioxccsstfry'
ClassName: 'osutqdyoiugkwlrgi' WindowName: 'yiyicbyvwokffyxnlfhvomdpjmhfb'
ClassName: 'nviugwjrpwyynjzid' WindowName: 'utjeovvngkuueiatgjxpodkhohrnzbkmz'
ClassName: 'auginflfggsjkcsqzmvpcdgenlkkcykyykjms' WindowName: 'chmwqmigrygaerjfrfiykumxlfwxvqahkfa'
ClassName: 'mpnsonqnbixpzbikqggezliaewdatudk' WindowName: 'avrecuegtefpgwydzdrcexcgutijrsdvz'
ClassName: 'pvjcvolljwaafhrjhvia' WindowName: 'rquazubxmiacbjdlojkznkbidtooml'
ClassName: 'dgxukpfbzabccnckbryhftvyjhfedktaawh' WindowName: 'rsvwnoigbmnfjrmfreqgwbs'
ClassName: 'qebkzquhgiqnyczar' WindowName: 'cwzuhlysovlxpixjznlbopa'
ClassName: 'fscnbfqenvdwcyibitkbkwvsjham' WindowName: 'snkqstfdqyarysodrljrqomsprjeioyfjt'
ClassName: 'jddnfhtrhnxwxoyyqv' WindowName: 'tbiptzupsxvfxjghbrglohm'
ClassName: 'yojwaxrqybuklzvxzmm' WindowName: 'szgbvfxkzlqikquewdbnbepwjpibuqxwahjq'