Trojan.StartPage.59733

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nso2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nso2.tmp\System.dll
%TEMP%\nso2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nso2.tmp\System.dll
%TEMP%\nso2.tmp\Math.dll
%TEMP%\nso2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'hnnhxrqvllztqgzcmycvqbbxkrqvalfmtgfsle' WindowName: 'hehizgiygoklpkxedxzzuoimomaopy'
ClassName: 'rdokoempdsrrhdkipgvzkxflrhifvalztwj' WindowName: 'jzlzbhfnbwhnunyszsv'
ClassName: 'araypmmuukeffjkzedwrwqxbv' WindowName: 'ybhltdtdudzeunptezqowpgwly'
ClassName: 'hnerdaqfliflmvwogoasjs' WindowName: 'yuyycuelbsbhdmraflls'
ClassName: 'bqiqvzzdttkutvffnfzzjsmqvjgksjxeodvtbu' WindowName: 'fmrzdpcwppovwnrlvnsjhjzlcjphusae'
ClassName: 'loixzideyolbtkhtupuxbcqobdo' WindowName: 'jzxsyexlkdqgykmkva'
ClassName: 'rstbfyqcropvyatvwvmfsawuhwmfydzxiwm' WindowName: 'iwbpdsbedenfyduacgaauk'
ClassName: 'ylgdypnjqaiesiyxswiylgwzv' WindowName: 'omnbevawfglnlckkniczcyatadr'
ClassName: 'utajfwrvtzrjxmhe' WindowName: 'bmmechebjizsumdbwoaduppeoctket'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'lzkhucvddawhtlemeszcxvvcckww' WindowName: 'ofccmxzxnjnwaeulavlpqkfiyyjeieruvokahk'
ClassName: 'tcmexfoysrleopjxlmddnnldayraqehdwmk' WindowName: 'jqyvftxmyikqszlhrasktyytkvidjynfqblkq'
ClassName: 'uocnttnjluklruhejycmffqfyb' WindowName: 'tpdtddfkjrniadnhdwdxpqgajwenu'
ClassName: 'hltferciifmjdbvoxuxpglinehhlxtszhkuej' WindowName: 'lkygvnzwldkjraaluoc'
ClassName: 'jewmhhvnfoizoewryqnf' WindowName: 'upxfbxdpkzqwxnkylbnsdvdwcwcnvcogg'
ClassName: 'nukkpbfvllqcpyybbaparlkupmhboeir' WindowName: 'pibevgumvrhdjuehezkzcjrzaahgvbvneozdbsx'
ClassName: 'lryexuazfmfhvcopavmhhpwmviepj' WindowName: 'hvlpoasmmxtvlhuzrlfcysnck'
ClassName: 'ajfvlaspckjrrytypheqkcctkwwlcwrfsgzi' WindowName: 'gtlckldxqiopbdlwrpkflqrbyeoykdknhclre'
ClassName: 'ftajvjdxwgdyrggranisoac' WindowName: 'cosecofttllwqkjzmktzsf'
ClassName: 'iykmmwjuehlfcgyhaqeyxugbvhggfnefd' WindowName: 'pknaalvdsbpxewpiobmazsygfskoda'
ClassName: 'nzlfxgjbglhjaglay' WindowName: 'uvpmjeeqyqcyvbd'
ClassName: 'nyfamxdeqixmiqkvbblx' WindowName: 'cvaykcdgtzleiittzjakojlbaetgo'
ClassName: 'ggpfzolmrhxeouidaecvslwvmyqmjigzks' WindowName: 'puuaqqueaodtkmpanujjvpeff'
ClassName: 'uxfvacpoykpjtnkfadqkteekmj' WindowName: 'ftxvbgcsdqvcbcnjaljkuiznqsmwzuakrwb'
ClassName: 'glguklfhmmdkfwpjhu' WindowName: 'xomkzuozqvqnizizkoaixrow'
ClassName: 'adnyxqdnvcjfcyf' WindowName: 'diblrshtebsbteaogpwjdmuwqamalyc'
ClassName: 'ajbwxihfhbynekyrqdopmqqngbd' WindowName: 'ueucgnmcfgegbtvawurwvjtxmoldgahkn'
ClassName: 'etusbhriogwncznioqbohdtpcmjmpolnqch' WindowName: 'jxoeroojvmxfsgaxorwvnzgsmqqdp'
ClassName: 'crwlatelecmdfophpfzstllfblrjrfsgml' WindowName: 'omhwkbsilcvscrsqghjkdvrgahavjjquxs'
ClassName: 'jbwxbbsecxhxchvhdpoaeqi' WindowName: 'tpvumrbtlvnnqjrfcbqfijcaamwkbbyrgxyswpb'
ClassName: 'izvvcpbrzatmrunbxkxpibb' WindowName: 'cddbfcpcpvgjuxmwpvtpbrwnmiqxnhnfwz'
ClassName: 'ocdvvmyyhvczrasltmfrsihfutccdkzudzcwg' WindowName: 'rhtglfmcowwpqztw'
ClassName: 'rcspfxkdljgdundufhjfrnfyappontfqfpf' WindowName: 'navvjccioylrskpivodtsjygliv'
ClassName: 'ohjhmrinnpuksonewoh' WindowName: 'wvjdrjymuyowpleyunwehqcruzsge'
ClassName: 'tsrnancemkohdmiwojwhgtu' WindowName: 'lrdptayfbijcnzobicpjlmzamozbbuosqjlnhl'
ClassName: 'dichnudyhdvkzjmsyklrhygwnbgxhuzavcd' WindowName: 'fmbfkvejjtwtpmthbfbwms'
ClassName: 'cmoxdzhvhimxobjbtlzzqbyztigub' WindowName: 'fvpemypybumechi'
ClassName: 'luxraqzfgmcigndg' WindowName: 'iokpuaeutwxokrgjpvyugzxrfvqocrrfkfwv'
ClassName: 'fmkrzaaiewnzfgimtlheqbw' WindowName: 'ldupjucbqladthxrvmvbgzyvyqfcfuwjrcgz'
ClassName: 'bblkijypdqcbztwgnavftseinjcvnxgrny' WindowName: 'botwjwuwjeihknqggrmwfnnjsaaqhgcyyhyp'
ClassName: 'uokrdayzomqgrbfpeyync' WindowName: 'cxkqntnjoraznkcmgjqlurknoeqfsxifydt'
ClassName: 'ryhgcbtczmmcaispvcsslmrerhgg' WindowName: 'fzkunlvvygdqfvhu'
ClassName: 'hmimrvjfjhvvqcchzcmabwthvkb' WindowName: 'ckbnhozjqttysbckvzjxcpic'
ClassName: 'jctzxvxfgjgymfjfqzw' WindowName: 'mfwxecematedsvqnhcxmgpzjvwkogpov'
ClassName: 'mszxmwnkwajfwzrvncmorkojiuyhsmwcud' WindowName: 'xrrawhpbhtdalikljqgjbylcbdsbgbjzm'
ClassName: 'xofqxaopieugiokftghgzysror' WindowName: 'fmugregrblhhfkxpafanddwu'
ClassName: 'yegjupnpfjsmrgrpsmeueomwklgbnssentzb' WindowName: 'mkblbkfprahthroauxeuhjomyxdf'
ClassName: 'hyqfduabudcixcjzssfxwinjuqimrhvrdhfem' WindowName: 'qdawrmoqgaqxngvaaunhtrhbqm'
ClassName: 'baqamevekodxihjsazyqfaciprz' WindowName: 'iujvpjxdsjtfpsyvvgr'
ClassName: 'wolrtumvgfdwzssdcij' WindowName: 'zfoxhgvbvaoqzkkwkqnuufjrsyyvhliojktgpfc'
ClassName: 'gtwsbercsplofralnzllhvlxprwakycbidl' WindowName: 'eqiocrdmhuzmrnrq'
ClassName: 'duphytemunwwgincrlfqzaszdggkoe' WindowName: 'onpbeoowgodqmde'
ClassName: 'iwsdpxaweprnmujriakbhf' WindowName: 'ixrochxejjunabdbufzzxnqjqugs'