Trojan.StartPage.60793

Техническая информация

Вредоносные функции:

Ищет следующие окна с целью

обхода различных антивирусов:

ClassName: 'qezilmavpspztyrthgohqcscttf' WindowName: 'lsdbkpizfbtpcsunlu'

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nso2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nso2.tmp\System.dll
%TEMP%\nso2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nso2.tmp\System.dll
%TEMP%\nso2.tmp\Math.dll
%TEMP%\nso2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'kwmofdxiagrdepoehhlscj' WindowName: 'prvahooiuuzceixrmodkpoiy'
ClassName: 'bfuupozhscldavhmpfamhlggjcxdkvoozt' WindowName: 'xzjjjtoeqhcnhrbqeqwigsnelkuy'
ClassName: 'tjqbtoashqkcmjhfycnfifkfdkii' WindowName: 'ziyvyslfaewaidoiglklmtfq'
ClassName: 'gtbrsjhpoooauarpxqcjscbmtfkatzjjhz' WindowName: 'dwmitgfjibiyjsttdcpxvuyhlzwjgpawosjcfcu'
ClassName: 'iznsxxhfzpvanhdolcezunmdip' WindowName: 'nubwfnoqjqzsuthgdlgccpntzfdqr'
ClassName: 'vbihvzkhdzkeenmbtubzdmhuffmoehr' WindowName: 'cgpdulllkbkbpyiyxcydotiews'
ClassName: 'ugeltwrizabzszkzvlo' WindowName: 'mjomfdwnfsryaxttcqdobbqsuiqhcpyvyuvu'
ClassName: 'fhefechithvdcyagkaqgstiev' WindowName: 'nxiuvmctwufziqzuxihyazxypxjcmz'
ClassName: 'wmwrqtnvfvzhwniwypkmuwruc' WindowName: 'lddnnrlouzmqicgajztjabbl'
ClassName: 'vovuqtfnwayxirlxdsxuuideivrhmqi' WindowName: 'rbkgwikjmdwauejbiokuwbhqmgxihefanj'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'kpppxgwauwirqxnholgolpieh' WindowName: 'hjxbsmvbaqtfxwaornc'
ClassName: 'llnsydyltpkrsgrfaho' WindowName: 'xsactgtdnxpamyzvkyi'
ClassName: 'uyrjaryhkycdzuunlglkereetnfgrhoj' WindowName: 'zhpemvdmytoekfozxfmnqvngj'
ClassName: 'khrgtercvjbjvboa' WindowName: 'ztlgsxwymgmxtpo'
ClassName: 'fhrtvdzendwkpdtsgzlpowbdw' WindowName: 'wbltxqyuwojjvbiv'
ClassName: 'wvtgbwaowzsytwtstuwjehzv' WindowName: 'veexoqiamhtrkahfpknmkdmjmhf'
ClassName: 'npzcwungxzhqqlpmtargxolemcbfngafhg' WindowName: 'bvsccpxgdpftpxjxe'
ClassName: 'vhwyvdsninhndncjuzv' WindowName: 'boobjbxlqqtclowheffjsyrojd'
ClassName: 'oznqfukhipshanecsvabtadwlozrsewdq' WindowName: 'lxtfwrhzqrctivwfiysovorumxkzwbt'
ClassName: 'fimlybjiujruuduwuqrfbufbgfrmdpdmxdbckun' WindowName: 'ebefcmurntcwazxjprmpltpqaxuaagsl'
ClassName: 'hvnnjjemxrnkzmnvwaatwsx' WindowName: 'hzyvcxwjfhuynrcfqfpir'
ClassName: 'abfoulqjlnjydnvydpahlkrgpkfeartpllaeb' WindowName: 'odnpczrqnuiufdjnudeocresktvmcxlo'
ClassName: 'ybkdrfwyoezzjbrttwtiqqtdzwsjyekfshggpu' WindowName: 'ezypqzrijuwnslvpotiwlldbsvvkfrwvxwuo'
ClassName: 'ghapumfcttvpjxgagdrqjlwaf' WindowName: 'fywetbrhnmdrywnmilywuhxmu'
ClassName: 'efcleadrbresmdophtmikdibghlhaj' WindowName: 'yabfbxwvfqqyaztdgmnrsezhqyfggqwassj'
ClassName: 'iljeazuiqqkkgoz' WindowName: 'elgxxrngkcgftlrc'
ClassName: 'fnlsrgejxmhjipj' WindowName: 'tjtdbkfkbenmstwicbrfygupkcgdfxwhb'
ClassName: 'xlplnxnykncjsoutbmbsaw' WindowName: 'hhoqbfvkphtqoffcxm'
ClassName: 'cnjjypbzcfmysnbrhzwcndescrn' WindowName: 'moauggqjsgocmjkupzkvckkwcxsfgh'
ClassName: 'mtchexhpuiqpanrgsbbyiczddlt' WindowName: 'gogrmtzbtabiolxynhecqiaybcasnnju'
ClassName: 'dkfyibgdxtledniigps' WindowName: 'nasukflsegsmiqoxtcqftwifdyhkc'
ClassName: 'ktmsbrgaocuxesgbsojldwxjbyftbz' WindowName: 'fhmwwakkxiadpzbtiodjquuegjkwbqeyzumv'
ClassName: 'fnnwzyorphabihdroie' WindowName: 'dviuuflobgjnsazukshxeogilozcufuk'
ClassName: 'damoxxuaremojyvyilgdmhxbfgrhqtbcsetxxov' WindowName: 'nekfibconxyfrajklylgolyyifsmyaa'
ClassName: 'zjvnwvappffmriepmdgujgcxulbvknlcbzald' WindowName: 'iwauvelsqcuyufitpsyvullszlvpusdzympycs'
ClassName: 'hpcrwdaffixiecd' WindowName: 'aquehhkbficaifxggqkcgeccebzwyski'
ClassName: 'umpainhwgclyfcz' WindowName: 'mvyflpuhyxfoggs'
ClassName: 'bjhunbruzotjkqlnvrzrkbzu' WindowName: 'lgzcnlvusfhyjfvlmb'
ClassName: 'tkddoxlbpmmlmpgwsovouqzvjs' WindowName: 'chsvzhavvzpwtmpvkds'
ClassName: 'ttwvleiadkfxekdzpjterr' WindowName: 'ppcsrefspbxmfxomnal'
ClassName: 'siixzgdhhqkgzxkhkldvndcnxl' WindowName: 'gswnerrjqtgnouzshpfslvwzaxsltcsuqn'
ClassName: 'dshjwrpbbxhhxudhsgxosfwzezonvqqsmsgrwx' WindowName: 'donymsucibrerhmtsxybgoq'
ClassName: 'qfgriqglstdujdavqzjlmdnds' WindowName: 'quvlanqfafzxrxeqmcxafkibrfmyuvnh'
ClassName: 'xfujagzilrpcnnyaboxdagybzkpwqutyerctx' WindowName: 'xujaohuuacnlnbizdzlxrtn'
ClassName: 'sjhheahkzearihijlgp' WindowName: 'dxlyxamyaqxdafnytniskoggkslyzdxq'
ClassName: 'wasmshsfdxtykcrfvtzbfysrpwsdr' WindowName: 'zeecxvodkrqbqugkgclvtbjofggdcqqqhrih'
ClassName: 'mjznwskcygxlapfeflqewfjsfv' WindowName: 'ejrluzaqrwzeecayxllwjstkfrhvjqvwewih'
ClassName: 'zjppotbbohnldyerpfiyceqyrwemg' WindowName: 'swddthjedvjeuncpmnclilais'
ClassName: 'yndikadtffxaqwqnnksfugudo' WindowName: 'usrmewnqqdobsscsnii'
ClassName: 'mbvdtsyhcpyyfwrootfhfhxgktfnaabdf' WindowName: 'nfwjrmgylfjfustjewtrheisdcloruamryc'
ClassName: 'rqzwhxonxyoelykcqfyxb' WindowName: 'fdbnxitiozfitarbfuadvjklcrfxrfmeeepql'
ClassName: 'dluhonuiwgztvcweyiostxlnsmkq' WindowName: 'smcrqycdibsrcttifbyt'
ClassName: 'vltgbllwwznvedxuiiwnsdmsrb' WindowName: 'lobbzxgpdltgdsnuxzjjfn'
ClassName: 'tvezsmxfudwsdtxcxo' WindowName: 'bdlyoatehlblcmowzjamxtfeljyv'
ClassName: 'oshtplkghpmkjrshncmazsqrzjcuqkgpsy' WindowName: 'jvbmrcnlzxdgfjrsphilvrdnkv'
ClassName: 'ccytistjrjvkbgnwmevkyazusdhhkku' WindowName: 'lurlxtcxhsohlxzjhhbwxebplcjfgvtt'
ClassName: 'efhhfxbpmmonhjoysfog' WindowName: 'wdudjzblfkerxirupzwioryxhryedvxozivydcs'
ClassName: 'kyiuqxhbiyypmnmfrhzyqsmqfwmzn' WindowName: 'ybqkcjjywqvzyifhfgkpquqslw'
ClassName: 'vezkkjyftixlwcdwe' WindowName: 'abthmzvwmvcmtcmavdcieqd'
ClassName: 'sioszbyodyrykuqgxusqiizmrbv' WindowName: 'cirlhtjhvrvytzrdazzumrzft'
ClassName: 'hqccnvlteamuzhc' WindowName: 'mdalocaanlxefonljbbetqcpmvaznkvmiehetjl'