Trojan.StartPage.59365

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nse2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nse2.tmp\System.dll
%TEMP%\nse2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nse2.tmp\System.dll
%TEMP%\nse2.tmp\Math.dll
%TEMP%\nse2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'haynvjbujqdewsgnqpcpjvuqtzdfc' WindowName: 'oyfzicqxqutlibjlm'
ClassName: 'vbjigmpihlvypdclqlobmswics' WindowName: 'iweaynzrrupfyuzywcb'
ClassName: 'lhxzkhenszkebahekjifoxoprducrmepgbr' WindowName: 'ntopgmtjpyyorwudgai'
ClassName: 'djknhunctikmhfoscijjuyfrcopdvzkgls' WindowName: 'memjncctozbgkzxcwwtunrsrvwpbchkie'
ClassName: 'eqflrbjrsbikchakl' WindowName: 'ludmmqdbggrbwcuhzdybqzixuuetrvaukbhrqc'
ClassName: 'ipqivsqhkczoljcwn' WindowName: 'ansnqqefypvgidamlqltrhmwbdc'
ClassName: 'pbxraanjyeufwylhzehb' WindowName: 'xnlzazahuixhnms'
ClassName: 'iimwbfvoalbjfnybgvaklhbjpnjzbvsstwqpg' WindowName: 'rxftyxfezvhqgotivfwomqmeowm'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'mnyknwhnjecmzbaxltekvkgskpwjtxqgutql' WindowName: 'uzhcnpwzoesinmzlwszguoide'
ClassName: 'dgtdbxhjjfkmawmfkqhqjjifcy' WindowName: 'nclwtecqepsmubfgnvythiakmsznp'
ClassName: 'ahnutatitswffymqkfulgqrbjwiuyabwr' WindowName: 'eayztxyugbtkwvlagxrip'
ClassName: 'xbljipgevkarhtxluweeltinsumohnqdrvg' WindowName: 'lpcjdscbxlfzjwfslinbigkwddk'
ClassName: 'ogicqkceoazwvqqizlooiplu' WindowName: 'qjnnsewhqohflauapwmgkwmu'
ClassName: 'drjvvcoeqwypmipkzasozdywvndibfyq' WindowName: 'jwkvtdjyjfubofgrtttxcxhxczlhgsduj'
ClassName: 'tmncqbolawhdtvovnqtwnhbtijd' WindowName: 'xjseacrhslauvcsxwrzbolomxxvyns'
ClassName: 'qofusfdtlheajgjekkgilxpfdrhuz' WindowName: 'nfrgkklicyyosixivpkodcurpdkjmkl'
ClassName: 'kcynmmdedkabtgxyzvedgpngfadycdcjjjca' WindowName: 'ohpplduvdcrxhgjmkovkpjfurviageigvpsft'
ClassName: 'djxvmbgbjujjfgoqyzpuzavqyti' WindowName: 'mzuraclrfvotafdoyatlfmgalyvsq'
ClassName: 'pfcanmzcqfmjnlmulsmmaetw' WindowName: 'oywruglhosbuidvwkwcku'
ClassName: 'jwzedzjsmfmfbrgkhg' WindowName: 'gjxzykmltyvvjkxakwcndltjpao'
ClassName: 'lbhxjgbtrcdmstmbv' WindowName: 'wjrtfasopxqlbpocw'
ClassName: 'zuaxudrvsltrboqnaqotpwegavsiivambhhkzi' WindowName: 'llunbhhwpxskgpfcqkfgtvqjkst'
ClassName: 'juhgknrktmtwmywzvprhctndxe' WindowName: 'djbopgmlkepvlqfflcielwekoiybzgzatyf'
ClassName: 'kaepyxaalpitkfftwnnmpumdhjnb' WindowName: 'azygfhqfgemwbcwznknkemoeptdjeybjdlfyg'
ClassName: 'eucplvzslwympky' WindowName: 'zxibkkembftitgffy'
ClassName: 'vhvzogoifsqfbnfkejq' WindowName: 'btijvonkxgbnzpac'
ClassName: 'xrocisfkszhvryafbrtwrxrmpvxcmveglcskrp' WindowName: 'zxpamspfjjkcllzdywrfvkptcmhwdof'
ClassName: 'bnefyctbxshmkopwfnsqfjlcgquham' WindowName: 'zrarhrzmmysnivdurxeqdoqgf'
ClassName: 'vldanlegwzpcoqdaaygrf' WindowName: 'mdlnlmxpermwjquin'
ClassName: 'cthmrxhhnynoebxxbirrnsj' WindowName: 'yimhvdysvovyqjupnvtzrgsxhgqengo'
ClassName: 'mtyzcvelxbzszrpbzkwqsbmqokirhtqximdcjzc' WindowName: 'zoggkfvuwjywyzkegxzitotpbfwwiltbmnfieqk'
ClassName: 'aqezikqwwzooesuzlitlmsgzurujrotgebpvhk' WindowName: 'iktycdswxsddrgkrivncvivhufwhsllhpjztqu'
ClassName: 'amkjyugfuysggllyzjaa' WindowName: 'rdaswphqtvpoddwkuhzdbmmekdqp'
ClassName: 'mzbgtwdsosapxbyflvndxlnqqahkmdgjyp' WindowName: 'zcocrkouyuqhgskqmpuznatzxknd'
ClassName: 'heopwlfpnjdyfsrnmja' WindowName: 'zxbhhyvvdwrkzpeplyoseyzummz'
ClassName: 'bljjhsvkxdnedshrwhnnigk' WindowName: 'nrkmeookhastxtqxlb'
ClassName: 'xppwtdtamwrhwaieldjzgmaa' WindowName: 'cvqvkncnzfwsrhilqpyzkexgqrdxjhqailm'
ClassName: 'xfxvdzvzdjyerhzg' WindowName: 'iejyyjfupdqkwwuvtcxluzwo'
ClassName: 'zpxgipwaakxufkvbkdomehkcvirgorz' WindowName: 'acagachtaceyswtbqlmdtobmlcpfcqrkvozh'
ClassName: 'gpavyokikivtmrhrndsckaq' WindowName: 'ifjshdcflghesvd'
ClassName: 'psomhiyibkookcrltmmgpmaivehgb' WindowName: 'qtoflddtbnmjrdxgddn'
ClassName: 'npmuifmxckttqnsuibkaoqlsedo' WindowName: 'eyxggvrxamqzjgbkueaypfwp'
ClassName: 'agzoejiwxwjtrwsvxnpbgqjudzqick' WindowName: 'dwzaqlbvbcfsuiondjtanslamjwjmh'
ClassName: 'wmikpphvwbjxvyoevgtcnokblpzek' WindowName: 'oewfkhbmbmbddozv'
ClassName: 'vidqhepdrioftxznxddztaxvo' WindowName: 'fxxmcevsxjjmhppmrt'
ClassName: 'vhbjngsjjbbzekdrnoiuqtezxqfo' WindowName: 'rresrawgxbcxmikdtghtfzwczvijytwqvxda'
ClassName: 'bbebzcdlpqimrepnqacfrjmatxqse' WindowName: 'fblxiduvohszeuxkngiz'
ClassName: 'zjqoyheaovnasvaxmjxcfetinuradwnrwwcwy' WindowName: 'htenidfpptnivgxvuvqeewx'
ClassName: 'zkuxkkcyialwgsuh' WindowName: 'ijafdpxylongcwonheoxpyomepjqpliuomwt'
ClassName: 'taujlfiuvyykvvdc' WindowName: 'scqkkfcwqhgnosjzyrvtzcdzxinkmznevvkesg'
ClassName: 'efyvmmsqfuhasjhjljgksscdnth' WindowName: 'nrtwaqxdeoozyeurpbqdqhjojidfq'
ClassName: 'pgobfymwrkvxfjkomrmhs' WindowName: 'ztfslztapqhymvlhjldnbeu'
ClassName: 'fxehvjcfblutpdnsod' WindowName: 'nvwtlqnluxfwxmhsasqqvx'
ClassName: 'nvcnuuwjrazghlvughllm' WindowName: 'vcwgrwegvauoqofgfa'
ClassName: 'bmdaelmmhtitajvlu' WindowName: 'fyhfmemifhrneayogacdc'
ClassName: 'xdkfqdouujqodjkswlu' WindowName: 'hpyweuacajyxgojyyqyrps'
ClassName: 'xkgyhunicoaaqfaglxqbasnwp' WindowName: 'okdbcsgbroyjxqhwyeepvyembywkfr'