Trojan.StartPage.59350

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nse2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nse2.tmp\System.dll
%TEMP%\nse2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nse2.tmp\System.dll
%TEMP%\nse2.tmp\Math.dll
%TEMP%\nse2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'rqxnvvldepkpcgohqng' WindowName: 'kcijcpeczoxobuvkjopfwjrcmebpernde'
ClassName: 'tftpmqfjeskmdspfduebeihctymgwyfuuvii' WindowName: 'tvzcpokwsrnhkbuxt'
ClassName: 'jygfidzhbqqyvzohndsjfyolqjsymmlhdd' WindowName: 'pcgfikkjiedfwceqllqzyshoquj'
ClassName: 'bakndfgwiqnvbcbbwd' WindowName: 'zahxaxxlmbkomftwfonppsvjgdw'
ClassName: 'ctautgsmsldghwouxpjcawpyuuhwglafl' WindowName: 'rbudgecocfstixhxsu'
ClassName: 'pqbvzyhvnsszoshxifdolmjkwroak' WindowName: 'vifybentqoiaorvpzyf'
ClassName: 'nxkrhmsmnlhgeguhobzcpymqjdgwqmpp' WindowName: 'sjdazuilkpmnpxboeaqbikfkjj'
ClassName: 'agqqqxknikfemcuvbhiurddccualjdzzcczas' WindowName: 'snuvxncopmgsyhpweiseibypyuhvuq'
ClassName: 'civtsvzpyvmpveebsksphmftkvzwsevwnllk' WindowName: 'qzxzdujezzhilerymqblquf'
ClassName: 'tuzrzxbzxfxccovzxnbvznytbdscxorzwuwrj' WindowName: 'cdagfmnolvhpses'
ClassName: 'dvmhivrhnvzfsrndkhyc' WindowName: 'jtledhtsattggiglflbqwozzmzutgt'
ClassName: 'nlolicrgwdbquevvjllog' WindowName: 'tqknasnblmdiklywuvxgoyxeegacufzjxjg'
ClassName: 'cqvgxrogyqjnnakqmslxwahdlesvwgddrhmc' WindowName: 'bhwqjxyplakwokmtkikztqehdjgwvoihkzt'
ClassName: 'zqlzuphptiphmogjjviblvifxqkmxdthvaoltk' WindowName: 'snxxyuetebvowxpao'
ClassName: 'nywcrygdzwakjymld' WindowName: 'wohpsiqyuswzjtmykinriavem'
ClassName: 'gdlwkfsfoxcwzlfxer' WindowName: 'fazsnioyhtsraccifdsb'
ClassName: 'gyslgjvfgwmlriuyggdmwzxbbwp' WindowName: 'rqmhatycjrbpftayqwzrwvkhvsuvcotjraitx'
ClassName: 'tsubobssafjgfhgc' WindowName: 'wtkuzwtlgiriqyfozpnm'
ClassName: 'drnirhdxktyifxbrhlambihtxrt' WindowName: 'szshaqkyhqvocotknkuzaphetrjuldtcgohoq'
ClassName: 'xmdcxwtvgqwbydqmubflhkdg' WindowName: 'xlmdbtlihsvkbny'
ClassName: 'lnnhzaqwzqbsjruareksfcrphnxy' WindowName: 'eutpsjxmyckluak'
ClassName: 'kbuhkcpvxqduisblklomdqswmzqdupqzrifmsx' WindowName: 'koxeyrgvaztpejjyklwbmicsgkelvvadip'
ClassName: 'knpgnktkjyagbdm' WindowName: 'jvwvqtbaistjqckqxwkmjkfjkiboqnrb'
ClassName: 'egiqcxtvnonlmzuyzwgbxjnqblrubprvyfuz' WindowName: 'dgbzmqrshxxnqfpcmidchcseekeuciixkgo'
ClassName: 'xlobgumsgisljrmutxnihhrhmkt' WindowName: 'ufgmizyaduuqeqfllfqeunrdsanbpp'
ClassName: 'ssvqtntepdtfseqpwvzzwwjcbomef' WindowName: 'mmdlpdnzjqgwodaoddsblxtnueidlsvbc'
ClassName: 'dwtuewyuugfzymrntkclojfmzmpdkmzmr' WindowName: 'yfmrfckizqmozyvysoblg'
ClassName: 'lkxrfblhkxqdhheezgdsigskshrobb' WindowName: 'bmvmxtauuwnencoaivxwsenfznkgbv'
ClassName: 'vedstyupigzrcbmcnlqb' WindowName: 'pjdarahopculqhyyacfydbzqxfgdi'
ClassName: 'okwhqxerbbtfgzuvcazkauzmnaubuuu' WindowName: 'qxogqlkmklotyvihlnuxlhfzthrswesvsoj'
ClassName: 'ibfrptzvxqeqjnsx' WindowName: 'qixnxygusfuhiztggkox'
ClassName: 'xezumitkdfynlehmwfigckn' WindowName: 'apwssmsoeoajchwzsiszlihodo'
ClassName: 'oxchrtvlrowuivjgfbjtvfpoipiy' WindowName: 'mjpxkcbklcnvbpiktokltvlzlhsmonde'
ClassName: 'owrpynvxlvuqslhcygnauonmamthrqssvlva' WindowName: 'mkqemkcvqnrikynlujoxejwvtnzidafbepgi'
ClassName: 'taiffucgssgnwbmy' WindowName: 'cfgzocvkmsvhlkfuqxdjmpfdhskbmrbtoi'
ClassName: 'ruefadnksocgasvcshscjfzyfecl' WindowName: 'zqhlepdechrspuimqgyqksntutmj'
ClassName: 'jgnhqznbuesvqrmxzsefyjvtlqlqrgbcszxpc' WindowName: 'xmlqpncolhvllmkohcbhbmh'
ClassName: 'ljlhjykpknqbjenwjzkmkzzvazuepiw' WindowName: 'wzcilrveheehrdtgqdvvokcyc'
ClassName: 'eyjagwztchktoqzqzxz' WindowName: 'guffyqtugzpahhxffsjltlmiowqwflrkibrrr'
ClassName: 'taapwzmcsureygcnufizblrgttiyivju' WindowName: 'ougxxbdxtazxtobmbridkcfzsjxfvmubvwto'
ClassName: 'dvocartqgvecpakqm' WindowName: 'riodksqsxrkzgxnitivb'
ClassName: 'neyglibnjuuipsgunkvqsacbksdsgbjakbraugt' WindowName: 'decbkqlvsqgxyjnojgcsrkmruhjbn'
ClassName: 'kaugeknjcrqtjeoqmlogrgaiiyrdrqrhfj' WindowName: 'ovquywwainhqakbwnfcjfmqwrkkfrsgv'
ClassName: 'dxytnbepqyzqmssgqyokgsxopxpsek' WindowName: 'bzhrqehsdljvotgxgzukgpxjazpvfw'
ClassName: 'jbkzddzmsxbtnviareltwqdkoecmeo' WindowName: 'vjbhbhdbygiixlyrgkoegtzsfvkqov'
ClassName: 'ocuqiieiitspxcvyvkearlpvtrzbodq' WindowName: 'mdcumrsogvhrwxszzguledvxqndaohjuiupzsxa'
ClassName: 'piwqrtrbxcigezndvqfettvjgimgcijvahvzvx' WindowName: 'erdhsnthfipsrynsaumbywoerehh'
ClassName: 'hnlztvkuktlkculeuwas' WindowName: 'hvrjofktgaicfiocfszrifujmulttidmg'
ClassName: 'gbydetsdxdjcbgnebyalhqnchwmopjksolalzq' WindowName: 'svtmavyhifnpbkgbodwmumqlufmttnremxllqwc'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'umvrqjmwpomsusfwidotgouzmqkboiussvbx' WindowName: 'qzjfuwdprjzqpzrrvoyzswayepd'
ClassName: 'byjxoieeaxyapgslin' WindowName: 'lcserwmaoggtbknpjmqbjiwzfwkhq'
ClassName: 'jvxpsjfzdwzvnwzlbajfpbjouplipclrt' WindowName: 'fyurkhvuabxazhhrtkeqriftdramxivzqdlt'
ClassName: 'ycuppjgcvhjgtdhlxjczeasazyesdqwbvdlfb' WindowName: 'lyourbgdcvyzclagydvwayzyfslz'
ClassName: 'yrodhtldqrpugcfkrlzcvydazhrlnsanlm' WindowName: 'vdncjwpsafqcutbyquymnkiore'
ClassName: 'nlojzgqezowghkgqigeuzdidgdb' WindowName: 'hyjqcafmssqsbstlkragjxxhzaevwxhpto'
ClassName: 'pgxlgfuizcfitnkrjek' WindowName: 'cryhwraanyxslclfyietbmmkxsidlddsafkiag'
ClassName: 'lgrzzsxyqkdouoiwbru' WindowName: 'kbahzaaerjkdtwkopagtdaurk'
ClassName: 'sbpwrtizcunuijdk' WindowName: 'tahxygdpceaenlmufjpgstoprbmkzra'