Trojan.StartPage.59080

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nse2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nse2.tmp\System.dll
%TEMP%\nse2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nse2.tmp\System.dll
%TEMP%\nse2.tmp\Math.dll
%TEMP%\nse2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'dadwipjfnobrpvktcqvjji' WindowName: 'puxtlzaessoxdtlrjbuyeiscqtrkpztzopic'
ClassName: 'chnhfevuvxghystjjcmhefelikcbtxvnathyuga' WindowName: 'oidjfhnfeetlvuxrqoaewjqjmamochhjo'
ClassName: 'znsaxbaappsndznuox' WindowName: 'xrknpijeggfjyqicwabwasssvdj'
ClassName: 'keutgebabvtqszzjsgyu' WindowName: 'mwmnetddjynsbyxeaztisant'
ClassName: 'pacaamvenpicvwreotdchqckxdazcwyv' WindowName: 'qftejdithichttmsxdgjoghfzu'
ClassName: 'spnvtmjollwxahjmombaaieal' WindowName: 'jtbzxbkngnbdjvkfeuwrvecunyi'
ClassName: 'xtkywycvteshxbtecgckmvaajholi' WindowName: 'hdymewtnrcbokimjcpzcmeyd'
ClassName: 'izezetvcptijflstwprnhfodc' WindowName: 'fbqahrqkubsokwvliiqxndcj'
ClassName: 'yvtaxkmxierdyyxebs' WindowName: 'isnjmfvzrtebmsicdaaayqdfc'
ClassName: 'axoyvgguhyvgacqhfaznwkjbrkbpciljpzrp' WindowName: 'jifrrxzvootgcjefbamsgorikbwzht'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'ngiqxfeeaaadencoelaodygbgqdl' WindowName: 'dtawjnnjgwulcatwdlonjhndufgrgkwp'
ClassName: 'xjxxmpekixdzsvvjvsbqfvorrrimshmqmqzsn' WindowName: 'vevwwvyseyrhhooiojjwvxd'
ClassName: 'bxgscgcdjremeghx' WindowName: 'wkcwyzqlxqmrofsbwywzrqdvt'
ClassName: 'mjlxvleyhlfzpzrlljngblb' WindowName: 'oqvjijlosuabzcy'
ClassName: 'wprvccpcrbicisqgwwtwgy' WindowName: 'seckqicazkgprqgvyd'
ClassName: 'fbccipcfvpwtdyenub' WindowName: 'nhpmehlkgbfpxqddbexwqvfxlwpuugkeyhidm'
ClassName: 'vpnayhtqesvsqsqmuzmduhpuqacovjijmc' WindowName: 'buwmokrjochkadqjcejynlmrlfl'
ClassName: 'smmpkxplehuckvbxiuchpxdqbubdcc' WindowName: 'mcltefwkmspqlolimmwyogu'
ClassName: 'ffqpioxignybmltqksrijxkihfklsm' WindowName: 'zpmdjusxudfqtml'
ClassName: 'etiyesjesfcgduiegfzlpiwepzjqplksakiig' WindowName: 'rlaqjneyhxgvpqlqa'
ClassName: 'snhnatauhmzsbcxtnyevawbrtgxtocng' WindowName: 'fqdljtnvnjkkfddqjmwhujmxrykatcuvkcjy'
ClassName: 'taauqclyltbgfntcseowg' WindowName: 'rhqicrbjrbjiydmdybvickxnxjtxnnfdc'
ClassName: 'rlnfmvekntqjtbvskujcauhnpuzmr' WindowName: 'tftnljkxxtmjgbd'
ClassName: 'iwwwpaeeyvgcdvghqfvwyjyay' WindowName: 'spsvzuezzqctjfpjwcsrbgqixwiyjs'
ClassName: 'ozjcdenzxmgojspecanbhkcccjdtgyfwlrsskb' WindowName: 'nzeedxpteyxzacnybzxqxyqfjephlgja'
ClassName: 'aaazjhtqmtimibtscatjqiuunzltozac' WindowName: 'jdnkkyjgxfzqfosofblrki'
ClassName: 'pfqbyncemnufjma' WindowName: 'ktblzrpjbjjckvygifragresqaldwwu'
ClassName: 'qfkktdnnlhfzsiksufffykduself' WindowName: 'schkcksfgcwpsirtrwmym'
ClassName: 'aqgmpwlzwaukkggcqecxc' WindowName: 'thxuukzciczvojuiscoiwy'
ClassName: 'cevxnhhktfdvxgqhxmz' WindowName: 'szvesxkegedyiblhoebdzdkqxvxvffighndii'
ClassName: 'awwntfqrqkvaeourvukdzggtrp' WindowName: 'bwingldwfhmgkjawsswqlflpknfelo'
ClassName: 'osdbtqjhwrclnrmfnifocwbuqdhubjhqgtcavc' WindowName: 'ceiacuhqwfbnkthvtktyekwebzz'
ClassName: 'xziokijqludoxwnsifresmh' WindowName: 'hohcutvfjjxuleaujnnvno'
ClassName: 'oggbsgxaywvocbsk' WindowName: 'bxwzepiakywttkqbrlozlc'
ClassName: 'audvcwtixtislcudi' WindowName: 'dacnuymskbzprymkjoo'
ClassName: 'vsbzzdqumukpleqxicezsgidmvutu' WindowName: 'skeyzbyutrbfduvkiobyimusmv'
ClassName: 'oudvzfuzjwlsjawzcvbactlgbnqcbtgdlyvxb' WindowName: 'fctdxrriimxhpahnxohrcvsud'
ClassName: 'jnczwdmhpyosancwbkganmkbyi' WindowName: 'nopfsppxyoxzcxpfkjck'
ClassName: 'pdrtqpbprhdfculmcssjbnndorv' WindowName: 'ukaumhvefwsrdisp'
ClassName: 'avelochmsbolbfividisoyfavs' WindowName: 'tpnzaakvqdetwqogfkicxmqqvqcn'
ClassName: 'enfsdkhtxiegbiiabacwamldjmdihuwd' WindowName: 'rkcvrqgfzxqijmmd'
ClassName: 'vcfufrvxvkxgmdidouwowkjrrhkd' WindowName: 'hcvapkjpqtmekdoih'
ClassName: 'fxdokdnsfaeyajnsndpaykrqtezzcflucmz' WindowName: 'iqqwcqtpezqmsnumpwuplmnzykjrkzicrviv'
ClassName: 'fwkwuwwsfzqtqlnxjndfxyau' WindowName: 'ridhhuvccufkfkrwmzscf'
ClassName: 'mmjytaydwzpdjzkcmypdbfvo' WindowName: 'kgtmaibtpqfliyqkgdrpqprssw'
ClassName: 'vxfctxjtnuvjfqrwaswiius' WindowName: 'kddlypcsgrxgweyhqmcdihucjsykbfnene'
ClassName: 'chiievjfentyhcgtxjpgdrcxhwnzzrylhefdd' WindowName: 'kisowwyqqfyimvxwci'
ClassName: 'cmlfnyxakpvzxoplwgthzvltwxy' WindowName: 'bzuvazmbwxanefcvlnpiszrrocm'
ClassName: 'jbsbqxiitjppwqlervbd' WindowName: 'halsftmmckmbigtvtsq'
ClassName: 'gwjgizovucfngygsfpppnthidukpjkcw' WindowName: 'lfadaclvkoauqkaksechcxtjdlyzovo'
ClassName: 'vglgzlvzqthfpwuiuthixlvqv' WindowName: 'kdcpzaaglhqxqqrvjjmpopifugwasmcbl'
ClassName: 'rxyisxungvtkhludekybtwoppkocdxascqq' WindowName: 'nzufdckhlvsffkrwlyqbfwmbefnbycgdpowmbk'
ClassName: 'xoyciyehzxapzkajlpnxjwavrsjio' WindowName: 'jxokarfijelmplsf'
ClassName: 'darhezpvhpzmqpvfzgymfhgigcotfzkfp' WindowName: 'fkxphgppmjgipezmteoiqporuyfjyhkhntrher'
ClassName: 'bcbhufsdnkgdura' WindowName: 'hlymeddveriwdodeqoufgjtlyj'
ClassName: 'hjfjhtkbzsslrkotczrqpzwzttbw' WindowName: 'ewntrhdwwwlwcjkymplyqaoeamdbibvryjbuttq'
ClassName: 'jrivittuvefhlvnzxhipc' WindowName: 'qoldwnbawnmeneiutiiip'
ClassName: 'wglqxskgaknnwalxiagyuwzilcxq' WindowName: 'tnyajdsfeyiccdw'
ClassName: 'ryemlhtxzccshwudvlrvseegnnlfgftu' WindowName: 'utjjgadyzjouizfsmxxm'
ClassName: 'zvtgtizrqzizfpnccytsxvk' WindowName: 'lkqgrrbudqppxhcletsxtgckkecheeaox'
ClassName: 'sigbskoqepfgqntqn' WindowName: 'wcprwjkpuumrcxd'
ClassName: 'tywimdwuepiyxzvexwknamdstcdfprymqo' WindowName: 'lrlisjiuenfrauehxyzcpmzlmklsgahdunq'
ClassName: 'sttqeyrngarsmvdmiqpj' WindowName: 'trqjuoeqykunzemzuxsvhxhg'
ClassName: 'jxcraprnklifzzzmiiwbwqlmdtt' WindowName: 'pfnexzibbdkjnteergbx'
ClassName: 'ucqfhklyiwzpvnaweysfhjqoamgvhnxrmkcsq' WindowName: 'fyoqxzeemogrmvxndcwic'