Trojan.StartPage.59124

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nse2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nse2.tmp\System.dll
%TEMP%\nse2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nse2.tmp\System.dll
%TEMP%\nse2.tmp\Math.dll
%TEMP%\nse2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'17#.#95.249.133':8511
'bi##.#antule.net':5735
'cv#.#antule.net':7034
'to####.kantule.net':9282

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'cjtmdqybnnyqtnnlxcvjrmxcepgujnze' WindowName: 'dwjxhczsghymckruwlcakzaeofrdouykkors'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'mdtbqrqfchtsktt' WindowName: 'lxysnngiychlzyyslbrnp'
ClassName: 'corsfvhmjphhvysspwouxaeersmhlcqsgdq' WindowName: 'laelwryuhlrlftlfwqktqvueur'
ClassName: 'pebpczxiuduqtzbmuvnlcnxvzuexbcdhqdqt' WindowName: 'bmxqkngdfnvmjttlzmdotupyepdxryujboa'
ClassName: 'pbederpjqaameamubxydvkgorqfxvxu' WindowName: 'pglkoysaxivwsvjkyddbgneldzhtybsfgqhe'
ClassName: 'nqhqusmjrxqvlglvmsfrxno' WindowName: 'rzmcmwppnhzjrijkvyeejtcexecbwekavrr'
ClassName: 'otyxxzqnysgcmthqxmhxdtdtkzjklsdbngku' WindowName: 'ljmetacepziuivsuedjxjhgeilrzymemylxzgq'
ClassName: 'ohutqantdklajeylvdjkoqgd' WindowName: 'ktpeibqrkllggetvmpjfnftnxdlfnxrjreydag'
ClassName: 'dagkvwkaqxeonfwsmleglznondghcxam' WindowName: 'lejbsjyegexgrgtcyenackpkpwadunzrnvviui'
ClassName: 'byivpxrmaioxpfngghvt' WindowName: 'ayfnszysfhnvuxulpnpayjefaruisw'
ClassName: 'thediasdipxbxsglzitariohazvzvesawapk' WindowName: 'opsiqqxhzxzodtxcasb'
ClassName: 'lxpapgjtyogcqoqvfuunqotkupq' WindowName: 'yigqyfwexvqsinjy'
ClassName: 'offntdjhrrxxrpkzzmtmd' WindowName: 'ofyudizfbswgnufmmtttop'
ClassName: 'cawcllyyqbjnvtrhhotilyguecmojfebtzah' WindowName: 'xzeexjaqhfcemgwkqlzhaenclfitdkbajnbccgk'
ClassName: 'gibxbppzhceoddbanxlewtnwrmt' WindowName: 'tsrzfuopxtzxlvfgrzyokg'
ClassName: 'glphgqzmydlkheiywkh' WindowName: 'qurxwwamicqfgejt'
ClassName: 'grpvwkybfsjaqya' WindowName: 'frbnfjsipwbcfxipqzkvvetujxlsydybqrfecnh'
ClassName: 'rjcsgvqxlshhmfdzfuezeosxfy' WindowName: 'qzosxpncovldcspzzbkuheywbr'
ClassName: 'gerrexlfokhfqhygvmybotisffotilavtsul' WindowName: 'avrmnobxdnivwzexbvgymztjx'
ClassName: 'uqejmegkzehwwgmzjzrkhiwpcaosgjoregy' WindowName: 'tremptvoqyqcqhcfksjtjhrk'
ClassName: 'dnozaegssxyguynkfataaxqbocaugylajmg' WindowName: 'rmgvdegfqgjhshltnpuoarfucltlg'
ClassName: 'phcpbatwizxmzobatwogsapfjgc' WindowName: 'utlcuvbeijwrvdgzohysnpvhoxtrs'
ClassName: 'uoyzhuccmbyyjwwnnxlk' WindowName: 'fzhbhqqjtuflsnxhzejxwjyxqlypzgqj'
ClassName: 'pdtyraexgsysikxkxn' WindowName: 'xzpmsvquswitkyjivsrnhxmwon'
ClassName: 'mmfuvwdlvdzmvotiuwlihmbsgbigsmsecujf' WindowName: 'gnkcmojwabdbwkoybnyabaok'
ClassName: 'faxvnniethbymmovjdcjmusfdgqytjcuqmj' WindowName: 'yvjknqngjngosbnkizssywwx'
ClassName: 'vspiwuuysdzwuvezjwflixcq' WindowName: 'pbgyzqjamaddfbydyhf'
ClassName: 'hlvuqjehqxhodbevtyazvussvmpjsylicgkvhbu' WindowName: 'fejjlfpeviqvdcckllczcmixpuhoafrekbtov'
ClassName: 'nxjwnrfifdhcbyftlwqgckg' WindowName: 'edzpawtybqtqbxwtmcvrjovpexnl'
ClassName: 'hxkftmzjbpdaxfytrwstecxfldurkhgepfjyljl' WindowName: 'ybgxlkfgwjxqdezqwipnvjvwglxvlyn'
ClassName: 'pvlnzrsjcpcgcvirvsxqcyuwunhhztua' WindowName: 'phvpzbydandkhfwklrxxqmgjjmyjtqvuml'
ClassName: 'dbvjieyzjurbvvocfgwrspgqzje' WindowName: 'nnkyapqhgzwgwxtcdtzvv'
ClassName: 'nvepmmavhcheookxldlfuznbxglcolimosd' WindowName: 'lioykccdwmmlhyzszefl'
ClassName: 'mhljkzacxraiqqyylhkauisvegipoimhpzvk' WindowName: 'chbwximyxfamxaiglqvyvebiupnhpnwlwj'
ClassName: 'rzfsiuggyvivaopqpc' WindowName: 'shsoqefxsvbxwfrurhoqzgrwvg'
ClassName: 'kgdfeugsdkntttpjo' WindowName: 'absahitdnrvotszg'
ClassName: 'ukxjjjntlgfhxazkachzvjgjmktrjhvzjgzv' WindowName: 'bkgtsahvgqsrbekcvnvbaebbudmjlpojrgbuck'
ClassName: 'afgnkmhgtcyvdrxkoqroro' WindowName: 'rwelkwkcajbzysdfhpbu'
ClassName: 'dchmlszsyntjyqdhimtuxfvyosqcqovhroe' WindowName: 'qostgbhfmfivvxjliscukoqkrbbaikxjkiaal'
ClassName: 'dcrhoyziwvhkjgypoipgbo' WindowName: 'adrdulgakeysyqsk'
ClassName: 'poopvwyblxezinnunmlnsqnmnxc' WindowName: 'icppjvpsicswwprirjij'
ClassName: 'ayszcuftpeddsotcjozcxaotafjbr' WindowName: 'gyzlqpnigywufyimwbkxrnxmzmcyfjp'
ClassName: 'xtdniilbeznoupmew' WindowName: 'sdrhkvmrhlkocfaqdivej'
ClassName: 'mbrgsgjpomunhhdtsgtvbl' WindowName: 'qzxroizpwfwtececdkqhkpcwbjmqjipwifkgtru'
ClassName: 'lgzlfmilfefweqflhvcorxgxhvxve' WindowName: 'uvbwkofzverewayxxysyvjgomkazonvds'
ClassName: 'epoqrckctuveuhccdr' WindowName: 'rdcxhrwjhsdblfpffjfeihnmzqwsugllstcdln'
ClassName: 'dzqcvmwqrvbuusncdcnn' WindowName: 'vvtjsztjullbvmfgbnbd'
ClassName: 'sbtoabllszijixrjyssdbsauwmkzxhwkx' WindowName: 'uogevbjmvyfvlmaggeubeermyngnrislsdwio'