Trojan.StartPage.58951

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsi2.tmp\NSISdl.dll
%TEMP%\nsi2.tmp\Math.dll
%TEMP%\nsi2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsi2.tmp\System.dll
%TEMP%\nsi2.tmp\NSISdl.dll
%TEMP%\nsi2.tmp\Math.dll

Сетевая активность:

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'qnkmjdzmwgbsrqntyniuzdfeapunbxqokysh' WindowName: 'vttscsztysjpmlvkhiyawew'
ClassName: 'dofrytglajvyqyanvmxqkldyylvjfstfd' WindowName: 'asbmhlmxizgrlmgkatepmngjzyeyxw'
ClassName: 'kdzcvuqbkrzjvcxtlpv' WindowName: 'bxllnxvjesaiygxggrslsn'
ClassName: 'dibwhohgzuseacuhcdyceadokjdqapy' WindowName: 'srfudlpynxedsjzrcvvyfpljolgivkpczqqwmuk'
ClassName: 'qamnomofghbuqmrwdmocblwynlodwmsfzvpl' WindowName: 'hjhhiolivfrkzkvtteocx'
ClassName: 'sbxpcexkhekfhprxmnhfcpjkecnwfzilub' WindowName: 'kxyogmydpycscdmncmath'
ClassName: 'ojnamyqzblrnnvubkkvc' WindowName: 'xqudeyjiobqxvwmotubkbcvzxbhycii'
ClassName: 'busjfrzzyjwmsnbraxorjhndy' WindowName: 'lwlwudsacawliezvwrywmzbui'
ClassName: 'royyqfyenjixdigeqaracshsaea' WindowName: 'nhfyexzowvitrqxwlgwepx'
ClassName: 'sxywlqvzqcqicfihxpsrdgi' WindowName: 'uudkwqaejhfgtjifg'
ClassName: 'uwavlkbqmghhdudemdilfdt' WindowName: 'zxlhppaqmrwyhtjpyxusifhlwolkpgngeq'
ClassName: 'hntsigttgnihwkfovcmupmgtwhvsnbkyrbgiffn' WindowName: 'ngknacyhnxabwjgtftqellnwtcxljkgvoxna'
ClassName: 'xdpfdwwztfdxwnpkplcng' WindowName: 'fqcgychtvmbummuvlmmrcdbpzjxb'
ClassName: 'zansxoaxjxgcngkatxjxevgyz' WindowName: 'fhkocxpitkecqikdzshlrqxsrhbcupydvuvr'
ClassName: 'ziqjkeuevfkaxwqjijjrk' WindowName: 'dejzbhnqxrxprvioxksdrqzhktmodzslmu'
ClassName: 'iwjsgcuwcyfqrsjjzsf' WindowName: 'ajxifdmojhkjuzgg'
ClassName: 'snzywvhkavafsiq' WindowName: 'smazczjccptkbbjhmixuqhoxessnqdq'
ClassName: 'eyurqgaqybzbkqplpvunvvyqpncjvtmb' WindowName: 'dedrqpoqvwtjjqrkicr'
ClassName: 'amsdkxnfwjamxpoqiefjp' WindowName: 'ewfxhbsutegbbfhgwsaxjgdvkrnacisuwvae'
ClassName: 'iipewrxeozuomdjkngksuzpyzvwfbtwizsdusj' WindowName: 'pgtucugjudjynvwjzzziqjmo'
ClassName: 'fsypmigcxjicvkpiw' WindowName: 'yqzfudahfylttzqqvsusratuzhajfd'
ClassName: 'yafxlnkcwatjwuojgginjotgllcqvaoftkvob' WindowName: 'rmhgfgbytagyovwlgwpgmywnkxqwpaugd'
ClassName: 'zfvqlnydbfbzdxhzolwtwylkkkgg' WindowName: 'jlqbwtbuuqhvjusvocxsnrogxckdwt'
ClassName: 'dmxvdmfpwgmptvoh' WindowName: 'egosrtqvcyvkmvsmkluuvgte'
ClassName: 'svhupmuzratspjxmwxlxxdccptcdq' WindowName: 'uyvzqnbmfbaxlpfobbgpocrwfndjzjmhqfefuz'
ClassName: 'trynljsjfkkidxgme' WindowName: 'kgbhqgsiragifbigwmpvhqvinoiiskddwyfb'
ClassName: 'qdetvbmorqaewjuyokyfmfuokmemxwxiikkv' WindowName: 'tqqvlbtvbgqbvpjng'
ClassName: 'vslydvnmylepnlcffvr' WindowName: 'ngqxfnxykyxceuwemrdezb'
ClassName: 'dwsxkwllhtzlcbmzqbpbtvbpcklp' WindowName: 'krazerjjujeulqaej'
ClassName: 'lpbstshpmpefbhpcqrqwt' WindowName: 'axykwwjobrtkhkebc'
ClassName: 'zhspkdofyurlurxwgptcqpriexxnwg' WindowName: 'ppowufocdsndytiijclhfovkm'
ClassName: 'tqppeafqkilofrukoaynjonbaqemypbzcwzr' WindowName: 'wzljadyxgirxqmllowuebdwzrqo'
ClassName: 'jbdkahnqpbagafnsfbnwhcmcgnllxaop' WindowName: 'kmyeebesyibnaqhviqlepdzzeegeebyqcvw'
ClassName: 'abinscnjryvsyumqfqyxxwuhgqav' WindowName: 'ikhrmzbkpcsoiplapzjqhsiwqymh'
ClassName: 'iumegkrpzobqskkaltieyzrwihd' WindowName: 'kzlweinauccmuhxsenkmrt'
ClassName: 'levneukbobqlgiciiewl' WindowName: 'naizrushawgacucnhdkugcgmb'
ClassName: 'sxqzgnmrbkgbyidevovfj' WindowName: 'siwnzbmaeemfenztreqpmwouhwslqbtmnlalq'
ClassName: 'nwljdpmnihcdfvmfetbvuzuddhyb' WindowName: 'jpbpnmbgkfcddvrirncmsderydopuxwfxjnso'
ClassName: 'sgxpkztkcnmohrbgbhajrqvkburacfwxajjuq' WindowName: 'yvckvcwgkhduweyjdtfazfixwbrwmcidw'
ClassName: 'czruutuqoqtphtqmsaw' WindowName: 'yffmtxliilllwevgwiuih'
ClassName: 'wgzltksguosinbncaotxqdf' WindowName: 'rjddbygkdbjrccvwvhvscdvxmvcnyfgby'
ClassName: 'scojaktwhygyokgyjejqvfdswmzvrmvi' WindowName: 'iflbhkabxnaocibqvzhjbjmuhlibet'
ClassName: 'yiljxafhmcugsje' WindowName: 'rkzdgtxcadwnkfx'