Trojan.StartPage.57954

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsr2.tmp\NSISdl.dll
%TEMP%\nsr2.tmp\Math.dll
%TEMP%\nsr2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\NSISdl.dll
%TEMP%\nsr2.tmp\Math.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'jrtnoabwphwhuxl' WindowName: 'qxuddhpebfmigearsantefgv'
ClassName: 'aadfyapacbjogjtsnjrxqgu' WindowName: 'xgjzukrrkwowzchqepkgzuxud'
ClassName: 'vfrktmpeatldcnvj' WindowName: 'ltvqzljxqloxmloralkikvwttimckrrqqtmqqki'
ClassName: 'lblzjsckfyarmmekrw' WindowName: 'quzjeaqttydzxngvgsrkdwdwjrgwuwkts'
ClassName: 'fvxtejhvpnfunafclvlvskukghsodqmj' WindowName: 'hgenjtrravlynavyybbgxm'
ClassName: 'qlginruwsqdhvuozvelwr' WindowName: 'usqpkaexubpuxoetxghuevmuefgjbsxqfmq'
ClassName: 'bhulybnsgqdecxcejgoloyyhqvguxisjhxsxxcr' WindowName: 'nswrgijacghapocpyaawdredlqjdd'
ClassName: 'yfzbxdcxdluzkulvzumlmkx' WindowName: 'jbtawvgtvdmafat'
ClassName: 'efpdxjltllebtxcafvflrwwbyfzjsrzuztekye' WindowName: 'fizcmirazvowboefyvjjddketxd'
ClassName: 'odfvzondoqrdksjoxjqjgzirudwcuyybvh' WindowName: 'asfwwaajhxlaypy'
ClassName: 'wklncnjtfqfrxomszvbgysepnfqg' WindowName: 'clmfrktoqrhedmijcxdim'
ClassName: 'ghbheyypbmggygamugunglcedc' WindowName: 'snmwesuobnmixyai'
ClassName: 'pvocdqybosiolscmgxllsqqwlmgai' WindowName: 'mcogdfdcovdlrxekxsystn'
ClassName: 'xhsrdfmmenuaqgvktfnvhfrhoiwjgypociy' WindowName: 'shrzeuluwmhpnzffdf'
ClassName: 'qfhmljkozdbiepsdttuloqezihy' WindowName: 'zlbuwcpwufsqhdpebywgzgsotiongxnrz'
ClassName: 'uqlefgqojrhcxgxjmozhqumaftdobp' WindowName: 'vuhklyauptekwtttqjzjggyxvabbsd'
ClassName: 'mpxcijexjjbojdldtfimbxgps' WindowName: 'azbnvpanuxxzltfhpiflc'
ClassName: 'oefltqzagaaxqmrjamzqar' WindowName: 'nrtxckvkhthhnkehjqfxamuuzdpbhaoigzsqcv'
ClassName: 'irqzsrdtiytqgiybipucdkgbgwpnytofzzcvb' WindowName: 'wdzqaorbvyqafropyhllvq'
ClassName: 'vfezpvlgfgvictlxqgg' WindowName: 'lgteavjdhqofamucppcoosesnb'
ClassName: 'mazfvcpmcpzwuxtzynestilsasjnn' WindowName: 'tejfhngybfqihmoehitvpixybatve'
ClassName: 'fmwaeqcydglchfqdjdyjhupyrs' WindowName: 'kgrxowhjzqogobfezpj'
ClassName: 'eoxzmkutfhofgdwyxelwqcmzur' WindowName: 'lisglgwmytnlubdbv'
ClassName: 'wbqrqqzhririyarsnvzdenfuarl' WindowName: 'rbwhstxxljfkypnmpkrzlkhhnhj'
ClassName: 'yljoozwhjhwcejgkfrxkndofxddewqtg' WindowName: 'ldwbklqsxejjnaelkaocztduizk'
ClassName: 'enscpjrsjgfrcxaumnbxvpvslsxldtpcnqz' WindowName: 'zroigxaowpsyrwglerlqyfwu'
ClassName: 'wubnzjtzphiqlpbmwaiuwoelawmvfpjtsnd' WindowName: 'plbebsuwejrpmmaoitqwgbdlu'
ClassName: 'iapjwerxmtfeiwxvxcstzh' WindowName: 'rzqlypvjfpdeypctondwylvkrwaj'
ClassName: 'urikecstekjabnaunnezczg' WindowName: 'gkwlntzoagktvtsnjljaaz'
ClassName: 'wjlmqmceowatunkaqbixxopusdwflnqfykpxb' WindowName: 'jymjvvgxksdfyynfdtmyxexck'
ClassName: 'hhozhferpnslwozplwpgoalfbiahhrqzd' WindowName: 'fwrxvgxczmtyigs'
ClassName: 'pzrlvawrkmbupihafkmajs' WindowName: 'nhjahmtvftusovgvf'
ClassName: 'vlfcmtocxasooxbacyseabn' WindowName: 'afpsjdxizpmsvswyhwzlzwzorozofggimapqppc'
ClassName: 'akugoyampfckrgzbukeufyk' WindowName: 'bvrhbvtspwvcbginexjlpx'
ClassName: 'ugzdejynhasfslpeuuhab' WindowName: 'wcopfpcqhjzxisddoaoglzbgexkssjesolc'
ClassName: 'cozzacgoxjhwuivdkduzgwiqo' WindowName: 'fkqpraqchtsufgmoadbvilwjhhmkajsxqvt'
ClassName: 'norawftkskykglycaeyfggiul' WindowName: 'qzmluerwuduiohkfljwqztfojoy'
ClassName: 'ublozhpxpycujzchohrgezqoazlc' WindowName: 'oacpdyiirvjwmnnohaiunhywvjlfo'
ClassName: 'bgxzirdwzxcgumyrswtlmiabbrrj' WindowName: 'hewlylauccaknyoqvgqo'
ClassName: 'jjdpklimdhkcenvgiobgneugxqdsritwjqr' WindowName: 'bzbldadfwbswkibprgkemkzwaqjquczfia'
ClassName: 'vmrkiadnzkncyespxxtxroui' WindowName: 'skpnkoyausdtbmrrbgaohhj'
ClassName: 'vqkvcuvvzdpnywsvxjyyrcjy' WindowName: 'pguthyikykckjefwkkokdhqqnkyzekbp'
ClassName: 'rkqofssslpsbwlkublsdydxxqyjspgpofzah' WindowName: 'qhcjlyvochxlyrkupyevcfaxtuuqnpqnih'
ClassName: 'oyrbiqievyjuocrborafuobhsaaq' WindowName: 'uwfsclagzicdeveynwhueob'
ClassName: 'vynpqovhafprsvvuzo' WindowName: 'hqbliuximincmscyijgcpta'
ClassName: 'ryohpbswxpnhktjqslnhldrfprstermlh' WindowName: 'cbxrgvscmlqjvivzoennzzplezyieeeyrad'
ClassName: 'jpznzhsqxnjrazbsyuriujhoe' WindowName: 'vcebregqmoweabutcuntaanyvexjoprxacyn'
ClassName: 'ipxnjdjtlpxpqjukswo' WindowName: 'tsuwedwonnqbqylzzuakgcxqbrialayrer'
ClassName: 'udfdafwtthkwergujjytdkuzalhkqszx' WindowName: 'jjcprjopykekrbmvmhrbzwhnomdzscnpb'