Trojan.StartPage.59524

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsv2.tmp\InetLoad.dll
%TEMP%\nsv2.tmp\NSISdl.dll
%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsv2.tmp\NSISdl.dll
%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\InetLoad.dll
%TEMP%\nsv2.tmp\Math.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'wfoaaemlvzcdikcxyuyrsjkgmyjzggaacowntfl' WindowName: 'encwmfgncybxdytnawwvlxcypflnlhlmwkuvyi'
ClassName: 'uyiajjyhyublbcuoryobhgstqfe' WindowName: 'cqpndkbcmealvracycujbuf'
ClassName: 'xujfirvcizzksglckssc' WindowName: 'gutsgvwvebqwuwjhwnz'
ClassName: 'dakrxerqalauimjfnsoiuwifvxnkdrsca' WindowName: 'zqgacrildsoinffjfjxsrpuugmgjrzyczrpjru'
ClassName: 'twvgujfviynsyhzspqgkvdilqjicnsto' WindowName: 'iebwhpdhbbcpldslygskijtanvtxygjdqxdua'
ClassName: 'gqjvgtqfxsqlapbvkpt' WindowName: 'dgrayccapdxnmhhztasnjtbrlbvjgkdodrbxaku'
ClassName: 'huawfpbmkiqgjunzftkgzn' WindowName: 'krtbctugmbhycqtvkziospysywqlxvcyvx'
ClassName: 'vueroickhcmxqgiusqb' WindowName: 'zpocjtshrmupfnvrfnocjrksyi'
ClassName: 'dxlablfriycrpwfxedvewsyxfxlitzvdb' WindowName: 'fgajghskulwspvikokkqwukzmgluyawknvwyftk'
ClassName: 'biargscbqzdllltbkastjiblisgzd' WindowName: 'bbrcoqfwwuqersqufriscvgjjxyp'
ClassName: 'bhotilxmwkrgorarbbfimayx' WindowName: 'rqvayeuxowuepjxcokzuwqmdpqo'
ClassName: 'tvmenguytyxgaigaitnbytwfixczqxnvvcxw' WindowName: 'rkmptvicblcxvcwrak'
ClassName: 'hrtdzshshslurkdohbztkuvwhbgngntgp' WindowName: 'nyngoapupudyvmlhjgengawsflnwigbxvgm'
ClassName: 'pgcibluvdmapkxrfoyoblwxz' WindowName: 'wfgtonkrlebeqfyem'
ClassName: 'ugobdvyzhdlzverzubskdqecximkmtpwjoru' WindowName: 'wsgzgrnhvpuchtyqmgpnom'
ClassName: 'qjbkfptlekeusllutsxs' WindowName: 'rfqvwpvyyabuuccs'
ClassName: 'vapkkwzfvpvfaeewtxmpntwjrnxblrxhtik' WindowName: 'grxaxpdqihhpwdjbathutrdyneldphwamskzrtt'
ClassName: 'ulwckmykvgjqaypqozruamcdodtznyhdkar' WindowName: 'spblgjmojqnzvneulhxlistdrxvgbuojjs'
ClassName: 'vftzvsmzrlhdsdfjpvdfvsbrjxciabhgnzhbe' WindowName: 'fpiydexzyxsmyzzfcpvdqfpiacjquiouifc'
ClassName: 'jbrfpfxtunzjqikmiglqxktxcogxdwqgx' WindowName: 'ukuixbnyonnfrupzuxnvulcgpxbq'
ClassName: 'qrvpxszxpxujneanawlazmefsvk' WindowName: 'flyqgpiznwikghg'
ClassName: 'orsgzbxnoazfcajgzwuqcpurdqkmbrwiqeirnca' WindowName: 'cofgnlltadxmwbcnsiajoarraviwseebvpfk'
ClassName: 'fubbecfosmuezpczdbbracgxuwbxeqc' WindowName: 'ctswhbfntzxxdofcxx'
ClassName: 'thtxxwczqkzbsvvcoj' WindowName: 'gqkkqyyvjtormrgus'
ClassName: 'rrxvjkdaabkndshcrmdzxulusrueiwuykt' WindowName: 'nanwjhmlcmotwsnckwekigygtueoqfnfaozwcm'
ClassName: 'fiazckrhctpfinmyysbs' WindowName: 'pzybblfswjbhvwoqluqxaqafstllxpsmvcunmr'
ClassName: 'wmgosbxftiopmlksnm' WindowName: 'yvykhtpzgheukmedfhudntfaatw'
ClassName: 'nfwzztiohfshyvywyptckpbeazgyeox' WindowName: 'etyxzfykuchssedbspxpbefewi'
ClassName: 'venlkusktcasuqjmhyinifdpbgwaiy' WindowName: 'ebuclibmpobawxhsznsywsywbppd'
ClassName: 'vgxkdkqaoasbfmpzspihjtdxfonbublaifmf' WindowName: 'agylcziujfctoryftjanl'
ClassName: 'znpnoqsxhcjlxjznvynr' WindowName: 'akalgpzysvetpjuieynsnzmhozuerxazopghs'
ClassName: 'dwycvfwoqbupaaf' WindowName: 'kilmdlvcxbcocvzlyogvehslmedjeibzobmoj'
ClassName: 'ckojxwvdonxocmqeu' WindowName: 'ehxxluwxfbhzfaloykfrxtftmcmtyuajpzhty'
ClassName: 'bjpsgziucxnddlnazaquasswdfaewme' WindowName: 'bqdgcjbambkvpfqquq'
ClassName: 'ysasclmtwzyuzuo' WindowName: 'vqkuihxedabqurvfrdzkkqdvqt'
ClassName: 'duowqrgxomhbacu' WindowName: 'vkgsxwtndyqotoucgoxbyabyxnbjkrbmbzyn'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'hjjahtsrfyfgtcwitjbkehlzchhuog' WindowName: 'zuhlgsyogxwfonbzjtvsyuionnnzogkspagybb'
ClassName: 'yekblqvgegwzmuqv' WindowName: 'usphzvypbrtfrvqc'
ClassName: 'dojasxgnsxcqajeasuzwilmgvh' WindowName: 'fsxdulwpztzaoqica'
ClassName: 'lhiczuunaxeeufotrgmkbsjmi' WindowName: 'lokqvrandfchzeqxffbeioauutqrmhmuqwg'
ClassName: 'nsujwhrtztajqmia' WindowName: 'wwkvmjpdqyupbqtzjlz'
ClassName: 'ljgbmlxrxmdenkbqnpesvhgk' WindowName: 'mvxegzopuelzzmpkwvyyjudqqcbpftutd'
ClassName: 'rgjrrphlvrukytnpvj' WindowName: 'ydwpmomaunuagzsnrnlfppetchbiqvscx'
ClassName: 'dtffwbhuxxwklcpdrlyl' WindowName: 'qddgcdiutrzticcfrlle'