Trojan.StartPage.59639

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nss2.tmp\NSISdl.dll
%TEMP%\nss2.tmp\Math.dll
%TEMP%\nss2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nss2.tmp\System.dll
%TEMP%\nss2.tmp\NSISdl.dll
%TEMP%\nss2.tmp\Math.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'zgateibjvzrfwkrapabezuydfbssgvfswzwffqo' WindowName: 'ljsxkbpbldbchmgsgdpexiovndbnukrqma'
ClassName: 'wvdmlnzpuqiuezynwxjrzlstqhldu' WindowName: 'ofkedimklaqsxrlfn'
ClassName: 'baeydizibvfdxkaj' WindowName: 'ednactrogcaitiuunjekjwsbujtczwfku'
ClassName: 'ccyouisxjhuxeuzdwgczuodbpqzmzolnqgs' WindowName: 'odbbrfffhlmfyhatjdkowosugrmqg'
ClassName: 'krwpkoircltypgmfcwewvrkhoa' WindowName: 'ikvkorbhnlbejtrbeoudjhxutdh'
ClassName: 'wfqwogtvguyuaugojpsi' WindowName: 'typyhbujzxetdcwprfargghmvnqes'
ClassName: 'qwmouvfsnevwempdsgkxvuklctnhvfmtvivuhaz' WindowName: 'irgtyvzvtqfibfhjxecdpjuweqhkpstcyybyfu'
ClassName: 'zdqxhffyqanhiphahyoxbayv' WindowName: 'ohtirveishasntzkwzetggpycrqclwnazh'
ClassName: 'lwzxsfmflbicfjwizmxffnxipkdnyqhgze' WindowName: 'jiphfiplbvbnqmd'
ClassName: 'ugzwnjkbrqwtytuhmgjnzy' WindowName: 'sboqwspbhmdilgkyn'
ClassName: 'zpdgddibzkusvawpkqqmykodvf' WindowName: 'snvssplezrdupzhmlrgnbkeijdstknwmegepbm'
ClassName: 'pylemmbwzxwtyisu' WindowName: 'wuxvtppmzpgjlbgnusyiz'
ClassName: 'qfkrujoafbvhemfgbd' WindowName: 'itpzrljluosbpufgwhehr'
ClassName: 'flwjbdyjmbpdiluqhsvflfjnclez' WindowName: 'yvrvshtmwytjkxiueyyuihfqpwaiamxihhp'
ClassName: 'anuuxxbsklvnlkgupnylzmgmfimjtdun' WindowName: 'punldvlbvintcywvgqm'
ClassName: 'sfklbvgquathjxxprdamntbl' WindowName: 'tyfnzslehbjmkbumliltxejmmipbyumkh'
ClassName: 'htvucuaaqtgyfdyilizbxecc' WindowName: 'jhnaqsxhimkcxvdu'
ClassName: 'ltyelmregumntxbuodricoxqrbaumprlrylpq' WindowName: 'gsmhargqtozfgqirvkahxdukmgummxrwr'
ClassName: 'pxaabfusxirnbuabasddkamd' WindowName: 'qyskbtjxepylgmahntkbmqagduesd'
ClassName: 'leliuxrethbmzokhbonobhqtofrqsjjntaj' WindowName: 'rzveujixlmpliyvojzdwa'
ClassName: 'jzsaoccfiknbhzubvsshgqjxs' WindowName: 'oyafrllmtfnlyomrstkbhujlakqifmfixkdcet'
ClassName: 'gancxnjbqextccjfnyeyxfdnalozow' WindowName: 'etjwpqqabiatztosdmbzribendrnowtexxhdad'
ClassName: 'phkomnfjiuaynaimv' WindowName: 'jwhssvbqtuehehxkyaosiwkrxtwruye'
ClassName: 'cjdpmyimxtdzzonxdno' WindowName: 'arnpmwrcrzjbmaoinsx'
ClassName: 'yjpkddnzdkxzkcak' WindowName: 'vxduuxreufdafrmhtfmmhfz'
ClassName: 'mwenounnwffualvmzaxnyfbza' WindowName: 'zkpcaaqnmkfhunbuqdpulwkwnlv'
ClassName: 'lsnjbszzmegjzrxgiszpoizlzei' WindowName: 'daueqiorpspxkymaa'
ClassName: 'olgcipheemzfbisdzli' WindowName: 'rpmsdntblbumwxd'
ClassName: 'mllbkbxgfkevlqvlusjuhpftbapzpugdidz' WindowName: 'wewudnbnoikmvyfxdjyafoyckwxz'
ClassName: 'zujjwvgjiwbxqkoqbzjcnncwxwdgaeu' WindowName: 'lauuxjxhjbuyzzfihrqhonuadwgcfywxdlxllu'
ClassName: 'drezrncqmdfigzxhgk' WindowName: 'czizaolawhvetmjikqlvexaeyflhqfet'
ClassName: 'krwfsumvfgmrfqpdnlxoctwlsggqondimekcy' WindowName: 'nhuhgetlqkeiwtzceppwlcqrrgfjaqqzu'
ClassName: 'cpuglyuvkvdayzelvlaeqdynijzfakngupakuor' WindowName: 'eqbbulnlwmqvkjaqnogr'
ClassName: 'fkbqhzhhtyujxsavxxtwskxrtamfxomu' WindowName: 'ehqaznqlfrhfhipqfodggenwxog'
ClassName: 'hobwcdeylkqwfufdhu' WindowName: 'ofpbeglurqqxqbcmtggiwfgptzztj'
ClassName: 'stdrqvqzbdghwghvwnohgvpmhblbkyxndbrdb' WindowName: 'jfdykmtjxzswwkfn'
ClassName: 'qghyynnhfrycueieezlhhlstqdwqqpoim' WindowName: 'igzmazfxieslpajqzaax'
ClassName: 'hoxvwtrszczezpwehqgcvmzhzvimulylihmeqo' WindowName: 'xgnovqpdvbxwbaitwgv'