Trojan.StartPage.58173

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsj2.tmp\NSISdl.dll
%TEMP%\nsj2.tmp\Math.dll
%TEMP%\nsj2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\NSISdl.dll
%TEMP%\nsj2.tmp\Math.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'xvvwvxmwqlnfurskoylfljv' WindowName: 'fckfgcgrgevoyaedqxoxfvw'
ClassName: 'kldykizpgxmlsarvhzhyxnaexstfcmipj' WindowName: 'dhdohybdzgyrvfkmywwzufmdqkxlcwtrgl'
ClassName: 'qfnqkzobavotjezceztycdbodedkj' WindowName: 'pftkubctxvoztatundhsjt'
ClassName: 'hdvhjnbnheomtzujezhsjljnc' WindowName: 'hbtjwgcvopchczxzcemhgwulyf'
ClassName: 'dogomlbbnqfvboalehlqddjvptpwpavxh' WindowName: 'mcyadnbsfrupytnpqdmbhqhwldwaazovy'
ClassName: 'ywolbschpoaniyzawpqjoo' WindowName: 'pxpknvkpakoiaglerwk'
ClassName: 'vqtbnairqgvohagrnftnaazfpuhgegg' WindowName: 'vovlfqhhtqphceovvzdqocelxuyxlmywdvut'
ClassName: 'eglcebrnhhncgfmhuiatfouxevvojskgjn' WindowName: 'iftwijwehmnvxewwlyejlenpycqbwprhpvyx'
ClassName: 'roptdwzsohpjypypvzqay' WindowName: 'hwyibsjhjhhhyrboiqnnvvjxceku'
ClassName: 'fyxomrudmkhnjupgpoexywv' WindowName: 'dcvbzzlbjdeqomyjxxzmqclwk'
ClassName: 'qlgbgodifnzaxavnvsushdca' WindowName: 'ynupvmuthzwyaksfjhzwfumggxljyuklohuoc'
ClassName: 'wpekmrwnmqyoyidtlmnfz' WindowName: 'vbzrvwselrhrrdocxqpmeutmxmkzyar'
ClassName: 'owgzvyolwhlesfxmbynwaxkwcaq' WindowName: 'ehvjimksymgaponxprhyg'
ClassName: 'chwjazkgsoehruidkmqpj' WindowName: 'mnvnfhagpexhdkhoztfyrfuw'
ClassName: 'kosdbkxwdlckorwqlljt' WindowName: 'gmtiqeusjfthyzrrdnwfdzulsppfenbzvybjdc'
ClassName: 'phknecjrmylhlgmyckarhv' WindowName: 'iiqlmcrglabqumtbpososqzbjnap'
ClassName: 'svarmewfsjgbrkk' WindowName: 'nzyfyjdaifbkxcoiowkvvaujmnferrwfirzi'
ClassName: 'dmvyrxasljfgnasvzxjrbedsymfrpip' WindowName: 'sisgnbrwjfsuggvjgn'
ClassName: 'tqngexluoanwiyofmpxnozcpbbh' WindowName: 'zskmuedcclvhnlvmttxrzuhs'
ClassName: 'mdqsiywbviwcwlnmvt' WindowName: 'olcrrprbshjvxdv'
ClassName: 'oifyysqtjmxpchbuuvsvidnaun' WindowName: 'rvetdchkrwqacsaezelq'
ClassName: 'csdndjnmcyycfxsixpwbmmgtfswkzzvjlzlj' WindowName: 'isjinvuoqbqfgew'
ClassName: 'nykpnlmtmkgsqxfuwcstnzgqxgvxlcpylmvw' WindowName: 'vjsbjxmiqlxifhvkufdahjlhwnfg'
ClassName: 'qujkyhtfwoovrtmpiilomojyf' WindowName: 'uallwekwggcjksebzxhi'
ClassName: 'abglaxugiyrnalwkzpusqhyauzgkzlnocgzx' WindowName: 'konaolrbkpdymcqpmrugfkipzaslxrn'
ClassName: 'ywytfqykpjthevzrqsaaodhanjwke' WindowName: 'qisodfnisjbguyiahqakmtsfua'
ClassName: 'flzdtzxeewbdbkeplnuwbbghkket' WindowName: 'odarkqrdpozzfnahcczqajfz'
ClassName: 'fgajnheelckfudqeyixaxnjfjxnvwejwvcglgjj' WindowName: 'rskdmwaxlfszkkermvelvqei'
ClassName: 'xvorzivntzjoxzctgyhvtettirqje' WindowName: 'osutdnrdzhpputoyujaynoihjrwneotaqbvnfb'
ClassName: 'uofzqskvzzlthvcytkv' WindowName: 'oommulqbojqedncxrgfdhrijnyu'
ClassName: 'vzonabvuaadwkrldx' WindowName: 'kshtiavbxfhmzqwitj'
ClassName: 'jmpwflrggekbtwgsajludslllnzht' WindowName: 'qeqyzlszirxazailbvuuvpybgb'
ClassName: 'ealhyypgffnsqbrcbgpiafreuqkqo' WindowName: 'wrsipecgatznriojhifzqna'
ClassName: 'ontubksucqjwvovccqrgdqocgfaebtxhhmlhfvq' WindowName: 'kdmgjiibydpizjvaobotcoxmltkrrlkldwqreh'
ClassName: 'ikcydfxrelpunqvbvhwbkbukpckbokxqumkejo' WindowName: 'vcxbzhjnyhremusgoamzhkkvl'
ClassName: 'efvusagituqtxgiimqnnzuzroxbm' WindowName: 'rdgmmprcjssejuxcvuaz'
ClassName: 'vdudqpyyaayrdxnertbqspwrfcrubkmk' WindowName: 'symddoewjmwzgagxcrcoxjcjyylwcuob'
ClassName: 'ssuzuisgthqnbabkigwyttibsmdynjebwrc' WindowName: 'khbysrztmdltvuukniicgiof'
ClassName: 'gtizlwgtutwixrurprtxmieelfu' WindowName: 'snzrgmrgfgielywtrrssihmamjdrctwwiguha'
ClassName: 'aqtqimgbomgchxteutxn' WindowName: 'ovunirjcqmkdbdqnxd'
ClassName: 'defzeqfbdcguibbgmzqcdpuiykcfgnk' WindowName: 'zyaulqriqdjfhnywqflfokseqse'
ClassName: 'woxhguaqqwyvrhbqiigbarbs' WindowName: 'zpkptmdvmjixmgxoeuxhdvlvlne'
ClassName: 'unqayrlihltclgtpsiywswumczner' WindowName: 'zmovuzomsvmimphvqml'
ClassName: 'fcstleifzsudpvxkghzfkq' WindowName: 'jxyztleagctnmopjifnpcpkazkekp'
ClassName: 'pboyajxautwlnrkwzqjxdqwiuwlpfp' WindowName: 'tmcaichhxrfulpepmoybq'
ClassName: 'zgxigobyweruaoriymbfehdzfcghayckllg' WindowName: 'wgzwmsazuvhvwklo'