Trojan.StartPage.58429

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsy2.tmp\InetLoad.dll
%TEMP%\nsy2.tmp\Math.dll
%TEMP%\nsy2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsy2.tmp\System.dll
%TEMP%\nsy2.tmp\Math.dll
%TEMP%\nsy2.tmp\InetLoad.dll

Сетевая активность:

UDP:

DNS ASK bi##.#antule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'yffchmwrnhljrffcwaupbydknvq' WindowName: 'uzlfxiakbspwddboncpgevtpdskwtdsucwgkqrc'
ClassName: 'qjbrbtnkrifjldqnisaa' WindowName: 'ypobvtrlfpjsmaujxjftam'
ClassName: 'dzjndneltsrdokxbftgx' WindowName: 'ninsvlvdsofbvkyybcomfxebujhwhtmzfrwma'
ClassName: 'yleldyneoopofdpcpivcfidqgtfs' WindowName: 'ujibblpygvhohyteunpvknzahrkdiutnfixu'
ClassName: 'cntxntvlaczoruvboswcasdsn' WindowName: 'owrvgzkbvyymjhuojdszde'
ClassName: 'ypbwrjemumeadmrxrrs' WindowName: 'dsjorabqateodsdmtykqoldxrhuqfkadlgogmnt'
ClassName: 'kpihaqvgjrppypubjqxogcjtoglwxebcwg' WindowName: 'azfahyszdnyuuyzzpcxplzdpzipnnr'
ClassName: 'yarqhobqiwjlwanuawhoao' WindowName: 'dgryfgatjgyqtgbzt'
ClassName: 'ntoiizfbhjnttvxhfltnpkobywhiapa' WindowName: 'fvgfbjftlybwjzqbpopjpblzvspwznvf'
ClassName: 'vzefxkdybkvueennidhwstbd' WindowName: 'baecbrumewlzjhika'
ClassName: 'jdlcwgcfpqbeplqfxqubshtnzggjpuawr' WindowName: 'adkofvrwrkjwvhbbwdgvoswwyufrfpytts'
ClassName: 'aweejvwzylizvbdbbqsbrdycbvqnuwiaovdzdmb' WindowName: 'kxidponeaukwtpczjmqdtblrspvap'
ClassName: 'nqqcotvfugatufejstnhao' WindowName: 'owocpzazokwrkcvuurryjvizytihr'
ClassName: 'qpdgapuiqbqpazbgtkxdpl' WindowName: 'pttmzhkrmiljwckbusuxl'
ClassName: 'laexbpgkgduiewlqofpzeoitubqhj' WindowName: 'bmlyhugfqcdomnvnwfm'
ClassName: 'zeaeludndcfgotknqficnarzboqtsyvmhug' WindowName: 'lrjfqrgcmppkcbpsqkrlejwgeoq'
ClassName: 'xkaeenqenfwznmqcbxttwtzlpvzcmdcaf' WindowName: 'cstxymeyahgwahnljlmfoipuzefenrqkdm'
ClassName: 'fqsbbtoiwzkdpqgzqa' WindowName: 'fcrxsnejpixqkagvzfrzbfqauey'
ClassName: 'jlfxtgsaqszfzepvmspwf' WindowName: 'shklaaiognjjnfvafqcxzcnjr'
ClassName: 'gggvmzigltyonpyvaacvpmrlnm' WindowName: 'tyebzowzwbtiptqukqnealmx'
ClassName: 'catknvigjsiyedqqgobflkiqn' WindowName: 'qksuzszoxydxzlgkqbrdusauobwbgphm'
ClassName: 'nhdmznvuiecrlepjloq' WindowName: 'dppyzjldpqmpbuscrzwavwtulqvxf'
ClassName: 'anslorqnhbenoxlugbreywvx' WindowName: 'ujuniogvljaththprbvanwyyggbeqpnqihyrdx'
ClassName: 'ovjddhrhucvoffwinmyzoyy' WindowName: 'pcjtfpimoohewdsdegqlulhwhp'
ClassName: 'keumfsflkrsgsuddnwnf' WindowName: 'oamlqlrxwrxcirusrjqskpp'
ClassName: 'ftdbmimimgmztxqqrwaby' WindowName: 'rnwenszyxuvtmzjzlnhddsacygn'
ClassName: 'krgptyjrjthrotigwjbdrice' WindowName: 'wygfielxrltpqwhq'
ClassName: 'ygqlvaxfitiotkoguvofuyyeylzpqzzo' WindowName: 'opvcpurraiieavbdyfxhqqbkvmihkulsbnngeg'
ClassName: 'maziogpsenxdrdjdlhraqqsbf' WindowName: 'xtjycoymugodztnzpsgzcgnfbygm'
ClassName: 'odkneigqmfgfblgirljyjqm' WindowName: 'xhockantmnntdkeffnrewkrygj'
ClassName: 'rkurbtntqbuaskndlxclbipf' WindowName: 'dcisnxybtkxfowdlcodbeqlrqctc'
ClassName: 'jglxgrxetogtoeb' WindowName: 'lheqractizdbpiilheezv'
ClassName: 'blvgudavloyceywwaeggiorumazjmpzz' WindowName: 'avixiexaspgglyirwkgwlancilfekvi'
ClassName: 'eoubpqvnwndzjuaeupsyfxhxytzqi' WindowName: 'fvynequsualedtatwaycgrdavxrwtsgcieaegpj'
ClassName: 'jzudxsctpsxpiyjbrywmypixxoygvr' WindowName: 'oyxwyqgeoakotlvhozcgjwmpxehnl'
ClassName: 'apizyhyntyrgtlckmjfzqqiiosk' WindowName: 'knqtsqtxfxzpmykjbyezqymajiz'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'pduxyujljkwiqqolwnscgyv' WindowName: 'ppedhnwomkecgcmiehnwbormgfjoniwjmb'
ClassName: 'nzliqsvejwhivgqp' WindowName: 'wjprcqokwybalpveuqqlcktm'
ClassName: 'ucriojrpmgpuakscigsgfh' WindowName: 'pfhqsdnlwtjhoaank'
ClassName: 'owembfcprjywbnkaizmp' WindowName: 'wrmqxlcpftipvpgelyh'
ClassName: 'gsgexhbyyojfbxyaphngghatlwxfaqgilbouhwi' WindowName: 'pcqpcwsnsuhyosgintdab'
ClassName: 'bqodwhffsodkflembmbqtog' WindowName: 'guqstcilqyyudboyxinehdcuozbwisrftj'
ClassName: 'rkjvqzuqzaovjjljwybtpbhjkueeqva' WindowName: 'gnbsfnvztwqizkctkuwwaevtpzrlstzcvlmbzys'
ClassName: 'twgeldpyxpnfibtjtroiqqdwiwcbgb' WindowName: 'ipnttmxmrotdxilfb'