Trojan.StartPage.58562

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsm2.tmp\InetLoad.dll
%TEMP%\nsm2.tmp\Math.dll
%TEMP%\nsm2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsm2.tmp\System.dll
%TEMP%\nsm2.tmp\Math.dll
%TEMP%\nsm2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'wtwxgqndvcabyxfznaierusbabbxcjxf' WindowName: 'nfcvgxokhsapcuv'
ClassName: 'vartlpktpeymcxciopwrvr' WindowName: 'oguvfhaygroaawpqh'
ClassName: 'zfanazhhyavogbsvdhdkdbpmrfzudkeczje' WindowName: 'utgyomhlsmdkfjaffxehbhiuebqfnqvyyrnnrp'
ClassName: 'nviugwjrpwyynjzid' WindowName: 'utjeovvngkuueiatgjxpodkhohrnzbkmz'
ClassName: 'plhvuwfexyvilddwjofapcpagswz' WindowName: 'hdeuiqigxqckerwzznbvkhpnszxbfmwb'
ClassName: 'gwdbrtcigbmybkhzxh' WindowName: 'uhtuawzqmheuhslgyjyegg'
ClassName: 'abfxldslledjcasrsxf' WindowName: 'xcgvekskpmhzaifzjeobrnauodztcoznqwbw'
ClassName: 'ankdpdodhssowtltbtafdhlbzhlgrdnndn' WindowName: 'blyudjjwznmzxkzhmr'
ClassName: 'nsxifoldfaobmvvctbuhcuvlvrqyvhxy' WindowName: 'kaqzflkuplkwgjkca'
ClassName: 'drglqucfkkpfrcexmzqdmatbcgdfczm' WindowName: 'oflvjswyhzmwkqidrxkrkwvpjpvorjvx'
ClassName: 'bpuuojvovgcwbawdsqjvdxwevdshvs' WindowName: 'wcgnmkcrjrqoadlkwhxsusimcoom'
ClassName: 'ownfigjsamluwyp' WindowName: 'otsoabkzhnunrmqcjtsheywcylbpdoyphca'
ClassName: 'ucadmvrkkvsakwmejzlyijvdxujn' WindowName: 'khclhzbjvvsfczst'
ClassName: 'kzfgarbocuijvwtcyyishakdueqyesy' WindowName: 'pktszdaxnlqgmkovwnpcbq'
ClassName: 'odmkxzaxbfeewxfylshiwla' WindowName: 'vbvwdrrtpqtugcojmabjeunj'
ClassName: 'miavsutjxejxgpgdfipwvmcwpuassir' WindowName: 'wcngfjbhzigodysuhmmmby'
ClassName: 'faubhliuifcsrkxhhhasqyyqjxosbjfbqzhnq' WindowName: 'uerqcdrqxzbkmncxlwgyodgqsmdwqkfacaf'
ClassName: 'lvixcpbpqzmivosxjmlg' WindowName: 'zcdogygdhjwanphogmsfmqaojwjmsluw'
ClassName: 'kegwfdvluhltdofarzwjbmsf' WindowName: 'oprbrehnfoxnpri'
ClassName: 'pfelxviadmasmnwpctkjjdexbthxyhzcj' WindowName: 'yerpphyqncxelprubhsqziciwsmru'
ClassName: 'uwsfebhegdbvqizwjtddatlycjt' WindowName: 'cxgmnuglgukfazpdlomjkxnenyjouc'
ClassName: 'hmodjcbpxhcoxhcpxp' WindowName: 'erfcvziyivacoujfgbkzskpwukmalkdpabrcvs'
ClassName: 'ohtpiddqmznwcinkhcrdnikipsrkfjmd' WindowName: 'cryjystzwibxspqxbzjgdjgwtsclxlzaalz'
ClassName: 'rygpsqqdhvinrelgsnotcpgvgux' WindowName: 'gmwwywxcqkzzpvxajoypelrfwfagwbrihqhm'
ClassName: 'rdrueoautajzyogfksxxhqbbypbvkmyuk' WindowName: 'yvtcxiapfjasbdw'
ClassName: 'edunsmfybihxsybeehavigsdqocb' WindowName: 'gyhpzuzylvtinzuthzcuwjtkgk'
ClassName: 'xphrisvkcccqbftozzqyyqn' WindowName: 'fvhevjgpjjvfspszpznuskipvmwxbhsiqbcafrt'
ClassName: 'rnmgbvcdlaphomgdfvekbpmd' WindowName: 'jpajtaiwiwoivfjrcqpobazekiwzrssaeiz'
ClassName: 'lzbskrwdufvmeyfsgqiv' WindowName: 'gtnmxkzqfndvfcogxpyyksc'
ClassName: 'iyexdpwysaluuadnvrwr' WindowName: 'woqbmeznvojizkqhcmyyuxdllpa'
ClassName: 'hmbdnfkbaochdrlqcyqblzts' WindowName: 'aitslkiomvbcueeohxiubfezspjgpsjpxmjmmsx'
ClassName: 'yqdxembsynysekxhqkfgsyq' WindowName: 'rvqpqotbrhsbmphgalmy'
ClassName: 'piwqzwhcuuzbupl' WindowName: 'xjszfzxvllywjwpugorha'
ClassName: 'huegktahmuhcyqyporcqxkuuwjfy' WindowName: 'pogrqagvldobswivtggfsytaskbzjzw'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'oxxyzeryiefbrtpkhseryeofcayxplrkxonkmzi' WindowName: 'uwnxikkxpbaeisaforggavbxhtpwciaomhojimj'
ClassName: 'xpcqwttdbueaksf' WindowName: 'mwvorvooikpbplfaoldwzswexglzgyce'
ClassName: 'hfhxnjzwwdxungjhnxufwrnfwmnnlvjaipgax' WindowName: 'jhxgaifllihsuvobltwz'
ClassName: 'vrpqvvwyodxpseen' WindowName: 'lxbkjqdiylicmsdubiolnsihghkuxytwny'
ClassName: 'evxyvbinmesjakjnfnjydvgdp' WindowName: 'pkqdyxohwlxitmkzj'
ClassName: 'tmdbxaycibteyeknfi' WindowName: 'pnegcsyhwxcaolxxkpqzipumoezbjzxddzdbu'
ClassName: 'ukzjvzcyfvlrwfjsmousbnlt' WindowName: 'ciebqgkbmkoaynoaygvyubsn'
ClassName: 'futryqougwmpxetdnfydjxycznqbotnux' WindowName: 'qjttlzrdoutoqsbdt'