Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsv2.tmp\InetLoad.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsv2.tmp\System.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'glrebypokyxgjvajsuobdbhyivultdzqancm' WindowName: 'cbdhhuevjqiqvoggbfygnocwyzuwy'
- ClassName: 'lphpkozaltjeefzegmiawdshq' WindowName: 'afhbicgyqsddvvgnaomwrl'
- ClassName: 'nthyzfmwikywegovxhplscdhtnltdit' WindowName: 'fqrwckzpkbfstudegxsy'
- ClassName: 'dsakbcxkxvavsalpdcfxdwlnel' WindowName: 'ypthekpgsjnitygfbequxtglqbrvpr'
- ClassName: 'jezobozodnbtwvaqwjstbyrcezcrxp' WindowName: 'wzvnrqgxcgdpmqudonzhligvmdsygc'
- ClassName: 'gpgkhsuywvujrdayqmroovu' WindowName: 'hhrxclkwtwwzswsu'
- ClassName: 'kslpckvujckyoyfmllskaeeore' WindowName: 'zvoxhzqpyileecvrhtcoqcfjjlwso'
- ClassName: 'tfiulfpstvouwxdpzbnmrhbasemjoom' WindowName: 'adobqlljvcqyavapvrgdnosodp'
- ClassName: 'mtuepsgxdjmtmhygndqajzdpcae' WindowName: 'esfdqvkvrfncccjvgiipkdfquuyjbfmcynlusou'
- ClassName: 'husycmgmbvvexdmaycazfdmfjkmq' WindowName: 'tyrqgezduxaxzjfbknfoeyphdqfweqff'
- ClassName: 'ouppcafjlxfvwkdqsbw' WindowName: 'czyndstoybzgriphojrruguuriqgfrifcxenee'
- ClassName: 'bkpfkndqierynbfluzpqvqqkjfwdhojzxsf' WindowName: 'wjkgdlcgxevylirftmavjaydyhlaa'
- ClassName: 'gjmzcrjrhfdrmbprxcwtsrwcki' WindowName: 'bhoagbtlsjejthhtogsxqfyadr'
- ClassName: 'kewjtnwotzntusgvgnniqwkvqdgqerohqj' WindowName: 'kdmfuuzouttummohywzdwnqnjgrbjrk'
- ClassName: 'umlpikrmuuticxralbwqrgfiodcuguccy' WindowName: 'apiqrzkuovzyxclhhijhzwi'
- ClassName: 'tsmkcefzaolweupjsatjeo' WindowName: 'srxhmsdjembcrxqbfnefseuzbzfdnbedcaax'
- ClassName: 'wshassemanecxhqxdjlhsgzqx' WindowName: 'zguzucoifzjgutanugdbj'
- ClassName: 'kgenaoaacixyoderxegzqgf' WindowName: 'ymavuakacqxhifrlgklq'
- ClassName: 'lyjukspbwbznuhumhxhmcksuygfn' WindowName: 'spmffqggjgwekgppvcftptbgxargkpwxstgn'
- ClassName: 'gvagtllnyfskfukxjuhjudnhomdhdexdpqxivtz' WindowName: 'tzaupdckzeowbynybnvrjfxedv'
- ClassName: 'ffqgbztwqdsehkephzocdcwksxab' WindowName: 'fabkcvmwlrahzpaacfzddrpgljebflw'
- ClassName: 'nugckocmjvrhpgjatmvhw' WindowName: 'ufaundjlytllsbdctyrhstdhwfniaibcmegb'
- ClassName: 'gfenaiossmvaqrfjvozwfipmtzmebripwlzmgz' WindowName: 'oahewyuctbqilmuf'
- ClassName: 'xjzqdajgcxiuzeswwrnqnbusv' WindowName: 'vljvrfrjgohhndsmtasgotmnmqtxgpa'
- ClassName: 'umieldsffksghrrvpqs' WindowName: 'abqkeyvxfcimpfpybegoxtrpfdsec'
- ClassName: 'etzkczgkgywqphmnmiqpffw' WindowName: 'cabdylguoqsautzqivvvbslsposx'
- ClassName: 'soyqsurxwfhihzcambzkqp' WindowName: 'izzvkhjvfplnkimhqvraektddkpchompkusv'
- ClassName: 'ocnpxzmslxpfblrle' WindowName: 'tznvqsecbpbzspc'
- ClassName: 'mxbpbfrsaiysqczydohq' WindowName: 'uzeztcvgslrzqydrwnjxpatafssxeevil'
- ClassName: 'qufclcnjywoxzsaercguiejda' WindowName: 'rrvffxtvjtbynpixpsjmxkbqmhvdp'
- ClassName: 'rrdhvryoalbrsqvyehlgiysth' WindowName: 'vubslwjimzqodrbkdyxnlwmgzsrbli'
- ClassName: 'robvurgyjzvwkhpodpoxzqfgj' WindowName: 'aigwalrobewzedsbkfofbh'
- ClassName: 'edixuwawvfkqkxiaufudbcvlxthvgf' WindowName: 'pkrpihuzyiyrndzeovhcah'
- ClassName: 'lfqkasilkvodihmn' WindowName: 'dxscugxhzjicwtnrstqhhsrxaxqxkut'
- ClassName: 'vwxfdeglrswofrjqklrwdyejvp' WindowName: 'dryovnstxhtdzltvgvlmxxjwog'
- ClassName: 'abdemwemktspufybmeyitsljrqomwnmuzkjc' WindowName: 'hagrgfqdfgjgrcrjhhrvp'
- ClassName: 'vulvlwxlmzhcsqmpekhhjocxksphyssc' WindowName: 'ezhpbrtkzzdttgtxttzh'
- ClassName: 'mmatjjiqkrjbpenxpeflgjdpeqwhqexr' WindowName: 'ovrypvjsqobyvrxqbaodonjdfxyp'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'lvxcfyszjzvvgkkcqwghutxlwlqapyjunasw' WindowName: 'igukmrqanoexiycvmlgyuwrtdvbaffoztteph'
