Trojan.StartPage.59145

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsl2.tmp\NSISdl.dll
%TEMP%\nsl2.tmp\Math.dll
%TEMP%\nsl2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsl2.tmp\System.dll
%TEMP%\nsl2.tmp\NSISdl.dll
%TEMP%\nsl2.tmp\Math.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'lldcrwusjgvxnbsjknbaiqeljt' WindowName: 'nllkrrzegqeioovv'
ClassName: 'tmdtswnrrnelwsoiopgxupmvxtmaxph' WindowName: 'uanvbixeaombojrayg'
ClassName: 'ndgbekgrcwgbzhkvdradoquhoyunqvnspyc' WindowName: 'atathwokorfhmof'
ClassName: 'qvtsugazvaqlxiqdudeo' WindowName: 'wvlcnsnesoubpiwxgfgyrsfgyhqac'
ClassName: 'qipqruxotpfmdoddvlxxdleeoyxqaibcg' WindowName: 'gfojcbydztowmweyvbnaaema'
ClassName: 'tsodytfljoztqnuslpvxcfiemwclxmxbvo' WindowName: 'ugpsaeozllhkvihhffveus'
ClassName: 'drknntexchvugerrupawtxbjtmhue' WindowName: 'ftcrpnwwhwcftdey'
ClassName: 'jfroyrhsozxgsfrvhtpgahmi' WindowName: 'jidhikomjoyvsrgsviyehns'
ClassName: 'hctymoiumjgckteqsllrjpmrhdvopye' WindowName: 'rmuajgzpcrhtbqipnrgxkjtwtbqgawkvytshok'
ClassName: 'kfgdxduqhuapciysobziiqqmykeqh' WindowName: 'osnldgqrehryfhxplerubcfihwwq'
ClassName: 'aaajhroxxkcijjjeeklktqvpwpyvbusqokr' WindowName: 'emyvqtropyxnijazabio'
ClassName: 'ayeiiyfumjunwwpldachxnwrk' WindowName: 'itgylynnolxtrpdssldpjlmkativnrlnsmuzmm'
ClassName: 'mxtahwoklfzjbairylzqhsstlxmyhykil' WindowName: 'jbsqwjlgzaptxjedhoslficavzfgsygzhn'
ClassName: 'lhvfurkwgtoeokftxaf' WindowName: 'rnfkrzodrwtunpmevdtwku'
ClassName: 'uqfjeqsfwscdrix' WindowName: 'awjkktsopcbmbhjkzsnpearj'
ClassName: 'fxgvjooufvyegwjxvijtetsbo' WindowName: 'ituxwyglgcmdmzyacdynacx'
ClassName: 'utqcayhfvyvfpge' WindowName: 'zanwqmykqwvmndrvvwf'
ClassName: 'jjizgngfznycaxxsuqg' WindowName: 'ssmydaemocidlyz'
ClassName: 'pkbocgfzxsilbfhbiefkboxssrrwvdvsw' WindowName: 'nlmbnyagpzbhcmubxngthamcwesbxy'
ClassName: 'kiulyokxxncxeeyp' WindowName: 'mhenxpfanaluanwffhavecpf'
ClassName: 'teojtwdqnsgjrqwfaspexg' WindowName: 'gnqsevhwwebtvemqjhdmtslx'
ClassName: 'ivmpiinybstczubusqidgso' WindowName: 'nigrxkuzfnbhcaqyvhygmhszgiexl'
ClassName: 'zwsioqixcgngufekctisjjuprojhzajgpwlhav' WindowName: 'rufnmvrtbadspmhpdda'
ClassName: 'kbzytbbupdiymafuknbk' WindowName: 'sagqsfywejzcodpelcsmllzhbfrkyh'
ClassName: 'tbpjmuzkwlbsaeqjxosvezdxoqympuckkdfqhi' WindowName: 'snupzpqjjzdqgridkhgbepk'
ClassName: 'rcqmhawwpvoztfigqyua' WindowName: 'xxyubngnrhdaqqnkzjrldeohyzuycfxzfaucyea'
ClassName: 'sgfzoujeeiqgwcsspqnx' WindowName: 'jpefirzodkwoibfzg'
ClassName: 'aimkvgfxtxneaopijnzmdioylsnke' WindowName: 'fajcbmafhgbugaehqkifzgyzdofooruhuwxw'
ClassName: 'mxtarwizaevdgxizuarkwxlml' WindowName: 'ileodsqpiilwxvusj'
ClassName: 'ulwmwmpslsrbtamdksoflw' WindowName: 'jbidcxaqnhwodgfuuopvlcuehblpgawb'
ClassName: 'lyqnstjdysdqnfnriiascktphajvudrdccs' WindowName: 'hadnzbmmelarztyy'
ClassName: 'cchmjcdecfehxhzuftjylscmcskkkxcjjcnm' WindowName: 'niifarxxypwrtydezavrdbrrprgdtpxqvvi'
ClassName: 'juejqzhwcnpzhlvgxznnc' WindowName: 'xaybhmxwewuoixpenbkqtswjnmszncokdsugltm'
ClassName: 'xbpflscajlgqprvrzlxqgwxtzhg' WindowName: 'fzngmmjzmpviojbfamwdlch'
ClassName: 'kdruhmwtqdfizqkppbalqckinoaqml' WindowName: 'pecrjmbbyanjsqorposrvfdzpkaxjgn'
ClassName: 'afzmmhehgtshpesndptmqbgilfyvlodojhec' WindowName: 'czhgvzlyacaskobcy'
ClassName: 'wgedtnmzqhvcphxylcrtgxzj' WindowName: 'etfjjavikaqbscyms'
ClassName: 'gznklrgfloxbzbjfigvlv' WindowName: 'osgcjostxzyvrxqqisnaedpodtk'
ClassName: 'niznxjcyacjchhyqhimezwlmjknqw' WindowName: 'eqomvrtveatlqoewtqkig'
ClassName: 'sjvmbgklvnckmdzekwtaxagnvfmgbarcdgiy' WindowName: 'yhzxcyexchnphdpjyfkvxcffgqgqfflmsmbvohq'
ClassName: 'swkkfrausqgpoyskudxybyzieionghimsnwdio' WindowName: 'yzofxvjoomuonuhbosfyijnfnspjgkqctblkm'