Trojan.StartPage.59469

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsr2.tmp\NSISdl.dll
%TEMP%\nsr2.tmp\Math.dll
%TEMP%\nsr2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\NSISdl.dll
%TEMP%\nsr2.tmp\Math.dll

Сетевая активность:

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'gefhcjdjtqruvnlxhuvyysiuxalkhbxkvnje' WindowName: 'kvwtabiwsupgnaqw'
ClassName: 'efandsroxqvuofgxfphefczze' WindowName: 'ewcozwopgkpfhebp'
ClassName: 'eshrdjsegvqnaiygddgw' WindowName: 'inbtzjgvujcrsurxljfwomvzp'
ClassName: 'tgizvbhcdsftexjulaecxkfosbobgbg' WindowName: 'stztuwyrhaaaqttnfwvobhkmqguhuoxlgsfwupb'
ClassName: 'hpkwizoamnahtihgcqfhgbqggjrchfhfow' WindowName: 'dlvqsknvyqdbwlqhtdqvuyyvavxnqht'
ClassName: 'ueeuuslqvzxfctwnsdqbvtvepnbqtqmfnfex' WindowName: 'syihupapbttaoeuikvltuykryinmapfkhlvoqud'
ClassName: 'hpwfqmacfkwtipodfkobtmzbqdlnsijkteaqv' WindowName: 'uxxliiinahtmarow'
ClassName: 'nhywgmyotrhmpgvjapwcfkbrazqsntncfsw' WindowName: 'ranxdwwbkutckeyvpsfvf'
ClassName: 'kjxgwsyrqvupjregwsjlemowd' WindowName: 'ssfkcfswqxaembtnsrwzcaftuguvjymour'
ClassName: 'vtojdndqsthindrkprpjuivzcnphdqkeicndn' WindowName: 'fqmiorvbqmcgnfvgoazpfjvxipie'
ClassName: 'pbmoabdjmcoaylwiiaxmsuzp' WindowName: 'lqqtdsgnvskkbpggojplwuoauuqcrmetgtq'
ClassName: 'homucfplkghifloeghrztvupffea' WindowName: 'jrqtoehltcfqfiqvoipxgslcfiktidzambxdvwa'
ClassName: 'vfmcwxiovwgzsdvplzbpjdg' WindowName: 'riuanqhttqnalqdqjnejiycrnssaxbhbxtr'
ClassName: 'xwzssnvcnohadlklicondfgthcmuadozk' WindowName: 'ovtrdisvuzdlwcxheyggxsgyogosjzlqfbuttst'
ClassName: 'wnctksvsdgkcpcgdv' WindowName: 'udgwtarucsznuxdmaqucrptgcziio'
ClassName: 'tgsqdklcjaizjlsh' WindowName: 'zwykwsgrsexcjzjxolp'
ClassName: 'bqhukmswlbkjmhjmcjcjokaydlhviv' WindowName: 'zuabpztuodcrwmnvoxbcojxgmjs'
ClassName: 'wmjizvvuxvqpibnhhajgopdigdo' WindowName: 'zboemxjgomddsmtztojit'
ClassName: 'dmyrzicsdtpiiji' WindowName: 'zylhwxwxyqslsmvjnunnomb'
ClassName: 'gaxnzfbbzxoxycablein' WindowName: 'jjwkfgpwwsiwgzvaubgxljohdwleftelu'
ClassName: 'xglzlbajkuhmxxbilgzfsxmytblckbelswvlclt' WindowName: 'txeqlzhedexrajkjjktqzpcdb'
ClassName: 'jxbsukgkysvgyfkivbzjhqvvkilms' WindowName: 'qzqmlgqozofoshqsyelcebqolzj'
ClassName: 'qeingocqxtbiyrksetlztcuzdbderr' WindowName: 'opvekcltncygpghysmmgijt'
ClassName: 'bkdxmxzkbhhocnjuxedsbjhnrwiniurlalvjksg' WindowName: 'zkzlxjhgeejtoeftchlzvrydazf'
ClassName: 'oawudoaihdkuzvwlukrzvqmibyjb' WindowName: 'pspqumkztvxgvjaysmxfmtayzwskiushtqpqgjv'
ClassName: 'baztpqugnqhdqfbcomnxojpqlfvpunxaw' WindowName: 'cjxputbuomckxbdtxvnirpzoplkarubqpeyzdu'
ClassName: 'zcyreinypjdfrzcfbkfzyjwljeaz' WindowName: 'poyyjqlhrgjbmtazgc'
ClassName: 'gvcwokoteregjovfrpzekxxxjxaqnhoxusn' WindowName: 'ydyizmfuykoaykibohiudpsgtzmlihwkzzyv'
ClassName: 'kxzowcoisbnzniu' WindowName: 'stgdrwryqzcbjgskilrr'
ClassName: 'amfgmfcyhgonljvjocaryhgtfdfawqft' WindowName: 'ussfisgcjiokerbdotem'
ClassName: 'ekfszkzzbctpcbbggyu' WindowName: 'oqddxmkrsbemyqwsqandy'
ClassName: 'jnqavxcqdzpaolekt' WindowName: 'nhgmaljggjfyfxadfeusphdojsflwhattfs'
ClassName: 'odnmbosmtlufeyzm' WindowName: 'hrpyqeapabloaqxzqvhblrf'
ClassName: 'zmyitzgcwgorivrwmyjhdkpqgooeadkrgj' WindowName: 'teojlvinxmizukiykkzpychto'
ClassName: 'wvdtpiqbtdyystjxofjoascmflxzmqsjvmejp' WindowName: 'fyidgglliiltzagzelcwibkdvk'
ClassName: 'plqbrgdnecigughplkbyu' WindowName: 'attmfcjlcqrjoennyzkp'
ClassName: 'xuprnfkkirqwgauga' WindowName: 'utjoogwwktvboqabkraghpfsbouddnp'
ClassName: 'npairkkpkwuqybfnzgecxzrqoumqznrocwe' WindowName: 'mthqwjzlbugmzrdunqiia'
ClassName: 'bzxythfercdsqnlhkvzqvndeiydpnuzdmptuxw' WindowName: 'uwrpnxtsnmbezwaz'
ClassName: 'pwaosqwjsfiisjxnivhjzjesu' WindowName: 'ckfupxscgkzftacehfcpfh'
ClassName: 'zgfagmhijemvtjcmwupdtsiha' WindowName: 'cpquadkmpssrbvpiepl'
ClassName: 'bjyakdwwjuddjpbjpc' WindowName: 'jfywndnduorpidhxxrsaepbhkqadw'