Trojan.StartPage.58342

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsd2.tmp\NSISdl.dll
%TEMP%\nsd2.tmp\Math.dll
%TEMP%\nsd2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsd2.tmp\System.dll
%TEMP%\nsd2.tmp\NSISdl.dll
%TEMP%\nsd2.tmp\Math.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'obirfjdsdgtxtxfkzvtvrspwsom' WindowName: 'edywhljgpwzcmbfhsghvujwij'
ClassName: 'lgoeoagbygivcguyofnfhwbubcbsbpbuvt' WindowName: 'tkcbspnczvpoxdpqq'
ClassName: 'zvnrejcoerkddneseozxoyyodpyydqrawaxhw' WindowName: 'ornvdrwekreeyrfvq'
ClassName: 'zdbjsjsjvtfgeqylvirhxqmyevsdbtgrobgoecl' WindowName: 'himepurlbtzasrwwmadzxsbc'
ClassName: 'goxvitekplmlfuzkzgy' WindowName: 'ivvmtkoqkxmrogzgadlgeluxlcbayvyujwtorn'
ClassName: 'nbejetwwnimgdprdarotcfbtrjokjgjzns' WindowName: 'hahizumkqujrdbsxhb'
ClassName: 'cbzyyiwkorukhml' WindowName: 'ubxfjgegpgrxlcyrpm'
ClassName: 'dsnlzvrpkufjwrvoec' WindowName: 'gqefbrbellyyropytgmarvhguvpbfomhdwxezy'
ClassName: 'wmlhbchqtagykhokvgqtplyfawcmgmpwh' WindowName: 'zibnzuwsksimhmiwnqkinphgchuxnqbalujg'
ClassName: 'pvwadbmytfawcrkojukau' WindowName: 'qwgnelaxmjlnicxbkxgcehwozbwfou'
ClassName: 'brjxawiklquryhq' WindowName: 'ntscfwcxqyrocjhv'
ClassName: 'suvtbbelklnzyemvstigouxaxprp' WindowName: 'psdvruhtlyzzgxxsmuhrj'
ClassName: 'ycdknmfeylspbdrooosfqliwqh' WindowName: 'evdvirdkwmmjvrckepavsycf'
ClassName: 'yziprlqrwyujujfzywnyidbysoolttsrcc' WindowName: 'axdhtzndcmkahqrkgrequda'
ClassName: 'jasfsaskdpoifppxhblxvidfxfnoaccvnrug' WindowName: 'keidvokkmszwdcdrkbwa'
ClassName: 'lgjuthumfouohqezdvwgvwrd' WindowName: 'mlhmvhuaytoivsj'
ClassName: 'cwhtotijcwvpgelqg' WindowName: 'nhkvpxvabcmjtvsjndovj'
ClassName: 'nnwxocueqenhbhmrwjuohselfo' WindowName: 'mulkttltnxaaazorexodnbpzevg'
ClassName: 'rohwiyzeqggvtxuyluzbshqdxaoxasvbmodjccp' WindowName: 'bbdhcmdmqnwaqfecusixndsyyolabqdhpqmtjd'
ClassName: 'mkrknjtdlfdyoampcuods' WindowName: 'qjqswvinnqhgtsoq'
ClassName: 'dhrgxdwbgyvkdsgima' WindowName: 'rbaabakqxflpritlewvgqs'
ClassName: 'dvzeftingswiyqrkoggpebrblpb' WindowName: 'rzspdoihupbtsvaeevhbvroazixne'
ClassName: 'hzvvsljfwlzlbkzahhkrprqpjjhxtslsbvw' WindowName: 'qqqedqnovszxhbwvytpmevynocnkflphyw'
ClassName: 'gzsjjfnpqgqkumgdharofrgejyatjffmnsvfn' WindowName: 'fjoqgydwkixejttgjjdufetwwbtlynkuiouzyd'
ClassName: 'vphxrmmxwlqubuzbwddx' WindowName: 'jgoipfddohbtxlittcew'
ClassName: 'qberzpjzbhgkoldbsmkaxxtfydtidzebezvmtgw' WindowName: 'knrwnhnmtjizidjyjwoeszdd'
ClassName: 'rxalrdtkvcrokwyncwranojlqujl' WindowName: 'tofdbjnzdjwnytjbrbmmebfznq'
ClassName: 'vblrntqpejtlijvodqzwng' WindowName: 'xbrqwbobgzvehlicouwgmpko'
ClassName: 'jgkmjsdnlzhpjcifjvvaertdggakduf' WindowName: 'gjbvxfxnbftfaaewgbypbiymqrqrxgevabf'
ClassName: 'bxeeneyoxmqndbciuavehor' WindowName: 'nnwlvnkohbcjnejcqkwmhrpclcwirfaade'
ClassName: 'vvngyzqymshvvhlssfumb' WindowName: 'jjisfaejfrmucgfvmf'
ClassName: 'hrwgtmpiwabksbicliprwlkzltusnxcc' WindowName: 'sypbdjqelprcthnumgejpklxpajkgtmr'
ClassName: 'faclspszajzqmugaolrvirdbujnapnlxhzf' WindowName: 'fbzowuthlzkzsyypzqdjermb'
ClassName: 'rbxvfmpvoyxenqfdqgn' WindowName: 'qsjturwdouhcsiiumdfejkuhcvn'
ClassName: 'ndfmmvujdtbkijspyqibevovxikvtbv' WindowName: 'yrmuoqlxcmdctqstbuykpdytuvrezxuftjkh'
ClassName: 'udpvojootrduebp' WindowName: 'qaobhuszlnzzkamabhrwsgjfddpaw'
ClassName: 'iehiqqennvyhwdmfdomtaca' WindowName: 'yqtjuhiydrnsmapgdevdztetfzwjwdlkfgmx'
ClassName: 'ummxohpbfjycpsbjn' WindowName: 'llmyklgfvkblcfpntirxxbtklre'
ClassName: 'gqayrutmsqbtcnlmpbp' WindowName: 'zrnuvhdnvjggofvzhbifmx'
ClassName: 'jjatfjxnstjuciqu' WindowName: 'oiuujwzoqdpaqdgxumprxvmsmbgfcvibdhpp'
ClassName: 'pcqwfdtczhxgiwdjb' WindowName: 'devmikrrshyicexplkhezi'
ClassName: 'bsvhnlyjcwzdjytamlqfghprytupatuolqiiohw' WindowName: 'qimqwndcimaldcnfpagqsryjscfsposghjzbc'
ClassName: 'xocpraiqqpujkaczd' WindowName: 'htfgdthohiecmclejwdxm'
ClassName: 'frbuezlyfnofnguuijzvbawjlsvel' WindowName: 'rzbxppausnqznsa'
ClassName: 'nuevwoieltlnpalqzcvlhlhhoiovycxfrg' WindowName: 'jgkmznifywzojqweixzt'
ClassName: 'evyxtfkthdpqiesevwcsfhvcywjhawhl' WindowName: 'atxseuxzjthqyicsmfvwxt'
ClassName: 'czlqqrdqkaedwekqt' WindowName: 'wxjteuhtqcoxjzkprk'
ClassName: 'pcznywpyqknkyuneozjdydeiyrxpehbjzj' WindowName: 'ezubocjjchwkmvqwdvxjqrtqjol'