Trojan.StartPage.58185

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsg2.tmp\InetLoad.dll
%TEMP%\nsg2.tmp\Math.dll
%TEMP%\nsg2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsg2.tmp\System.dll
%TEMP%\nsg2.tmp\Math.dll
%TEMP%\nsg2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'qfkjhgtguashnigeypdp' WindowName: 'uflvoecqdbueevavirojojismympdiflxkihvj'
ClassName: 'vhopsupcopkytxsdwdqnfudlkmhjfox' WindowName: 'jmkokebfypbmjboaldmmvlblvjjsakakwg'
ClassName: 'rexndfxerfuhkvc' WindowName: 'tlgtghctxhlgplspqijuhdsxnpvpgxntvk'
ClassName: 'haqvgtdtoenotenlamti' WindowName: 'aqywknilntetxwisvuokkupmvlxmlv'
ClassName: 'nearbctlavgncqyjsculjivwekxzgvtvl' WindowName: 'avxcurveuyrqicafmpaerrxfsxck'
ClassName: 'lqtdqnimfwkdlkbdzqetsjdvyqyso' WindowName: 'dcigcpdqwdagfrccsglrhazxvov'
ClassName: 'ytcradygnyiptbohyn' WindowName: 'qrjnufuccjwjekwmbrwuvozzdtybmmcgsrd'
ClassName: 'xkwqwqllwnijjqpwk' WindowName: 'tcgyjchnvlcvjjrbggtepbpzcvjgonsmphgcdtn'
ClassName: 'dvhihukhijqaboseleaf' WindowName: 'wmucrhcqzjhoauupsuyrpmgjsrcjxsprdvt'
ClassName: 'hqoxggoarfzhnowponbvhxohhfayfovnpybdu' WindowName: 'uafqisgcxtvnnkdbsuqbg'
ClassName: 'ixyzbscojyisvmkireoihrgvnumjenizd' WindowName: 'merxiqncerkitkentosollkhfjmlygxnjtsu'
ClassName: 'haytxumpeymnipkiwfkmshezqmanl' WindowName: 'bylopkdxkwxhiugyah'
ClassName: 'gaztyjcxklnyyuncaluphpi' WindowName: 'pafoejntsrhdjbsghaljygxqglhtj'
ClassName: 'cnhqgcrmjjvkesbapbs' WindowName: 'imrnkekojfvyocqfiscslpfncynexj'
ClassName: 'piotawmwbeeeticr' WindowName: 'zklxpamlswjcskjeeioxjjnjpwemhwxbgzl'
ClassName: 'ejnelzppynjyduqa' WindowName: 'levyxizsrnwzaexrigkvxjrrmltu'
ClassName: 'fgqrlocesafhiopfyxxje' WindowName: 'fqebjmsvutpczdpudwcjdgoyyg'
ClassName: 'xfqyxubqeuaonilyyspgijpdvlwzmkrawcpp' WindowName: 'zbfjhhleapjxhmwwqktsvvwllyigsfwmog'
ClassName: 'hufvyfmbxnxyjjvouuzvmxlxnq' WindowName: 'uhklofzybaeydqgjsdefcjndtnbywvsiu'
ClassName: 'vaaamjcqgwgcyvvxdvifwjfgly' WindowName: 'gvvspidrdzqtgdn'
ClassName: 'ytqiqmspnzotzxovjndemnrenxcw' WindowName: 'sgfpifeksffcmlwff'
ClassName: 'opelqiumncixoluiqexgjhxpluxdnzznqwfaxlt' WindowName: 'tohdrigauvuxguvqgjjqnypgqq'
ClassName: 'fscpwstprwgtfybygjdxlavcomysnxcz' WindowName: 'vqqrgkunhejcraxilcdttoegdu'
ClassName: 'wfzirgophtuatuctqthuwhmllqabomjq' WindowName: 'eflzcfvmgnvnfojxmuisrzbyne'
ClassName: 'zjzyhcwrkafdmpwmxoudzafxfoxa' WindowName: 'jstrmatyeexwfqehemieqxuyyjqo'
ClassName: 'ljvhlaamqjzmywqmare' WindowName: 'hcymzxrvnfcdqytaoloocmalu'
ClassName: 'htgnygcwbkurxdbatz' WindowName: 'jacwdwoohbwxyujylbecixssdaromyqjshorvkx'
ClassName: 'xfytmdbnvsaevkepzh' WindowName: 'oxwgsaiuqdercdvaqviikkxluxnkcnjz'
ClassName: 'xndtqamqdaeoskddhmssphhddsucypznasqee' WindowName: 'fojutocoykbqqhotbryfzykjisppowikmvvgj'
ClassName: 'ddvhvgxkrodbnzmjpnxezk' WindowName: 'gpkvtuudsmsgpfq'
ClassName: 'tujattzfqzdyxnfrelufefyw' WindowName: 'qvyoehaegtqkvuczfvlkxlmfgpnatwhgszds'
ClassName: 'dkkrihaxjovenvtikxuxnaqro' WindowName: 'paauofbmsbdmcbdkuclztnfyppmaoqmnnlhryv'
ClassName: 'hobsayhnvfftfgdsqzltinvt' WindowName: 'eborjacyguzopiy'
ClassName: 'fvffrryodpohpbhzrqr' WindowName: 'itlyjjuweaquhyocmsushczqfcdfxtfevyjxbvl'
ClassName: 'tdgbfkclxmvnverrvyorghdkwrlghwxxyc' WindowName: 'axthmqxeiknvfbqresbkacmdnszokg'
ClassName: 'smmipuxkobapvslptvlpprfanmsyrxnsmhxvebs' WindowName: 'wnmhracgnjkscnrewpccsesvlrxolhcdpnv'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'qlcceasacskeolvfylzjiqnjltdkojrle' WindowName: 'jkbttssryuxhtrpswwyrptxucvwhtan'
ClassName: 'bqkclatjxqtnwix' WindowName: 'jnhbeqxteevfqqrhymplwefwqs'
ClassName: 'hsfnhvqdjboseeiqil' WindowName: 'xvhjnlawdqngnjvhpgozwjlizpyhcblkrchm'
ClassName: 'suzypfgqhoguokitsbqogvxismqfbboucgv' WindowName: 'aihgqsoyjookxxsevkrgxkyezje'
ClassName: 'istdayuvohncjmwhgmdldkrixoykuezy' WindowName: 'iujdfqkqcdlctqetvun'
ClassName: 'ajknsnrlgacmennjstvdgfcigezpnknl' WindowName: 'vxptplexefoeooabggtxrqxehtakc'
ClassName: 'rgypjgzdpaouvflyejrtlwaz' WindowName: 'xfzvbstmazwlgrkqbxvjokcvr'
ClassName: 'lkdusyrizognwgn' WindowName: 'pprjxlzszdngasyscsyjijnpotqif'
ClassName: 'uorcxcbmoyxpicrxdxdoabxtmprb' WindowName: 'vxsaqtmlomugclwtrx'