Trojan.StartPage.58192

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsg2.tmp\NSISdl.dll
%TEMP%\nsg2.tmp\Math.dll
%TEMP%\nsg2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsg2.tmp\System.dll
%TEMP%\nsg2.tmp\NSISdl.dll
%TEMP%\nsg2.tmp\Math.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'qqjvrmnlagwnqpqepqtccobqlcbtojfle' WindowName: 'chbdonkmmtnigqxmbudqaalghjmnqtvpwf'
ClassName: 'okajmrxdbgnwhlbgicq' WindowName: 'ntzwdgggtaulrtlvmpjsnyojxrcwz'
ClassName: 'gcgowkwqnzyanxvvdwjsmmobpvqsb' WindowName: 'uzwvtjkzylczxmbbwajlikcjcwyyjejohcwuu'
ClassName: 'ahoslolyndaefxjymvfesquavabyzgr' WindowName: 'msfpqzfamjbdrhwqwny'
ClassName: 'ghjhlhkavmrnqavwn' WindowName: 'nmrpnahmjgxzulnlptqmsxdxnblmjus'
ClassName: 'jwrekeidqnjiiefqv' WindowName: 'tsfrmbibskloznhesygytcaaxoctwnvmo'
ClassName: 'zcmdkrolaqyyzmjqlrmqkgt' WindowName: 'mliiykchqknknjq'
ClassName: 'ltjfgedhgnhcaimn' WindowName: 'tfhhqxjctseebvmuljgpd'
ClassName: 'tvguzhrnawebnodfzqevxhtpluppivvpobr' WindowName: 'dhflgamrpefdslhymiwkobgtmwmky'
ClassName: 'moguoduxepnjbqvesmcntftkasfmkwo' WindowName: 'nuiorgadipfeetjodfsinavynusdonlzxdcyjp'
ClassName: 'injufmthebrzcmqdg' WindowName: 'umwrjwleuehesehxnivnasoshedkrcfyeyqmr'
ClassName: 'obstxvkywowovfrpqbmvwkhsekcbxhzus' WindowName: 'lcrwomuuwrspvsdfkgwervg'
ClassName: 'uzckjxjvxcpxfafosywpacccbeixpvwrtul' WindowName: 'quluqntzbmixjpeuadjfloxankhuk'
ClassName: 'xzpwfvtaxjccbmvoe' WindowName: 'abkdoczcvnkxrze'
ClassName: 'kqaagrhrkvaotwjaauqpuxboxyh' WindowName: 'rhpjlouirwpoosfsfqhnwj'
ClassName: 'wxsufvpbiizquwdswgdjfsfggjsn' WindowName: 'pwcglbrvmbykekoatqspjthqsetciczeatjf'
ClassName: 'lsvvdmrqvpzcphabobywd' WindowName: 'pktgvcxcqednijgspascglghcqwktvwqzu'
ClassName: 'vmhrddhyjjvrwrtafjvywc' WindowName: 'lyrmocyppjgmizdinptcrlgwj'
ClassName: 'vwplpetdvjzifkghxkultgvfeuwuvqcnuaoeutr' WindowName: 'nvjpdhjsqrscomrwzojgshwzqmqgumsnnlmhffm'
ClassName: 'dymugtuqnrkuxgzmjyyosry' WindowName: 'yuewzfkpzvswapeljezpxtgqlslutpcaxoefsj'
ClassName: 'nfyoluntatvfyjudpij' WindowName: 'czmdyyunqomfiyhfkwvmmiagukycylvjhxjeqvc'
ClassName: 'kqnjzfbmqmurpwty' WindowName: 'bbbxfxwfazxluhrnqxa'
ClassName: 'zdwqvgmhlakfebfhgmzoynzlbkvmuxjvnnrnov' WindowName: 'dmywbjyienhdnifgjjutdszfegxlzrdscuf'
ClassName: 'mygtmibrhdnhifbjukvglcsk' WindowName: 'rzsmlbaegdzvwdnsokbwgdxqfftiufxl'
ClassName: 'vixhjzbcthynlnqcpafedqypzkskkovaen' WindowName: 'imirnjyroilvgehvyafedwfbojkt'
ClassName: 'hdhojdrhatdkwoppbdccclobfj' WindowName: 'hcovbvamoqhadfawejtrqucumhhbdkknbxgq'
ClassName: 'qxqhhdulnokekjyrpjjvovjdpzubn' WindowName: 'ctvdswayjpmzjoxwdg'
ClassName: 'wmtzjjgqujjtupvnfduswsvxibmzssentnty' WindowName: 'fgwzgetfxcpuhowawpm'
ClassName: 'fuvmvioczmlhyihmkljnlhjyhwbgqcffromy' WindowName: 'vamjnfvriimvfexx'
ClassName: 'xtusvudxoykjvjbgx' WindowName: 'wrxuptufinzrhurqrztfagtaqu'
ClassName: 'jekglruhotkwgknzgdmzqidrlzyrhovj' WindowName: 'soyyuxecmqerlhtfuqapokenqoyrfe'
ClassName: 'dlvkkiadebnjzsuvsmflhoysjyqiilulsygoqxo' WindowName: 'pxapzkdshsknxsljalshs'
ClassName: 'spncakbxdphtgwcshsjgrcpf' WindowName: 'jmzxpdabrbzaambsbketjdgjyrmycdoynnjpn'
ClassName: 'cnxadezwlwqtrzvhynxmojhcedbvby' WindowName: 'usjglbztraqeaaesirsw'
ClassName: 'bbhgyykoiimubhm' WindowName: 'jkkrqzavqdqdmfsgyjars'
ClassName: 'tldohbnhxjfcfsl' WindowName: 'tvexdheijcemuehuopqykolsvifnckkxfuwa'
ClassName: 'tfnldbfqbnhirrs' WindowName: 'rdchxxdewneceoroxmuzocpq'
ClassName: 'ljszkptkunupujeydeldfukkqzmpumyyeujvwg' WindowName: 'sxukecjisuthtvlrdy'
ClassName: 'knotipegehpwcfkvemgkbdyhnlhvzuygxxkul' WindowName: 'fnaxctypwymzdtqxbkhioqtpuxfrcpkirpahj'
ClassName: 'ayytrvppnunsncfloxogwpcnx' WindowName: 'edhqdhcktqgsvsgmuvf'