Trojan.StartPage.58233

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsi2.tmp\NSISdl.dll
%TEMP%\nsi2.tmp\Math.dll
%TEMP%\nsi2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsi2.tmp\System.dll
%TEMP%\nsi2.tmp\NSISdl.dll
%TEMP%\nsi2.tmp\Math.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'eksppljwzphrbxekwyelfxvkdwlqxhmctih' WindowName: 'biilvgjgvqndntkkymcbwnidrrpoql'
ClassName: 'ticyvjkwoeiplsfynkzekzmn' WindowName: 'gevihpcbfxdezlybouuexfyt'
ClassName: 'xqiocevyfmpivfmhzaa' WindowName: 'gggrlhhbbupykghzorsccoagzuvuqzqhdod'
ClassName: 'ittylsahqxtftyyjkrnofuoechwgxseel' WindowName: 'gekiefcljttazqsbakjlgvfhlqui'
ClassName: 'zidqbdsjsksztfzkjjjkh' WindowName: 'mwogepexyjmgjadfumner'
ClassName: 'hiyfdycsqegeqxvitnoufijtqbwqpdqui' WindowName: 'xcpbfutdzenycwiv'
ClassName: 'mygojmsycfscxeqikj' WindowName: 'lbnpcmkisqyrskgxeriqlcsphlhclonpewqg'
ClassName: 'izzhrsifvtnjddrh' WindowName: 'ilqiriuddnumvffllgwrhxf'
ClassName: 'gagudnuxujklaoujawxqsdpuuexuigvumyhgs' WindowName: 'nsdhiuhdzkjkwpqjudslakrnvbivvdjhrc'
ClassName: 'qudffpleqcmqgwvcdjnwmoafhdfzzoexbp' WindowName: 'pgpkdanayxzywqfldij'
ClassName: 'bdxmxhbjabvseiqsomoczijquklmdymwxj' WindowName: 'ubypnrvivflxcquwqnwz'
ClassName: 'gmhsoijgparfcmckqonjsgmbtdatukdvfxdnhts' WindowName: 'bxltsihiucuwobtvwdwetvblxonmvoebap'
ClassName: 'pxqnztucuyjgnpn' WindowName: 'fflkeuifajvzlkf'
ClassName: 'cjqoyeptfficejjbjfukjgafwgzkuesidlztlrq' WindowName: 'jehogiclqcsqtoxivb'
ClassName: 'cgssycwvdlejrgxcvqrmmhbxtjtx' WindowName: 'lalyfpkfucetktjsicprlvjmatxxgwfkw'
ClassName: 'xrssnhgjkzozmkukiyqkkksjbphunsko' WindowName: 'jropibbtqohvlbckbcete'
ClassName: 'dwmnxhpypykwwtgzqextkqudrubykbpturd' WindowName: 'uhwbpatzfntamzwigzfmx'
ClassName: 'twpptwkogbofoozlqoujcyiykrryc' WindowName: 'ygnznhhtzecouftkwlwqdgobfyoxbiw'
ClassName: 'swefgjejitwegbfrwehnghwuwfujpbqonsrv' WindowName: 'orrhtzqtrdohtfgefxgxkkgffh'
ClassName: 'dftucjkjbajjlxq' WindowName: 'asnhbrlsmlwhkzsytzfufchz'
ClassName: 'ujrsbxnwlpgzelkcdfm' WindowName: 'lblfknutnxgiqsllqrrnodadiagsdaglqtdkddq'
ClassName: 'ocgukjnyfzszltablzooiroqeishsdfm' WindowName: 'eyrhgctorgnmsosxdetj'
ClassName: 'vmmfixuxwrcpfvdoh' WindowName: 'geokqeduhcgfwvcziubvaxdjkmx'
ClassName: 'oatslxahxzzijejjyzhsoabzoysyikpzsggpnu' WindowName: 'lguddzdlquoszjddtsculux'
ClassName: 'xjdarumvcxyypgvukrhmqatstyioyoafzuwvth' WindowName: 'eipyiexufajszshfmmbmizzvcqhnbrgfclsnyup'
ClassName: 'pgbpgfgklnckhynbbcmwqaes' WindowName: 'xnggxerwvmrnwuqierdm'
ClassName: 'ysgqoxyslgdzbkjcgjxqvswtvv' WindowName: 'cxpgliytuilkccoudfbesroprydsdywwaxny'
ClassName: 'gliafchvqapuhzmwalyxbybhezc' WindowName: 'ucslbqnmqfgjredojduronqxzczzrjbhqs'
ClassName: 'iyjcuowpvfymrqrpl' WindowName: 'adjrvbdbjjxhbptruaknidokyiiwbl'
ClassName: 'czypltvoszwyeyxkqbciwcrfvc' WindowName: 'aosxpmuyxmjloqpsfideqycuzl'
ClassName: 'dzzsxktiburrysszcdgaca' WindowName: 'aptfclhvuxacqjmdzdiypppfnvvjmlwpok'
ClassName: 'ctmmagpsuxwdaoply' WindowName: 'aeqrscrixkhmfqppjnhxxwvcpttivc'
ClassName: 'slxrcmwluvnrazsj' WindowName: 'yxrrsdxfwkqejrt'
ClassName: 'shkehfmjdrpgrhhicaigmbtk' WindowName: 'ijszvomkkzohrtzutb'
ClassName: 'qauqecpyzoyejvhaflmtuvwji' WindowName: 'uvrjwgfbyeojhfaeouhqpu'
ClassName: 'sicustgctzerwtyjhqqejyv' WindowName: 'orhxwzmtczsofzgzaxkmjwfksrddjqbazryaasx'
ClassName: 'yhushcbuzxhrldqfqaltyjypcisnkbrhwil' WindowName: 'appqyfrdfhstdycizrafhacptvtlsfvenejf'
ClassName: 'bgopkidlvrcwqvbpnhwa' WindowName: 'uuamttqkmqpqdvwi'
ClassName: 'spjmkyjzlxxbozhhimuncuv' WindowName: 'mmrvjuxayitbkcuuerpoab'
ClassName: 'lfbgxifzqygxcdjtodcquhaesqr' WindowName: 'gkawairwhjzxejhn'
ClassName: 'mpybzcgzciszmotccq' WindowName: 'ykmmhbioivumpcvjjxmohqxchyexdzli'
ClassName: 'eahozbzcqukisajnnyvsduazkpzri' WindowName: 'zgqpvjmvypqhaywrpllflplvftekpzrkaq'
ClassName: 'ynkigmibcwlidmvkjlfglachxljumcossm' WindowName: 'cmjbjfutmzmuvhshoupgthzddavwf'
ClassName: 'orpafxtawhdogwgamhjdbeeheyhxnitquo' WindowName: 'huapkqwlkldtnwg'
ClassName: 'wncuxaklkmdnjrvzcwbzdjuj' WindowName: 'ioqdzmdukbvisdnfwhhbdovwiszuwuxqjrxh'