Trojan.StartPage.58439

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsc2.tmp\NSISdl.dll
%TEMP%\nsc2.tmp\Math.dll
%TEMP%\nsc2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\NSISdl.dll
%TEMP%\nsc2.tmp\Math.dll

Сетевая активность:

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'slnlqykbxkxmzdbvdskedupcvhh' WindowName: 'lckjjbpiqmvxonreybvunvwxpgdkrljinpu'
ClassName: 'eiiegiufpxjoidbgrzbvdqjmqrd' WindowName: 'nvhcrkhejqmermamcwfsgxncrkrsvpqvyvr'
ClassName: 'seisplhgepprgabulgu' WindowName: 'lmvmvwfxokwzkxzizhqr'
ClassName: 'grgquglbdifmtgwvyhhcc' WindowName: 'cpdrnrqlzzchamzwxdousuhqxhbqwjro'
ClassName: 'wpxhtbpoqswaepr' WindowName: 'ngjsdvhmjlkptvdlcf'
ClassName: 'pkujskvaybaspezfqxdpdhubjmapyubtbx' WindowName: 'hqktlnlljrtcqystwzmohqrppdhdurlfagolq'
ClassName: 'lenfcmbizxemqmiljesnuumhuaydzjkfqmexe' WindowName: 'kmjglhgcdloqxdmsvdzsdqebixowpngvlo'
ClassName: 'legiugbpwwbsqyrmrmwvoortaeyxbyftk' WindowName: 'foxoihfsiafmlsfwlskqmonmwjjew'
ClassName: 'hqnnatglscrfjpebmpmpdjekotqli' WindowName: 'gqtdapnjmggatltnmdwwkhiw'
ClassName: 'vdcawhzlsxzljqaxiieumroteqovderwaptyyr' WindowName: 'ibfajuqhseyuhdxplcvmurm'
ClassName: 'ggffrwafdmnmawytpsyfwoxjsrrnqapshz' WindowName: 'zsskhygkaitzhyftoxfbtytnqlrtpffmxopx'
ClassName: 'wexsvlrvpwjpzutjdid' WindowName: 'mjpwaxigtuqbntigkvciq'
ClassName: 'wprafhwtsydsxxkltqqmekyxia' WindowName: 'vqmbpdyqwcdzslavtmqaslcbbifah'
ClassName: 'jswginfnyadprnqgtkjvuipfnbehlspwwoi' WindowName: 'bmcqztglqxfnqwbzcitixhdwievbgcjl'
ClassName: 'ohuxlgytdngokggkckyoxzvbihrbsdwhvup' WindowName: 'ebhiimpasquuargmoclcucqisufioafsidnxza'
ClassName: 'rnybjanavesndvt' WindowName: 'evajtojnwnkdjsnsmkxhfvib'
ClassName: 'cqwkazmeiaoawhzkgefulny' WindowName: 'znlgeestvittrrnjsfliwvxzvwkh'
ClassName: 'slzdyeouvltoyep' WindowName: 'tjnfxqlrfggmviqhdzncpvlaqssixhcthxni'
ClassName: 'crmlhtmcepxvqfqbmlnbjaq' WindowName: 'qdvmjtpfsdnmdngeenvhjud'
ClassName: 'elfcphpjphsbuapzghnbgj' WindowName: 'ufblgomibifihczxjosssotrwbifzncdybalc'
ClassName: 'vuxrogmlvcsvnxzofvmsjlvgnwywdovujgbll' WindowName: 'wfklwjdovykuoumea'
ClassName: 'owyotbdlqzasbcivjjkgpixt' WindowName: 'xykyfxkehrkqhjgrdmazddiulwfcbaqwvrtl'
ClassName: 'wgbzrcprbdtvflutjouicmnywjeyhpabuvl' WindowName: 'jansxbuehztrhwqreoavejqf'
ClassName: 'aujcaeyzwrrrryfbjar' WindowName: 'zienfpjfpfvxjkyoktwbpckssjwjuulmkm'
ClassName: 'huyhesynfkluywuljjc' WindowName: 'skxijzozhfrqhwill'
ClassName: 'kcajlnouajypdkuqexeiuxmkgewxmdxrxwi' WindowName: 'nurhbgyjhtqaislyxwrcazzrecp'
ClassName: 'rhywtxbzochydfdnnszwnzxpaonrr' WindowName: 'dbqlvhskddkrkufljzhhuiawfpzmdvdsahzzhad'
ClassName: 'zmgqqioinkxchzpnjrplzkosevsnfdtbtnc' WindowName: 'vehsowadurernucllap'
ClassName: 'zthxifyigbjzfkjvxjdaizbi' WindowName: 'zlemfnwwgsrbuuopl'
ClassName: 'scpxwpaiwjuntjqtftxngb' WindowName: 'mqurthcpjvoaymqkfkifgtrqbroocb'
ClassName: 'pjzkrzvlnjjkeigphmwlrqv' WindowName: 'zkzxugtoozhsbugwlrhcejwkfwbug'
ClassName: 'yygazcjrsytktwoqodchti' WindowName: 'zgxkdluhdvftzxqqigi'
ClassName: 'xovjzajdrxmysjudrxsvszzsaoihogzkwtjk' WindowName: 'psrzyzjdnuxuisinyqsvmxy'
ClassName: 'zgteikzbciziyyxhkphcelmwljf' WindowName: 'kclteqtojxgpbze'
ClassName: 'jbqnfatetarbcmchdf' WindowName: 'ysyqqogeuqlueojzoxqypqkhvnop'
ClassName: 'qirwfyceyjxpxmzobysjmkhqnfcn' WindowName: 'nchxtuabsncylpkowqyeeqeauxt'
ClassName: 'jqbfzafeeiabnlfgwowifvpkuzrgwefihvxg' WindowName: 'qbnhcdarqnevbqcldl'
ClassName: 'hdbqtdjqeeqokqsd' WindowName: 'swhyenzefaokkpeaqmzw'
ClassName: 'cyeydnzoiaymvjfbefjsfmajlv' WindowName: 'pytjgunhvphdpnmlrhyswsfznlnllswp'
ClassName: 'yqogctrruzayrehjww' WindowName: 'pqzizumhbszzlhcgmsmpetdgro'
ClassName: 'htffsylkwdyvwylqd' WindowName: 'wwgrbecqfnfkgpqva'
ClassName: 'ecqzbodqcywbijgtnipzbhrpnaxbvwkqretz' WindowName: 'ceyhgguxvhiflojtoihsnohechawnltskdqdpfi'
ClassName: 'pjmseacwznnuktsamokhtgcpjao' WindowName: 'bwohxxxltbsgcperj'