Trojan.StartPage.58457

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsy2.tmp\InetLoad.dll
%TEMP%\nsy2.tmp\Math.dll
%TEMP%\nsy2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsy2.tmp\System.dll
%TEMP%\nsy2.tmp\Math.dll
%TEMP%\nsy2.tmp\InetLoad.dll

Сетевая активность:

UDP:

DNS ASK bi##.#antule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'nsrofwncktywiuqyhporwxmskjvd' WindowName: 'ytmnejcsturvhvfhpbbkwgvkm'
ClassName: 'tcccpxyzphazkdsjqofh' WindowName: 'jijonpsbbpvvmhpgeo'
ClassName: 'jxaksfvwbgzudnagqquwidbmumyiamavyvnjp' WindowName: 'dsldtmlcqngebxwardfnvbrberpb'
ClassName: 'vvdsgkxttbhasygqcucaofvoyvzszmsxtvoef' WindowName: 'qvjfweisrmukhhaehchqduurjabotorcido'
ClassName: 'nyyiityvjfqcqcxsdtrvjjcrwunysh' WindowName: 'jgeacpxdmwudayixbasfednxqk'
ClassName: 'tyulxjzouikgweqkoszx' WindowName: 'xvgerfxnndhpameffspqugyekd'
ClassName: 'mxwkbjfknmgvmfw' WindowName: 'mdkllubiucquwvlmilyxgdrrsdgnsqopwosoybz'
ClassName: 'ktkamahoedtadnpuwqyar' WindowName: 'drgtpegyutcagldtyblbot'
ClassName: 'dnkonnkkfrzlcmaxtkn' WindowName: 'lzovhzdmgiayeeswfasehqfkuctvvaiurlda'
ClassName: 'daavskwdmndngzhqqwfawwbcklt' WindowName: 'ltbgtlbmqckpsuuwsknbwnjphoisfnsk'
ClassName: 'ajeujkmwgqmbirccmkwektssoaadlqwkrqtygz' WindowName: 'stlnulimqeycbeibom'
ClassName: 'qpatvomexvbfzdcqnulmnmjismwwqsubksch' WindowName: 'nreefgvuoymupkvtjrxnvvizjva'
ClassName: 'sqxtvychpchgbepvrxikfoumelrsuwkylsphkaw' WindowName: 'eqjnstbqfmdccqussumkm'
ClassName: 'dkpifzivgkmnvxehmdkkvsatnto' WindowName: 'iahwegpdpfhhrirkmbglpgtllhntsslznkg'
ClassName: 'wrrslzwzpszplpf' WindowName: 'ebumdysznbuekozfxmavezmo'
ClassName: 'ktvwnhpxwjbjoyuliqe' WindowName: 'xvjgfxftazusnpmwahpvwjaqmsrl'
ClassName: 'uajbntbxajehaacbgej' WindowName: 'ehwijpucwvpdvmqybcqfabkr'
ClassName: 'coqilkivfpvbyngbdodrzpqukzqtwvhcbci' WindowName: 'laqbttsbwwogtmvhqjdqe'
ClassName: 'rytppdaqrlehmiyehtsrbcffqiuqpwytaf' WindowName: 'ygcnlfqhpwzufvodzqeaof'
ClassName: 'hcrrramjyftmpaxwtspst' WindowName: 'kzrhzrbaqjwiadrcwwcrjqzjszjlueul'
ClassName: 'divhzxaowdmiwmc' WindowName: 'tszfghqpepbefyhqjstywx'
ClassName: 'ndaeekioefffudggbewxbcupxa' WindowName: 'aursozbzhrxsapakgegriqbnscjof'
ClassName: 'mqnakdoqxwnbwxda' WindowName: 'zhndmhvlvetbosidvgy'
ClassName: 'tacjtlpkjwpxyeayvtopdkrnla' WindowName: 'iwhhycfwqnsxqnvjzjxrrjghcphvpnylwd'
ClassName: 'rdzfywethhqptins' WindowName: 'wjhoxyirelrqogyhy'
ClassName: 'iwscldwzslwkwkiiuljxdwmybfwrr' WindowName: 'bhnwlunclslgnwkwgwqpqraucekipzyrgxaf'
ClassName: 'nvztyjhgsjebebwknwxfocwztg' WindowName: 'ncjyqonayudvzzmnudjzzrctdrixfuvhisqwr'
ClassName: 'nkxwkpjwwzsvsqcxpdlsegruozahlhpujvhjgxx' WindowName: 'yuighetkmkmnecaznlanxpiwnpcfhrhwpiw'
ClassName: 'eermphnwnlthjavbdqxdusfrdcoquz' WindowName: 'gjbawbrruiljzjpymmdojkbtk'
ClassName: 'wmygttcelsnyxwsvqt' WindowName: 'ryfgdnwxvjceklstmxirvi'
ClassName: 'vfkjrxjxungfuijyxwrdonzvpdqlgkqzjrkj' WindowName: 'xgundqarsfuvmjsrtdskohptptznzsoqsxrpya'
ClassName: 'zsvtqtidsnladfjyhxqjlqigkqeexgmo' WindowName: 'jwaszopkctidoljhc'
ClassName: 'syagqivkwualktvvjpggkrovryk' WindowName: 'dppvremsvisacaezoxisatjsjyosbxwgbvj'
ClassName: 'cpuvfyfrfyfwagqcwrnmphblmwcqhqtsc' WindowName: 'ecpxycryjpudstbzhhzrwozoptj'
ClassName: 'uaqpnrgzxeslzpacfbddhvog' WindowName: 'upbpwmkoqsgxzggu'
ClassName: 'paahdfagzqkexpyjdymafdr' WindowName: 'fdhpdrpcjfnukoypjzyoj'
ClassName: 'ljqqbmjdjffsxjadnwuknxxwdvngbumxygd' WindowName: 'rsxenhoybnksfunznlkywddm'
ClassName: 'glntzewkytcqoyuldbwochfghxwkhanujmlyx' WindowName: 'jtaknrucfsobszdptoluslpy'
ClassName: 'ywktlnqhamuqxieswblqcwa' WindowName: 'wpeiohnhiyabatfrxpyo'
ClassName: 'favtjjcbnldienmekpozbtyrljnwbih' WindowName: 'qpeixffilokcfsdgniqitxmvnkkvmlecgm'
ClassName: 'rgvlxgyqgpdpkzyr' WindowName: 'bdflwykjhjrdvfqcnsygbwzbc'
ClassName: 'wzwalkmeiebitbffmloxzdpuuxhucxk' WindowName: 'mzgkpulfedtmnygugvhttcvmruj'
ClassName: 'rvznzboczsgrcqqxfidfamiakwfjilftlnn' WindowName: 'zrczeszaawvjzcetpvoddyixivftciwiaih'