Trojan.StartPage.58454

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nss2.tmp\InetLoad.dll
%TEMP%\nss2.tmp\Math.dll
%TEMP%\nss2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nss2.tmp\System.dll
%TEMP%\nss2.tmp\Math.dll
%TEMP%\nss2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'plmeljafvbkpfsxxqnnmuthmepcpdlry' WindowName: 'mwizxvrxxtfqweaaoudpnzkktrbtdiznuezqxxa'
ClassName: 'auucbfbleklvncoxolhofy' WindowName: 'ntsosyzqgwiuqvrjyinengdtzdqnfj'
ClassName: 'fcgfjbfggogfhjnccc' WindowName: 'omygqmamakjdqgmdfsxkiwktyqpziiee'
ClassName: 'jwstdxxhfajvlzi' WindowName: 'gxhprerrqwljvustw'
ClassName: 'rjrwjrjybtgiqcppcxxsztqwvpfse' WindowName: 'iaqqbimbuenabvuxyhousxs'
ClassName: 'lmnnwthdojoanhvpqkvvwruettyxzcbfryaz' WindowName: 'tlytfoqupraqxekf'
ClassName: 'armxvzzlhftotitesqksvqrakccl' WindowName: 'yfxmpmunfttjybswkvfztzvmqfjmwbaj'
ClassName: 'sygxjuzwomltvngvlxbldkgsrori' WindowName: 'szuhmqovxfjbpaqvclnqbqbrxfu'
ClassName: 'wojckbpatoencsvwruipbpkqpgqejnr' WindowName: 'gtiomxeysfedsizumayitynprczath'
ClassName: 'dsvovywiefadkmfcfixshwaztbbeyks' WindowName: 'hawkxxufyynzlgtualnhlrkrlrleunrkvfxgs'
ClassName: 'qhhxyvxabpsqogwltmzuwlktdstlbpriahlv' WindowName: 'ulehmnjtwnqlhudbmhesprporj'
ClassName: 'pltjdupoetocvlhplhglowivhqwogz' WindowName: 'havwlpvtoznodvkdmvvkdposfkeucvmdp'
ClassName: 'afvinrmbjfmxquocajxm' WindowName: 'nksvdammqzdtdnkqj'
ClassName: 'rclbucdexjhlvzesznykezbsitpoypemoropr' WindowName: 'bxkkctzniefiysy'
ClassName: 'iydvofecqeokbglqhktnxgiqspjkb' WindowName: 'pkhbbpychtzymmwqhjhghlkmlnf'
ClassName: 'cshkdltzxijmxxvt' WindowName: 'lmunffbwiaqmxrjinuulydx'
ClassName: 'pwvnpydioslkoepplkgikjegmewiuerqjxvcb' WindowName: 'sjejppvveafceoqffinusczbggqg'
ClassName: 'piakxuoepplklonsiawv' WindowName: 'jasxraoscpcixkmjartfgmeqaejw'
ClassName: 'ynjucoeueflchlx' WindowName: 'xlegpaffvvmvjtdpttmcidzmotccqwfjpv'
ClassName: 'nfghxrvqnhablhxvjlfbeukzixx' WindowName: 'nzxchitvpshiaritmdyezx'
ClassName: 'iixvtforgddfrgmvbxtuqfhvcbilxpgz' WindowName: 'gijnfftgdogvqexqsdkfzoaycs'
ClassName: 'twpnfckgvxkwugfrtiihwhfd' WindowName: 'wuqtgcpkiccmtxoru'
ClassName: 'zlrrjbmtlhsuynkvrkipmzslkvvgawnmyob' WindowName: 'mfunnamcbdogndimfwyrisbfqkapgnyy'
ClassName: 'pbxztfmmyklpnuv' WindowName: 'qqtvpawskagoevtknjzotwrmpuyn'
ClassName: 'ppjedqxgrpvuzjqqovozjukratgnrrlqn' WindowName: 'xvqwjmmvoxqihtpdqwrfhvvojllwwdiftjbggi'
ClassName: 'bdezqnzkwebuwvb' WindowName: 'uuzvpwglzueddkq'
ClassName: 'igzpkqxbhxeagej' WindowName: 'wmoozcqnqwyrgteisktoe'
ClassName: 'erkseogzufmphphqfdxupwr' WindowName: 'zwtvagdrcbfhqcydpi'
ClassName: 'uwezyamzlxxuzdxucqyiidhuvht' WindowName: 'peepzexcjeaxtleldnxmj'
ClassName: 'uzbasbzambvktqhxq' WindowName: 'kxbzoyxwezchsrukb'
ClassName: 'juzlfrhbowrogwckmnymdij' WindowName: 'mybjtxfvgsokrwuubzipmjbzklpkdjpzd'
ClassName: 'neamgojjrlzkghainxttwi' WindowName: 'fudugbybnlooglcgj'
ClassName: 'gecpwhveabfxrtfkfirtyhvyydx' WindowName: 'pvgcfahabeprqloffxpzafwwofupincsekawg'
ClassName: 'egdcjhodvbevpsmgsq' WindowName: 'niydmxqljpplvejplnlgb'
ClassName: 'vwwxidadwyczlwywiwnnx' WindowName: 'vstkamzpugwtfphfooehtum'
ClassName: 'nbuorfpqkakhvnllxoivixtvewujrlyc' WindowName: 'uqszmzmfmybcesbiaqkcrqadbw'
ClassName: 'rmxmixvdsgqjusalysmdmdjcnsor' WindowName: 'wsiiryhmehytkzolnusozoehrdmcwzg'
ClassName: 'eanxfrrnologixtelwcjzgpx' WindowName: 'mduhbrxywfqzrkogslhfgzuojaagzdkogginu'
ClassName: 'blrzspquehzfibgtmebrcs' WindowName: 'ikutjoezuyskdfkwcbghynqgauskisgpjbdez'
ClassName: 'hmuxandasqrdijyqexmmmnaxia' WindowName: 'tvjssrkxjhwbdxrz'
ClassName: 'feivgsqlnsfhmgzs' WindowName: 'kmtohuhkginkiwdaevhdy'
ClassName: 'yyansekjyyacqagbzww' WindowName: 'imisnbjagrbhfixkegvxxjbvso'
ClassName: 'yaqodmszcqfledrardfvifleoinxuwsoulx' WindowName: 'vbxrfkvcaqvqvdvfzk'
ClassName: 'lmffamcicluggcjfudvcvwoyfywtdscpainogwv' WindowName: 'xxevrcoovhatrjmvrcocrargjxi'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'pryedjzcrqoausc' WindowName: 'duexqlpvoujbrzmyckbfppqasmiyyvvyiwduxq'