Trojan.StartPage.58289

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nss2.tmp\NSISdl.dll
%TEMP%\nss2.tmp\Math.dll
%TEMP%\nss2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nss2.tmp\System.dll
%TEMP%\nss2.tmp\NSISdl.dll
%TEMP%\nss2.tmp\Math.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ivuadwakkhlszjlmhjqmwbrcyvbnv' WindowName: 'dtsxdordfrhqurco'
ClassName: 'efazgxpohmvtvchzorchavuxuzkxuj' WindowName: 'jzqsowvxtvmhigdeydbbmilzeot'
ClassName: 'ldtwiwkwmjnqyzsicvsprrrmhcqk' WindowName: 'kchikduqwztpxqdbgamsaxurpelx'
ClassName: 'lirmxdacphcrhunumsfkloxvjmy' WindowName: 'mdokybcodrrhbkrezmltdoyzldmoxe'
ClassName: 'bzhbmyzajmhmyxx' WindowName: 'tqfdktrlgchcivjawyybqweatvxf'
ClassName: 'buogblbddpzgnffmdmwjgenyxhkynffumubhsy' WindowName: 'elrsnuzsxijtwrxn'
ClassName: 'nfvasrvxcbeinjlhmylamvyjghk' WindowName: 'gphlrqzmytwcmhethflyhdkpriazfamohrbvqye'
ClassName: 'bokpevgohvdzjcamgcoonpwqqgerfwhxdp' WindowName: 'wpuhkjsnmnwaogjezsqwiagaopcxoxjatck'
ClassName: 'ruzhtppgrypkuzrraqbkhegblzi' WindowName: 'amasryymuwqoxcmalvagmjfnluenknnacwnaf'
ClassName: 'xvjqdypymyjguphhzrxplpkafpx' WindowName: 'cbyxvjpfqykxqkprnknmybobkjorhe'
ClassName: 'onszlxgizzwihwwgizqedtczmirybi' WindowName: 'qgcjcfjvgfnsfrbyibhlgkugevsrxrylpxwoty'
ClassName: 'xoexrojyknbifabpdkwyndyznu' WindowName: 'xnkcaxbphqkhltgswnb'
ClassName: 'olagvzvapagbbaoonprzxiproi' WindowName: 'zmbwtlbxwmdufulrn'
ClassName: 'gxvqdspylzshiwvowpatagxwtnrpfcnceizwi' WindowName: 'foxblhyadtfecaorabrtqkmrcjdeokycb'
ClassName: 'hulwyjkmtfghriduqcm' WindowName: 'lmwngtlbmesmmohwdrrpbktsvxpqhbbii'
ClassName: 'fdvpuwghwpfuibbsdvzlmclowqyt' WindowName: 'wfjglrpxgjsrckyxwrgeztnsxmfazh'
ClassName: 'ncruptdrouyknfviutlzf' WindowName: 'zmlzggqctsyxpfgb'
ClassName: 'lyfubwkexujvmcgpcaluqcngxa' WindowName: 'orepusjuclfkpbcuvjzu'
ClassName: 'gqhhjmlnezqvhhhltgcspcb' WindowName: 'fwcevuqmrowxkckpz'
ClassName: 'vaxhsfiaxfsyvnhafobqtayjmhww' WindowName: 'ghozgiehyercmxadx'
ClassName: 'ogdezfbfcluhdkysyrrhfebi' WindowName: 'eelovczrelzfiewajaxgeqlpijxppzx'
ClassName: 'xnvdiyialtfiumhveqfijnwvvgsnjs' WindowName: 'mpaqezbnqhwrebwmc'
ClassName: 'zkzuzwdgbrcqsnedngbbjwufzptn' WindowName: 'dwptgclbjfbdexaqghfhyzgg'
ClassName: 'fgvdtdmcvfrojquwgrobb' WindowName: 'mwpxxwvgcvnuistosetvsnbijtzdegnaem'
ClassName: 'ttisqmxvravwcymgwexyaomvr' WindowName: 'inlpgrqacgzalgomnjq'
ClassName: 'sdcenrfsajbjzvzlgeats' WindowName: 'mdjjyepbhcptvoxwsnqhpevriyqit'
ClassName: 'jdbjhiqzchdcwhmxupzscecqipv' WindowName: 'utfsydlmwymxexirbquicllhdfpiphft'
ClassName: 'lbgruiqhxqzdeprkodwzk' WindowName: 'xvaerbbvqahbdalaxclexaqalzexguely'
ClassName: 'fdibenpubqmeoncmcsihukkfvbab' WindowName: 'ehkwpobnxoebubujbwawhkmyutguqsujtvisncd'
ClassName: 'lfmrcyeucxuioztetbzwdmfxtgfjtorgcszjsv' WindowName: 'tofsrvikorkvigtmknrerkqxfqs'
ClassName: 'ucbyjkjqommdqgodcbhnlhjxq' WindowName: 'hkmvgfoegassnflshavpuqcqvnbjqnejooh'
ClassName: 'dtzticndliruibahhyqtitvtoncfkyt' WindowName: 'dhwdxnxkdueczmmviozgfg'
ClassName: 'dyzsmaetyhemzrokkunzzveurbb' WindowName: 'glpztmeqndorujzpijjaniej'
ClassName: 'pzaxkuaujuvkeaqyyavfwstforchjjyp' WindowName: 'ggirccbziffvkzreyuqwts'
ClassName: 'bibamsgvtccyakqjdhjvxsmybtisycnuhluyeo' WindowName: 'mgukokwgldtrrpbxzrytvtoylp'
ClassName: 'rnimvwnqlazcuddffmumerynqwelkifyhyba' WindowName: 'ptwhtmgihkynvqimusmkcjupeokjrnf'
ClassName: 'alpehwknftmycygchyrvwhhisfqbnccttlma' WindowName: 'redshaopxjysbukvagdbgfuwpmlz'
ClassName: 'xwmuymvpucwipqicehszcbxvqlktnzbs' WindowName: 'hhlipifjctspxbvtvvqcec'
ClassName: 'decwkleuwbstwngpbjue' WindowName: 'iptfpwnjlzvggwbvvjkrflxlynbaaoxteinbbch'
ClassName: 'xylkjxcswalggsoicwilcpo' WindowName: 'ipnbgfltszaagorpgtiqspkczsblmtfhcjmygpg'
ClassName: 'gteokktdzxkhbptjuqtfz' WindowName: 'gyicekkzadqfynvmzdmrecxoytwcci'
ClassName: 'mnyjlioslfxrudusdfuvwvsndkgq' WindowName: 'ueqwyhbecmpcrdpyrhuglnjqoq'
ClassName: 'ufviepuyzsrnhjixaxaug' WindowName: 'mitwdtsnqyqdekmvvppsssppowgduyoxyx'
ClassName: 'gnltmjbpzfsxjfsr' WindowName: 'ggwxgoizbgyayafrzmdoezyqgejerrgvciz'
ClassName: 'wxftpjzicxfgcbtbpxemayxvsctk' WindowName: 'mhvtxsubxmxfkrqpmilkqpjcxugbjzwrw'
ClassName: 'fbovtnjkxcyfydkpuaujwccix' WindowName: 'jxnlbkzmafkolijhqjnkfohivhhtosyonzniffr'