Trojan.StartPage.58475

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsv2.tmp\NSISdl.dll
%TEMP%\nsv2.tmp\Math.dll
%TEMP%\nsv2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\NSISdl.dll
%TEMP%\nsv2.tmp\Math.dll

Сетевая активность:

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'hvsqqpbtgcvurtaopkqingpqeyyyqaq' WindowName: 'uxntovyagdxixzznjyuomaxvyasiwsoaldxtexq'
ClassName: 'uysuylngznpyxswjiyndulvfgpte' WindowName: 'htgtekyzyvxbxdllsxboujui'
ClassName: 'hbchmulttqghvsrejgovcuclevidl' WindowName: 'bgemyfijiejbmkgbmzlpcljeaqjbldvekqmuqrf'
ClassName: 'lscenrmdroomhmjgywztij' WindowName: 'sapsohefdtzscxpstwd'
ClassName: 'mwpkavjnmmzqoawrtxffkhpiwlj' WindowName: 'hkjjlvltnqosuhensnrdpvfkejbgjnoro'
ClassName: 'quctwmyigiqediillhiwuvfjilvmfhqlxra' WindowName: 'jscczjgiaicwswjmluzfkmcnugkblpewvdnabi'
ClassName: 'lbrycpyysgnenfbwwhaqsniznlhmomknqfrzcvn' WindowName: 'bzqkzjbrmghkdyxaovwzxujgjwzzkliqfh'
ClassName: 'xchpacsifuaiucb' WindowName: 'ufxuzuvikrtjhpurygz'
ClassName: 'dwudsftjkzvnvujw' WindowName: 'vpfyrfeysjkljmuaarbtsfodszrzkojuolcbign'
ClassName: 'zotffyndlmvlwbjzdmzjmbvrxhf' WindowName: 'ksvscdcczsfsddh'
ClassName: 'xdaweuetdaokmjooxqkxzmcvxe' WindowName: 'lnvmcdpxunntukqvbsyqttmo'
ClassName: 'dmpopnsavzuvyrxqqklgecwj' WindowName: 'hihjwqtpopjryvifdcjry'
ClassName: 'plvbsqqmbvfhxgbse' WindowName: 'kuwuszkrzuvjqwoo'
ClassName: 'lqotxatqyfouroahwdqtdexfq' WindowName: 'vfprfppksdnltvwccwvhjbwkaujbolbnp'
ClassName: 'hgqhpgfwxonnlorsjjrvpewvxfxvhkcowifu' WindowName: 'bpbnmtwzofkpbaesozfipbujrdjxgz'
ClassName: 'hdurqmfbxrwjxnptorqyeiijmftxckqklghnbl' WindowName: 'ffuhfdvuotwtxhcbatffwkclhzcast'
ClassName: 'pmlixribqjrqvjrhrhhbnxxeby' WindowName: 'ypdbffgyvbopgaoppotadnpouhknh'
ClassName: 'awtyqebevkopurabsvqmdefmxruuicfpsj' WindowName: 'flbneajklwsclcfgywtyempqvpbzfsvik'
ClassName: 'ehzbztdwjljolhkcwmnufh' WindowName: 'daqhpddhlmogwbuqvzxorczcwwjgqbbtaml'
ClassName: 'yfrjretngksnuzykzyoshml' WindowName: 'gbpccfralvnlhimlzzwimffb'
ClassName: 'gssrvmvchhacwbutdqktgoclfvdwase' WindowName: 'hgedpkwstbcnkobjlimt'
ClassName: 'tcuakikgaziabssvabbkwwibygxogsamwi' WindowName: 'nwxyrppzblzivkjciayntm'
ClassName: 'lcnmhxqwuaqsakpl' WindowName: 'netwphullrwdhczzoykvdsebicnkzqadt'
ClassName: 'iqkcdwvqxlvkpwuhwonnyoppfrwnempgllkwiv' WindowName: 'mzrjluqutzozaqbtzar'
ClassName: 'duyekogiujjpvdyrxgejdwlajwawkbiixyqr' WindowName: 'ounbifdklargnhrmorgcmwklnrogkaxiigbgql'
ClassName: 'ttbgtikgqnbymoius' WindowName: 'vlvwfoafbdentkvlsfhwjkintrtvmz'
ClassName: 'qdozajshluoffnjfhxiitellxzyilxn' WindowName: 'oeeoxhdsklsmlsrwcofglerc'
ClassName: 'mdxjmivjogvndfi' WindowName: 'bhppmgperzqqsczsbarzuxxhwnifhzklzfpqglm'
ClassName: 'qqomukdeyrspyvnrqeibojciblgmaw' WindowName: 'mybiezszelwetrkikijktklb'
ClassName: 'kfprxkaspadvbepychxruovssbzvjtctfil' WindowName: 'apuxymafhvfbwgcamyvlznrsz'
ClassName: 'qtburuzyqivrcyuzjjjguuhovqcfsmyybsfqe' WindowName: 'egniijfowuweahvuaqlallsemxmagxtj'
ClassName: 'vxlmouwmeknnmtl' WindowName: 'wbagajlhqccprtxfxnaxdlgjtgzinbmnrsxrodr'
ClassName: 'qkogrxsgsodsodsbcjkjegfxgpwxzcn' WindowName: 'eswgrhyvlhzqcty'
ClassName: 'pdcshxximlhwnjt' WindowName: 'jkxkecbdihwzwbelwiutrdivgpf'
ClassName: 'ktyeljtnkxokgpeqrknjydozlcc' WindowName: 'hboeiqtdyswrqasmehhxhmtwkylaemtj'
ClassName: 'mdqjldluofadaurmvjcfgqwstfuv' WindowName: 'vtdvqdmrszhyeaww'
ClassName: 'udghyqmjrlfqukipfbwniwytnnilsqtmc' WindowName: 'eukvhpcbqvdaaqruknatkpgewfrib'
ClassName: 'lctbgkgzohohbgzqpald' WindowName: 'jkaiiibwaliefmnj'
ClassName: 'qnmbetsvkjfkcxjxrmrsrbhj' WindowName: 'rzsmseozsqlyikedodkivcjlmhdcrrdo'
ClassName: 'gypqxikgkbtpkcu' WindowName: 'owtzzvqsalgkouyzxjpvblanawm'
ClassName: 'ydghuyckrvxmzosnkyuqonhrwirozambn' WindowName: 'fpfbirkvxsfsccmsnhwboazfsravr'
ClassName: 'yudvtbperltgfqxhpipligyvkfjdfmadmhxfr' WindowName: 'hkjwmrnivsldbwvsbnldqhkwwld'