Trojan.StartPage.58484

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsl2.tmp\NSISdl.dll
%TEMP%\nsl2.tmp\Math.dll
%TEMP%\nsl2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsl2.tmp\System.dll
%TEMP%\nsl2.tmp\NSISdl.dll
%TEMP%\nsl2.tmp\Math.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ifbxbxgtflwrarikkqlngamhlxhzac' WindowName: 'qfnuxzlgnvzuiqatuxjz'
ClassName: 'eshloxmhcnjofscvrgzjcnzmtwsggoesroyklhd' WindowName: 'qtswthaxdtyqqdwitwhebisjkeslfji'
ClassName: 'yzhydbjywknanwgsghtftnqeuhngd' WindowName: 'gomygamuxnqsvrdbdzfogzrulylhnrlqqmvxdw'
ClassName: 'xyejpbyjwdolfxfypqhacfzqzeflit' WindowName: 'ekjddggveyohlybhs'
ClassName: 'vdltzdlqvqwgfaqkpruzmqdhnek' WindowName: 'xyxnpvfxsthkfbpgdbeovgiultyrkkkjs'
ClassName: 'dqogzldidyfjdpdgjdktzezicd' WindowName: 'hmxjvuyzfyglxjmjbh'
ClassName: 'brxncmzgocimfjbg' WindowName: 'mrcmxgnoullamafdemywxroczwotow'
ClassName: 'hkpxptrudctptvuwphpyok' WindowName: 'iarrvhazoszozpjwpnctp'
ClassName: 'yszyitdgidasepjwewnjhsrnkaamcqe' WindowName: 'owydubwxlzgzgjzvxazneuzvmodraqbdjelzfxd'
ClassName: 'ksbnuoxpsdbdynvinklnerq' WindowName: 'kvonfmxrrxtwcujufqn'
ClassName: 'xeoloaaclashmguqrmeakpgr' WindowName: 'bwfaxlynwbwucecohsirlde'
ClassName: 'jpshggwygocpvdgeljejrwxqqytqrfprwcfmjdq' WindowName: 'clehfzaizqfqolabehdtoadqsm'
ClassName: 'pfaoepkjhdzcohewlyy' WindowName: 'qxexgsaiidelmzkxtbmoihcu'
ClassName: 'qoapeamkdkgmaagglioqjqeuceancxbbor' WindowName: 'qtrjjtvpvcurhqzyhfifbyccfilomth'
ClassName: 'ljpygotapcjjofswnakbexrkjykybp' WindowName: 'vqclgyqmlodsvlouzyfkdvuoppuewpnmkka'
ClassName: 'hnryupifnxdhpwigml' WindowName: 'qgdmwuyzcjvxfxzcxvgqmxcwtefppcwhqaetsme'
ClassName: 'tjaverlqcemcixfizbnimpl' WindowName: 'ftzzsulfzczpemamlkwixazezrwcvntyyjbwwb'
ClassName: 'bbndidcevnnuwjpvxcdspdtuzryubqijarki' WindowName: 'zojhlwceeqwvilkshw'
ClassName: 'nqcezirfprolfhtptaazbubnghaichbgayh' WindowName: 'deusqvjfwsczkhiwtqd'
ClassName: 'tbbcxtmffkhngfqfvvojjvrf' WindowName: 'iglicjmuznlnhgxdtuhfolxdzjglfdg'
ClassName: 'aousrbmniyoscrttahlnbl' WindowName: 'xnpfohsqdxxvhgbhlwvusspxvyahtbksirbvj'
ClassName: 'bbimjoibcwagtklznnaskoqpeapmutwttfckjb' WindowName: 'sukepepcfawuvlduooxiyvouelcvbtxyj'
ClassName: 'xsxltczqtblgwbunaslzhbcefvvicdujjhq' WindowName: 'tintinwehkzefrjiivfhnsei'
ClassName: 'uisqlxlkaxpitabcislnqhgwjtpxpcwafq' WindowName: 'ycxnlabyogrlynreiqmyslu'
ClassName: 'wnslmwylcmhhvqjdbffx' WindowName: 'vavtlrzaltgschcytvnaayqhthr'
ClassName: 'rrwjwhovathvdenespamgnocqbabtwzyrukti' WindowName: 'mjoscwoiktzqwsbfszplxrpvhoiikxjqe'
ClassName: 'pqbfophprcecbylalrr' WindowName: 'nxxnsoiiwzpwrypsapqsxxorfqqwenmfobn'
ClassName: 'xlszzhbmckmbnntyr' WindowName: 'ymprtudjcqpqgwnokxc'
ClassName: 'eolmcdvzqijuaux' WindowName: 'aazxywxpydcffphke'
ClassName: 'pjntrfdxhsennrpxobjyjkv' WindowName: 'easgxforrwzluziomghotybvtemz'
ClassName: 'cvkdavtavivieozlvzwsbkrdg' WindowName: 'tfozbvcgkytuwflotbegabaqtavqjlmmuuokjpg'
ClassName: 'ilpalbljttryppzo' WindowName: 'prxotpcqrohursamnafbieidahqbxgskpefanc'
ClassName: 'gehseqtzmixrlaywnu' WindowName: 'veencvnshbegmmt'
ClassName: 'bwhtqapiooxbecpjhbodbydaxsqakjmqjua' WindowName: 'ucphfwizcstfifgvntxovrisbppygwwiywdeico'
ClassName: 'leibizqyzlirbfzsfjewpzpvl' WindowName: 'cwgxdaxxwqyqdftldvwnnxni'
ClassName: 'hpshtgtthavdbpfae' WindowName: 'dlrwdinrqxmpslgvzghzvjuzy'
ClassName: 'brdrfqhofdffeaodgpgfafy' WindowName: 'xzlhnrkjgdddpoybbnfexndej'
ClassName: 'gxhhmhryicyctxujfgsjkdyw' WindowName: 'fmvezsogbvvhqsbi'
ClassName: 'cdlriotsxpaabxzvobxwojmvdhqocnmvyw' WindowName: 'eiapmsbyaasbtpcd'
ClassName: 'wjiattgehsebbneqd' WindowName: 'bdurtbrjiquttlutg'
ClassName: 'gjudaczzlemxyrjuxgglcb' WindowName: 'fhchsbycvuzsdsxuiudedugsen'
ClassName: 'rifadxpwotzhhwyardsnzdbhme' WindowName: 'knpkvmmsamsfdsrrwrsuhpfyttxaqu'
ClassName: 'mdilsrnmwqudpgsszzjkttceuire' WindowName: 'pfvuucnhhbhhqivinvvyejzcil'