Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsv2.tmp\InetLoad.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\System.dll
Удаляет следующие файлы:
- %TEMP%\nsv2.tmp\System.dll
- %TEMP%\nsv2.tmp\Math.dll
- %TEMP%\nsv2.tmp\InetLoad.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'dytybviudzeqnymiikoljicnmngrey' WindowName: 'mqujkqqisjhvxxiymwumunkss'
- ClassName: 'wmggiecsrjivjqjymk' WindowName: 'xaxskzhpozlrgom'
- ClassName: 'ljqxqmwoyllcygmmkthctizo' WindowName: 'ytodgkhvdiblyczvclg'
- ClassName: 'bstmrghopnxiqyycy' WindowName: 'acdcanofbobhkpxxbzubub'
- ClassName: 'tnkisonwgpbvxwgwjy' WindowName: 'qvyklnrzitecboudph'
- ClassName: 'nvokmupucmvnfngqvq' WindowName: 'uuczeaqyiqjizklmcvioqyxsdlsetrdrhrjesi'
- ClassName: 'asjracbkwmcsrmweqcvk' WindowName: 'zdgaebuqzhnumjavujnpkbvlxusya'
- ClassName: 'hlpeamaoghcwmirolmdiynpnsh' WindowName: 'pygcvjjnpxoyujfmexqgg'
- ClassName: 'zdgkmqrsnzbxfzkqrhlsnjqgfobdmasokiuvv' WindowName: 'nfysddohxxirghtkihyaohhlkaqexss'
- ClassName: 'xluokajbklveuxpphhvnythoyfiwikqbw' WindowName: 'plhzxnrhdgmqetcswbavlawsybqxn'
- ClassName: 'zdgmwjxztjeaepqt' WindowName: 'mgdhypztihjvoxvgmmwqwlmd'
- ClassName: 'unmyjtsdmedkhffusuhiolfeefhqh' WindowName: 'rtdvhfrjmpferobig'
- ClassName: 'wagbpbvxhtuaidehq' WindowName: 'xegwmskksqdgprpdzavqzgygcbavteicbng'
- ClassName: 'lmwlblyobrpekmzhpocevjfiwtsfri' WindowName: 'hksnnsczfqrcwovollghbedpjvkpsciig'
- ClassName: 'rhapxdfwbvpqkqwvujusmkkhjcihdeupqycflvu' WindowName: 'yksoqirrqflnppngzdndc'
- ClassName: 'nrfjtbmljmigwexpmefw' WindowName: 'nrwzvycwpbwhbfhfidaiz'
- ClassName: 'ttkttcvfvspwqtqeynsneldu' WindowName: 'jceutwgriwsaigsjzyzodfhskutamj'
- ClassName: 'ehlarzqgsrymzbioldgcxldzhfouzegvipkwldc' WindowName: 'mwcezbnuoznzjntpihvuhkzfiwyxb'
- ClassName: 'wklcfmjyutdyahcftuhidasxewtjy' WindowName: 'qvxeurgecprflskwmykmsolr'
- ClassName: 'ohrnbgupuypmmrrvykdtdqjzun' WindowName: 'fjznwsvlkznphswahirfskpkine'
- ClassName: 'szqiikzcpavnlzytjdgkgeg' WindowName: 'uzokklyfnlbsglulxkc'
- ClassName: 'znxzpyttwystpzz' WindowName: 'byfkfauhasuudwqakltrirmhzgdxiv'
- ClassName: 'lgtzdmudkczcjwhblzxczybtcvckzrpsi' WindowName: 'vzdniwdbnwavfrpaufxhmmzpiqousxvk'
- ClassName: 'jdqplpahdoqymgqz' WindowName: 'hrlfqywcvbtfedqzalwaalwxzttfuvtj'
- ClassName: 'kdahwshkwmflyqkvkd' WindowName: 'ztbjleziorjvnrnaib'
- ClassName: 'wlyuzabohkyhfwcgjppun' WindowName: 'wbvmsqodmxdfgpbzbdnavfqaeog'
- ClassName: 'wcvgmgvudwvhpxqwejlydibjkpigtgh' WindowName: 'snvipoxdyexbhhgbpdsoxhyhvogxkjxfub'
- ClassName: 'eihosvknvtprgxydyscgec' WindowName: 'saaftrksjzkkkhttmketdgzaudvemogqerjcihl'
- ClassName: 'kscsztumonmrfdetyzdbotjyrjmqctqzimluxr' WindowName: 'sbotanupjhtmjst'
- ClassName: 'vycisetcraqkhsafimaqkpndqglmsgbpulo' WindowName: 'ejcmetdollrrufsgvpgrcaizrybjocpek'
- ClassName: 'gywhmrlcahzlmuddvsbglehmuozlucbjdaieqsi' WindowName: 'wepjauqinmyabsr'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'qvonmnckclzxbrbwhkuefkycoxkiofhwy' WindowName: 'wrtvhpplvulwgzzc'
- ClassName: 'xpmlkhdzotkreuysnifthrpfpqumz' WindowName: 'mfzizmkyztdyqttjhwixaezodesrarkmphf'
- ClassName: 'zwrwiyledcnowofrzwlf' WindowName: 'fjzpzlvwzrjmnvm'
- ClassName: 'gjdmmgrxutczehsno' WindowName: 'squyglfgbqgfoqlkzpxtklcpwfhczbaozkauq'
- ClassName: 'iktnyybitlqsawvasufoxeuxnbywijilvo' WindowName: 'zcjtanehcvwocgrrencwtukvhtjjfmd'
- ClassName: 'qrlgodxsvohanpvmroxkinafwshumljnxprg' WindowName: 'ccxviofumcjtsxrqfsl'
- ClassName: 'bufwmomlktpaenenjjnfhodqhmiekkloyzjsbml' WindowName: 'ttquneeuwdnkdvkgtpnjctcrnugvaquii'
- ClassName: 'brqtgddrappmvwpeuqwnisnrgyamxvmydqxms' WindowName: 'tafkrsoigvvpneyubtefxbyfnxbunxkzvgcxpp'
