Trojan.StartPage.58499

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsm2.tmp\InetLoad.dll
%TEMP%\nsm2.tmp\Math.dll
%TEMP%\nsm2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsm2.tmp\System.dll
%TEMP%\nsm2.tmp\Math.dll
%TEMP%\nsm2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735

UDP:

DNS ASK bi##.#antule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'utgxnyvrsfqpnbqiyrnagsfdquryj' WindowName: 'tepivnfwlkqofyhoq'
ClassName: 'ywucipfpslhvijejetruqhmxddnopkruxjoyut' WindowName: 'fsmocfsevrfkcynlxeikxfnyxx'
ClassName: 'fripsutquhetvxkzozzcwxte' WindowName: 'ydqhjadutgoilgqrwq'
ClassName: 'bwxjbujfhffcwqewklsaik' WindowName: 'abntkuhcczmyoysnbfmvgstlqdgmx'
ClassName: 'qjthndamxlnaomg' WindowName: 'uoedmaggeerqhrkt'
ClassName: 'cnzrmblkqssddmksrbkrulbyifzyevvt' WindowName: 'reigfhecxzmhmannwawmusymunzip'
ClassName: 'lavkflquxeuqvvxdfi' WindowName: 'crdhdjpvbmxmcmfqggcq'
ClassName: 'vuutmbzvyipsetjfligfzqn' WindowName: 'pwgdoygzrfcckadhnpktmoiqfbsmtqztpd'
ClassName: 'ybzmyelskquaxpucwc' WindowName: 'mmynvsuurwkfxfjmzopyxqzrybyp'
ClassName: 'zzsvtmmygsehymfgngplqyl' WindowName: 'tfnfermzgjdiakncbwunj'
ClassName: 'fqiquhiifkgrnvaegwn' WindowName: 'mymcsmebklzkibmc'
ClassName: 'eeopcdodkcxajpvondzx' WindowName: 'ezzmgjjztvlzlsffhtoflummlczsslsim'
ClassName: 'zebazupslgjacgdhciholkbqbbbqmxsyb' WindowName: 'adliemhfkesityhxcivlxzxllsqxdfbrhs'
ClassName: 'msnvcovnqgxjgfgbwkfazrvljthmsekm' WindowName: 'zhxkaigneljyfdbgjllrrnzbvy'
ClassName: 'rdtqyysvzhthcdsywdxxikxjschfuodgpgsslrt' WindowName: 'xmqkhqatghhuiufjvdltqgq'
ClassName: 'ztzqgyqihrheqlgglnyxhiqvdsofcgcq' WindowName: 'vxswxgcfikgecappujxkldkxbk'
ClassName: 'ohxvgkekjzeyftzbcmugsn' WindowName: 'bbwjwrzqowlommubyhkpc'
ClassName: 'jrukrpndrttbkmzxb' WindowName: 'xdfagdvojaeydqxrlkcjeaainlzzmaxsk'
ClassName: 'kvvoawpjfyhcmaqhjoakwk' WindowName: 'sptkdoaelnlpmnfddgukhtxqicsqdcpof'
ClassName: 'wekklpgvdyuwmipfdzrlvyxl' WindowName: 'dbnvqqrwvkmvrxsbvwbjsybczjdzenyrmzvpjl'
ClassName: 'ogckkjzdlcmoifcakuygkxubmgofaimbb' WindowName: 'reqpkweuocstzmsqsgrxkmsnjvb'
ClassName: 'tcuatzysslsvijvekwwnosjvqvlxeqthr' WindowName: 'nzbdbqsxgkysstzlmepfwngceyvrervibzv'
ClassName: 'oiuikecknkhggtoawhldgaoakariuziqvtbjytp' WindowName: 'knckfhpwqishxoghpwxvohvxfscjwistflqayn'
ClassName: 'lxomiowhwsrzflqyxynplghnfbwrkaq' WindowName: 'kqwzuszbheekvdvwxrvwounuaafpyhdfakkw'
ClassName: 'xhgohlkjiehdpksidelsjazmastdxyjlqq' WindowName: 'pityarfxrwhbozymdczwri'
ClassName: 'ejxguvxpbhpddqy' WindowName: 'afduehxlqhdlubfgizvmnpiajkmvilpwh'
ClassName: 'dqijlzhkxllugrrlktcrjakhqdmtxk' WindowName: 'cnfwuamasphdynbxzjawthtiucjafdfuygbjl'
ClassName: 'kpjfofoxdxwhirdvaiuaqbsoleacrk' WindowName: 'pxtxkkmaumvmihcdcxdahichl'
ClassName: 'rxsecexroopfdcgmtkmnqzugwszh' WindowName: 'krvbevwoufwuwxvkklenm'
ClassName: 'abjutrsxywqimdwiemshlnxvvldalpty' WindowName: 'hcpdehvldmyzbwb'
ClassName: 'ufgrelnvgutfmlwbzyqnmv' WindowName: 'ewppmwbxfbhmopcphtxzoyttgcsieydnwo'
ClassName: 'mfnarbkrfnsppmsumipwydbknuwwl' WindowName: 'dkwvyvpinxbbbfmguvabmehupxjdgrxqchg'
ClassName: 'xrrzicrodcmutsysxlbbkyvopigixb' WindowName: 'eezunmsyfpwfdnyfb'
ClassName: 'qbupxypucezyljrduvbqvsdjqgdfneeqjwqvr' WindowName: 'xzeirysahlldkohzxlf'
ClassName: 'qadrfdchxdmoxekpdmierdmofhkeeuakdi' WindowName: 'lqmblpknzuwhgvitnjvhxdxtldxywt'
ClassName: 'jaioiqfamahqdogq' WindowName: 'rwlqnhqqwrhlxgaogzrxosasvkkbbodegavy'
ClassName: 'jfebjsakibjwleqwirvnyqevjey' WindowName: 'xkrozshygmmufspqvjlypwraiugoyzr'
ClassName: 'lmwezmvovacgvwusgvatlukq' WindowName: 'njqlzhswnsjvpbpjiuajxqletoc'
ClassName: 'cblpayreavflavkfdftsvynro' WindowName: 'fkoydijsmrdfkaocgdavcqrgqlwnynmy'
ClassName: 'gnunltzykwzwdskcmuwsuyapnerjlpxemcgmi' WindowName: 'zczllrjataployewicmcofgyyyfdeunfkxymo'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'