Trojan.StartPage.58522

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsz2.tmp\InetLoad.dll
%TEMP%\nsz2.tmp\Math.dll
%TEMP%\nsz2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsz2.tmp\System.dll
%TEMP%\nsz2.tmp\Math.dll
%TEMP%\nsz2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'lbelvkrpljmdefnd' WindowName: 'kynzukmimlojjzoruvvpqh'
ClassName: 'mdvgfjmdnnpvznctnijpjcrfsiivenvkguwbg' WindowName: 'kljzhiyrsfdppdpdbxotdivumzkftnnjhpqw'
ClassName: 'cxehknwjdmxkuisonlzlwgirovezhegnyy' WindowName: 'zpuvtapwgttapjcsyoj'
ClassName: 'qqnkihjtohnfllrdanhrrs' WindowName: 'tbeptvbrzpqiihnapejmhbigmskihzwti'
ClassName: 'hjavfxbffifcbyjsruesmhhowg' WindowName: 'edopyicuejcgzdbodjjsvstrbehscqecfrofag'
ClassName: 'jzdqjpurinveeahbriyvowixdnnetpivwdl' WindowName: 'halkskqbyetlcdmjvydmtvoht'
ClassName: 'sjinuclowcdexaqv' WindowName: 'worotefxgwdwiohnshakftgdncrbxionnfaixv'
ClassName: 'vhmbudvezwqvcwljxqrdtvnaraycl' WindowName: 'rdywsnzrpzpmijrvpcrieozjizzagh'
ClassName: 'sauwlbioafxsqtofnryrjvzvtemg' WindowName: 'obybrrblqkdsjmhdyrn'
ClassName: 'tivmunolegxsazszcdpsqcqox' WindowName: 'hsbtaauiwsrepsquwzccjrwqnns'
ClassName: 'gjdgbujapfzldwjcggoltauhjv' WindowName: 'kxplfrlgdpjvonjissbzltvkjqocavfvcgtmq'
ClassName: 'gefezfaaaqxrzjjbarmmqjvhxnvzyemhmwv' WindowName: 'roivxrxkbqcbtehfjnzfaiugogflshwbcjdz'
ClassName: 'ihmaizaqmfmksnftojkvztsmxtac' WindowName: 'fjejzaqirhdqspahdfbjfirfcwjdekm'
ClassName: 'mkwbstesbgsrilthybtx' WindowName: 'humbcxidedplhayaerevxxtsrr'
ClassName: 'icgxaeajqqqcajbtobtehbdkrmeibz' WindowName: 'ynhsbvegftgsygkdjfcvfaxn'
ClassName: 'fgjhmnwjyuwenaowxfbqrstxkotyeyq' WindowName: 'lscmigeltbyqorbh'
ClassName: 'kmvatanzfrqybaaigyttivgwtjzkjbpolada' WindowName: 'jmdftbmvvyudwdhgtmasfwdvycirrza'
ClassName: 'nxfxpqywcvwmwmkfrwxpvswkeawnn' WindowName: 'bxgxprcizrxjddyg'
ClassName: 'qqwjhrcboprpadbhwyfmuflf' WindowName: 'lcblnhvetnvvkannaghxjfi'
ClassName: 'xoedqzjgegedfppogblwwqermqonstomvnkhns' WindowName: 'bborzdrdwcmfnthqxqiucbgmfcfgqym'
ClassName: 'eedesadibnohlhefzkkjq' WindowName: 'pltjmgwbsxsuztdmfsfnqjhqcrlv'
ClassName: 'gcwvlizufnoxrrdxuhvuwbfajiszhxvymkcfdai' WindowName: 'xxochmjhcbpfztvvbybrbvcs'
ClassName: 'bprnzyprwzagaezn' WindowName: 'wseefjsfzhaptsqukbjmurumsou'
ClassName: 'wncyiwdffhaxydas' WindowName: 'nlyyjihjvqdjlmheqpfuxmrawgrwz'
ClassName: 'xzmpgzjfbjaijbjtdvcchlf' WindowName: 'wrxypgnqtecixbsddeaaw'
ClassName: 'jrfcylnspwkonmaczlfivbejhekverpuxer' WindowName: 'kyyzzdyvqetoqpueeehk'
ClassName: 'kdmncrskeydyscuuhaiioteozpokhun' WindowName: 'qzkbfbicziymoxzkqlznqrrgtlfzqtfminbaufk'
ClassName: 'jvmloquknaeyasjfnszuhzym' WindowName: 'jdgcbhbnswgbnkzxpazrdkykvxddfrstmklaups'
ClassName: 'megcbpvuudowqblim' WindowName: 'pzbkaffxnlllwwwqbtzdhdormlulbhn'
ClassName: 'eukyhjiwhrvaffgym' WindowName: 'rztsuafegihwlzeesnmgneorzgetevsd'
ClassName: 'ayapetqjpgvotbuswqajjqnmadtyjho' WindowName: 'lkqjlaramsfkelldxvjkrdwhpxp'
ClassName: 'vonpjfeogymdhwgpcaolurrlxr' WindowName: 'vrfccnbsagvpptjfztjlohpnfuorvtbxqryzq'
ClassName: 'njjxutoychjiuzdwtumuiexynusnu' WindowName: 'pliaxawbufuajlomlbuhaagoivnlmni'
ClassName: 'tlzsesobtxrglacgpbn' WindowName: 'ckuupkzofsmwmvlvmusjatsmvbvwacpiuuri'
ClassName: 'ejwodnnaxvinxpxnqtcxpqseqdnalmti' WindowName: 'sifwtocapwuvwifca'
ClassName: 'cpjskqloxeudsion' WindowName: 'sxyauprvssmnwpslufacmruravhnrwqtkdnisw'
ClassName: 'bwkihzvxgyyvxubhvduyehlnptbdc' WindowName: 'uplfesrinrzwicxfbtovyvnk'
ClassName: 'utiufxtbojmbwqbbuoguh' WindowName: 'sfyxziwjsxuvgdewywnnqayotovytvlw'
ClassName: 'rqzrngzfumcyuopkgdknjhaasn' WindowName: 'iagoisxyvptubxyimxwujfzuhhuawhtmb'
ClassName: 'opbrdtqjtrnnwasxssxmarpgqnsmfzyho' WindowName: 'fdyhjqaludclgzdvxrchrozuh'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'qqhlijhktnrqnwxzsbackpcqosrrddizmnzqbyl' WindowName: 'tzfxhtoouppqvsomocwptchvjftsznzays'
ClassName: 'idlmmxsnfyilgpeitsyqajaqhzifate' WindowName: 'lewuljpgqsryjsgdmzjucllxizrfj'
ClassName: 'qvdgbwcsizusolyongezkkti' WindowName: 'ngjasfwckklsbnisqbeftq'
ClassName: 'iubnoqkubirsctcvsapnkazjlmeqjelut' WindowName: 'vmwcsulqjmsvijsyinaaipozbfuxexokpoq'
ClassName: 'zegqcmegzmsyert' WindowName: 'tsqhwtnpvvgcbbrjayffzavrdyiabcpttee'