Trojan.StartPage.58601

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsy2.tmp\NSISdl.dll
%TEMP%\nsy2.tmp\Math.dll
%TEMP%\nsy2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsy2.tmp\System.dll
%TEMP%\nsy2.tmp\NSISdl.dll
%TEMP%\nsy2.tmp\Math.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'zvqxjqgjcnocypsjri' WindowName: 'hbfjaxocxqdevmzrzlkpxihfppakxcpofn'
ClassName: 'ocwyvvcjzowwbdiu' WindowName: 'hlvvtnomoughkgrntskleqzi'
ClassName: 'ruwwivyaatqsjxhxqfcybjrlqdv' WindowName: 'cquwtngfymkcprplksuxtouadfpv'
ClassName: 'psboebzslafpddbcfzqvrctpuhkqszdb' WindowName: 'aziqcmamhwdpqtmiwqgaggnkupqxwqdez'
ClassName: 'olvpghzzffstxqnivrjfagvgcwboph' WindowName: 'itvbccpngtldvvrimmkabuqupkgmdsf'
ClassName: 'nosiulvoiqxdplzhzcitiwkgx' WindowName: 'bssnbsczuvxzqhfgpmi'
ClassName: 'hmyqowrqbymaqusflxeyacudbi' WindowName: 'xfevcapdtzefoxrcpvqwoarpfhmjfglg'
ClassName: 'cwwggybxnhffjgu' WindowName: 'wmmqswdvuvwxwunvmkyhtogptamvkmfxunbjarq'
ClassName: 'fbqtxpbhlcixbtsr' WindowName: 'txghjwgwofetslcmzsot'
ClassName: 'jesnpnenhawlkjuxi' WindowName: 'dproaipdamqbknbec'
ClassName: 'jlszysfwucyzndezmagfn' WindowName: 'qnddswtvgjwsrnyhaobkfje'
ClassName: 'srkormsrjabftuxfjdlhvqycdkgnxocdsxtmzot' WindowName: 'kdlwcdcmsqphnssylceqqucsgtddo'
ClassName: 'ghmflqmnznfieyfckqrjvbcbv' WindowName: 'mqcvcblvczswtudddtmbsuxpiii'
ClassName: 'botarjezawpgzbufgwy' WindowName: 'jugeuvuvxlcxifnyuqvuhhplyzdity'
ClassName: 'ditnqsymjqobvuppqzohkdclulmzfwvx' WindowName: 'ngfkvnwwuhuzhqz'
ClassName: 'cwaicnpllrcqvwgadmcofcmrk' WindowName: 'jqrttsjemsljbcnfqcznjhczlrcnthyzckdp'
ClassName: 'avmiangmszwzlvyvscdnmnlfmzqxaxtmc' WindowName: 'ytdltjftfshggxxqrfkfqqpptqfaesdvxrovp'
ClassName: 'rkqvzfqzcskcrhimgm' WindowName: 'yknvhydfnlaseopiuoc'
ClassName: 'zihxlltqklsculhacac' WindowName: 'zaflbpztregxsbquljcnjwtjbjzksyryda'
ClassName: 'tnwbauudrcrrgamwcmxkkfzsqaksehmzosxywcj' WindowName: 'oyhkzndqweiruntavlbmdblgghxkgqjeffynl'
ClassName: 'msrquyjkurwoajsqwznviquiqtzihenf' WindowName: 'zwdlmhxyqjltqsvemqnqyftcwixugvjtcdehdyp'
ClassName: 'xpoulndrhbxsglmsmqgaikzeoackhelkurq' WindowName: 'rhsrvgemutgqwjlzzkujiatcxxhrpotuph'
ClassName: 'souortpvocqolfaplmdrv' WindowName: 'qavsqrvzqbxjuquhwtdf'
ClassName: 'eishnwuuxkervqikbngectdgusyxdjzidphtp' WindowName: 'fxxowkolhtirqnqbdenguximrhqvkqtnlfbsb'
ClassName: 'crogkbhwrrbmfepgbusyuwhglarwbcnwoa' WindowName: 'aiefrjzfaalgsaqaslxljptidzkznezx'
ClassName: 'sulyqkiwbhqxsrsltqmmvarpkatawkp' WindowName: 'svbujyhxrowykhfepxllhyz'
ClassName: 'wahzsdxzhdtphpoeqtb' WindowName: 'mcldvofuiprjkbmkyzttgbedt'
ClassName: 'eoliaflaenfsiebithltaxcpcb' WindowName: 'vfenskhjiryfnplhahfdagxjmtyehjomhee'
ClassName: 'dazaeqmdvulpvtsvyyfhkipugqtmkroxve' WindowName: 'hmfjrrqzqdrzopcobstlmwnajacuomssgqoeis'
ClassName: 'aemvhtyyoijqpruohhd' WindowName: 'yjrlguflzhhutywlbeijlfqztcrgysvvify'
ClassName: 'ciehyiqvwwdzgdtynpsjjoreonozvddtfvvfp' WindowName: 'xzxdxyecfukyejmmnqwtjqr'
ClassName: 'vrbhtlutpzshcdz' WindowName: 'dkezlpestkisffrpskentcfxbjlipa'
ClassName: 'qsszigbtadhrxsshkddicxxmexcyugueu' WindowName: 'puanjlfohdlqxiozoty'
ClassName: 'qqsqvqaqzvdtbnbnpmbiumfqdedxoltkpsxtc' WindowName: 'wfmwdyyvcplnaduvcwonvro'
ClassName: 'fuciolpautwytqivmqfveyx' WindowName: 'uwowiagcyhmwnsoomjbwcvafbmyokw'
ClassName: 'bfeehrdbojmiaaujfixjubbueq' WindowName: 'fiaczxscezgeyzhfubhjopnpi'
ClassName: 'uorwndrvrznemabqdawbvsdrndqlixhtazuyhjy' WindowName: 'webrgrpfdidzlamkmsu'
ClassName: 'laowocmrdkyjhzurgyjk' WindowName: 'cysfpzfkjvucerjccw'
ClassName: 'nczoppwvvoxtteaoeaceaubwddzmyrehtbfjx' WindowName: 'gkupwemeyghlmhjbmykmqrfukyxdykgr'
ClassName: 'jyivxbndhvfbgzvbxkvo' WindowName: 'dgtdmkacyvewwdxzsppaz'
ClassName: 'sbhnewmhoghowwzqep' WindowName: 'yzazsfrlilzqxnpbdmrtrzvixnctenglfv'
ClassName: 'dcmvosgzcfmabhyydm' WindowName: 'famligpsehzyaekwj'
ClassName: 'gbhxeupgpfrjbxyfmmbkflkwvvvktqy' WindowName: 'ihrppzumsymsdoomvswtzphnbxhjv'
ClassName: 'qfxzknfsrkrxfupjrszmlljmw' WindowName: 'ztjojbxhdxowktqmpatphts'