Trojan.StartPage.58662

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsn2.tmp\InetLoad.dll
%TEMP%\nsn2.tmp\Math.dll
%TEMP%\nsn2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsn2.tmp\System.dll
%TEMP%\nsn2.tmp\Math.dll
%TEMP%\nsn2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'sqcxxpebqpmukpbxehu' WindowName: 'boadiwsoghkbtarkpenjkviponkcbb'
ClassName: 'csmofytwwgbdaageam' WindowName: 'xybkultfartqtspzykmypfjczwqlpzrzfmyzeny'
ClassName: 'hoalajohslgeznpvtrtlqrpiilq' WindowName: 'ewqjtwowhfgjgsixulswsyuqelozz'
ClassName: 'qukfqyrpkiwkybpsjjcrwcws' WindowName: 'fthvqcxeykhwxecxrsyytm'
ClassName: 'yhfmmhovpobckgyjemyvxhiicomheeux' WindowName: 'scvhvdzydglcrtfd'
ClassName: 'zltsxwklailipktfz' WindowName: 'cnahmugvmxtuqlefgvzkod'
ClassName: 'dilzxhsivkcxbotrtiibalhcyzqxeagmxjrb' WindowName: 'ymdiopysgtresquqelpqobhijfpdi'
ClassName: 'xytsgranjilndpvvvsmhmjgigeseunroqwnlo' WindowName: 'meabgpiiyufpifpzoqfouobpahyipxoansuz'
ClassName: 'vbkvsrzpbnlzndopioethxvdhhskwxlatymbmd' WindowName: 'qtusmojzdssjxcxqkdheycnkinkz'
ClassName: 'iipbtymdyyzwfwulpqgpbn' WindowName: 'lgukbwfcskjnavkkysvnsgwymbighrpgoco'
ClassName: 'qigdlqexuikburaojmrfgyynbslvg' WindowName: 'cgqopbnxgjlztddmzarytoajm'
ClassName: 'npycgwvtuknwanqcpepighqonufimlcekxbds' WindowName: 'gyormzwelycsfucmngohsmhcaugyair'
ClassName: 'bxysgmwghuohaonhhzipvzick' WindowName: 'umnograznotwesjxcsapmggs'
ClassName: 'eloprrtfiffqsajjamsukqd' WindowName: 'yoanugoncorppebentdwqqi'
ClassName: 'phmjxhwpicwlpwipuq' WindowName: 'kluiaovvfxcllvewaxbiqvfgqmzuc'
ClassName: 'adinuaeynrofavxcasxdvvenbucf' WindowName: 'yqlzsmyasqytecttjsl'
ClassName: 'kjpuowurqfavzglghfppatjj' WindowName: 'anvfoxmktuijxqxkswp'
ClassName: 'kjgfpqaiqmmytgwqsqxoddamyuvsjaujbinwds' WindowName: 'ypznpfcrctbvlduuugilszutsgqwzlrfzc'
ClassName: 'agbtwhehrecgzzwseaeapgd' WindowName: 'wcmveqsjenpaemlmtikxdahjmcvdmcequypdlu'
ClassName: 'xzsudkbiamphlcwcgstaabqdyepppcalsx' WindowName: 'zvhmoxpxisopeicvbhcdjtleqgqkwutubx'
ClassName: 'wabcdualupwqmgcwvgrkbofgkmwfghazwojkem' WindowName: 'rfzbqjdiluxtpddc'
ClassName: 'auszkvofbzhavadzpsxwgitnvhbdx' WindowName: 'kjrbztpezwafjtsuezxryheeviqi'
ClassName: 'bvubpetqfcbcojcpszqkafpf' WindowName: 'oidzhlzfxpshjygfwashjwykdknw'
ClassName: 'qqhpultprhjlakyalemdzzscsbbqoklkvnz' WindowName: 'bvupdfcinpgkqwkgnlrylbtkqgedns'
ClassName: 'dmdjyubiihzqrobvxnqqfkgtdkxux' WindowName: 'kuwsmnlbhtmuyjobmnuphvihfdnzoos'
ClassName: 'nprfekrlkuuxwji' WindowName: 'eblsppcvjaumegfdcgklniigmforl'
ClassName: 'gtfsuthgwiuulcyimer' WindowName: 'wpclmdsgdktdppla'
ClassName: 'mwzuaagnwuiwlmjnapojzltrvcqnqtpboraoufy' WindowName: 'sjrvtaqzeyvfgxozisxpbzrybynbynpvhn'
ClassName: 'jtpugumzldzdhlctfctyszzqthlx' WindowName: 'owhebhrccecalvflplrhbjqic'
ClassName: 'nvbfihtujcghprydxsktlzwpsbbjcdlerl' WindowName: 'tnchzmsdegazippeqqnskmbmgdiswvipzqfydb'
ClassName: 'gmdmsawyavbpzmosa' WindowName: 'kbslaoebzyvcrvbeznbp'
ClassName: 'eqdyjudxayyfzyjbx' WindowName: 'ycwaemaxowhabxbnmyzljpwmnelhqolzjtvvvi'
ClassName: 'rkratgclbkgqqwonejrwt' WindowName: 'exoasmtsylwfidlcx'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'psiimwnjihfvozqumvczygkddvgolyyquul' WindowName: 'sbybxxyyqiefqujaixnx'
ClassName: 'xnqamavxynzgsobhidmzfwd' WindowName: 'nedhdutmtnyvdjbtrkzkgjzugbjckzfuehca'
ClassName: 'wstfloiwujokxmmagkvdu' WindowName: 'qesedoxxwptmctumcqrjrvxnbhrkpozosffxvgk'
ClassName: 'riwnulgsekwoioozpglnhqz' WindowName: 'iwjkkbkrhteiydkhrtxlpxgsuonbyufne'
ClassName: 'zxetqptxazilvjoadbkkfjhmotwrmx' WindowName: 'dcmtillxiyllttnwd'
ClassName: 'aouluexwplyvofg' WindowName: 'ycqhxdyctsvhtfcyy'
ClassName: 'dufxzbqyhskukkvx' WindowName: 'hiewtllptozhgzoioxgibihymatdgvvs'
ClassName: 'sidgeibtywnrbqvgielytkuuwmlpszoqgaqqg' WindowName: 'xegljtjiqscihvmsxctjgvoznikfgxwbdtzprw'